Snapshot 44519
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Docusign Envelope ID: D2E80E57-D685-423B-AFA5-B3B7367E66E5
DATA PROCESSING AGREEMENT
This Data Processing Agreement (the “Agreement”) forms part of General Terms of Service (“Terms of
Service”.
The Client and ClickMeeting are hereinafter jointly referred to as “Parties” and each separately as a “Party”.
Whereas:
1. the use of the Service may require ClickMeeting to process Personal Data (as defined below);
2. the Service – in terms of the file and recording space sharing features – constitutes a data processing
service and its use leads to the direct or indirect generation or co-generation of input and output data,
including metadata (“Exportable Data”)
3. the Client is the controller of the personal data processed in the course of using the Service (“Personal
Data”) or acts based on an authorization granted by the Personal Data controller as a processor on
behalf of the controller. The detailed description of the type of Personal Data and the categories of
Personal Data subjects can be found in Annex 1;
4. the Parties wish to make sure that the processing of Personal and non-personal Data complies with the
applicable laws, in particular with Regulation 2016/679 of the European Parliament and of the Council
(EU) of 27 April 2016 on the protection of natural persons with regard to the processing of personal
data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”), as well as
Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on
harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and
Directive (EU) 2020/1828 (“Data Act”), and other applicable data protection laws;
The Parties have decided as follows:
§1 SUBJECT MATTER OF THE AGREEMENT
1. The Client entrusts the processing of the Personal Data to ClickMeeting and ClickMeeting accepts the
task.
2. ClickMeeting shall process the Personal Data: (i) in accordance with applicable laws and the Agreement,
(ii) exclusively for the purposes associated with providing the Service to the Client and to the persons
authorized by the Client, including participants of online conferences, (iii) to the extent defined in
Annex 1 and (iv) in the period from the commencement of Service provision to Agreement termination,
subject to §7 hereof.
3. The role of ClickMeeting shall be limited to providing the Client with the Service tools (functionalities)
to be used for the purpose of Personal Data processing. ClickMeeting does not influence the scope of
the Personal Data processed by the Client in the Service except for specifying the minimum scope of the
Personal Data required for the proper use of the Service, ClickMeeting does not establish the purposes
and methods of their processing, monitor the scope of these data or the legitimacy of the basis for their
processing, nor does it check if the Client processes them correctly.
§2 REPRESENTATIONS OF THE CLIENT
1. The Client hereby represents that they have obtained and process Personal Data in accordance with
applicable laws, including the GDPR. The Client confirms in particular that, where applicable, they have
(i) obtained and hold the legally required consent to activities and operations of personal data
processing carried out through the Service, (ii) information obligation and other rights are exercised
towards data subjects to the extent and in the manner required under the GDPR, and (iii) have the right
to process Personal Data and entrust them for processing to ClickMeeting to the extent and for the
purpose defined in Annex 1 hereto. Notwithstanding the foregoing, if the Client is not the Personal Data
controller, they confirm that they have received the permission of the respective controller as required
under the GDPR to entrust ClickMeeting with further Personal Data processing for the purpose and to
the extent in question.
2. The Client hereby confirms that the technical and organizational measures described in materials
available at: https://knowledge.clickmeeting.com/privacy-security/ implemented by ClickMeeting are
ClickMeeting Sp. z o.o.
al. Grunwaldzka 413, 80-309 Gdansk, Poland
KRS: 0000604194 | NIP: 5842747535 | Share capital: PLN 1,187,500.00
Docusign Envelope ID: D2E80E57-D685-423B-AFA5-B3B7367E66E5
suitable and sufficient for the protection of the rights of data subjects, and the Client considers
ClickMeeting to be providing sufficient guarantees in this respect.
3. The Client acknowledges and accepts that they are responsible for secure use of the Service, which
includes properly securing the Client Account authentication data, ensuring the security of the Personal
Data while their being provided for the purpose of the Service, and their protection against
unauthorized access.
§3 THE CLIENT’S INSTRUCTIONS
1. ClickMeeting shall process the Personal Data exclusively in line with the instructions given by the Client,
unless the European Union or Member State law requires otherwise. In the latter case, §4(5)(a) hereof
shall apply.
2. The Client’s instructions are given and followed through the functionalities provided by ClickMeeting
in the Service in the period when the Service is provided. The Client shall make sure that any
instructions given to ClickMeeting are in conformity with applicable laws.
3. Any further instructions that go beyond the instructions defined in §3(2) above must pertain to the
subject matter of this Agreement or the subject matter of the use of the Service , as well as be within the
technical and organizations capabilities of ClickMeeting. Should following further instructions generate
costs for ClickMeeting, ClickMeeting shall inform the Client about such costs, explaining the amounts of
the costs, before following the instruction. Only once the Client confirms the costs and covers them is
ClickMeeting obligated to follow any further instructions. The Client shall give further instructions in
writing or via email, unless urgency or other special circumstances justify giving instructions through
electronic means of communication. Instructions in any other form should be subsequently properly
documented without undue delay.
4. ClickMeeting shall promptly inform the Client if ClickMeeting believes that an instruction violates the
GDPR or any other generally applicable European Union or Member State law, and shall request the
Client to withdraw, change or confirm and explain the challenged instruction. While waiting for the
Client’s decision, ClickMeeting has the right to suspend the performance of the challenged instruction.
Where following the Client’s instruction, despite explanations having been given, would lead to
violation of generally applicable European Union or Member State law, ClickMeeting has the right to
refrain from following the instruction.
§4 REPRESENTATIONS AND OBLIGATIONS OF CLICKMEETING
1. Considering the risk of violating the rights and freedoms of natural persons, and considering the state
of the art, the implementation costs, as well as the scope, nature and context of Personal Data
processing, ClickMeeting hereby represents that as per Article 32 of the GDPR, ClickMeeting has
implemented suitable technical and organizational measures to secure the processing of Personal Data.
The description of the implemented measures is available at:
https://knowledge.clickmeeting.com/privacy-security/. ClickMeeting may at any time change the
implemented measures, provided that the protection level they guarantee is not lower than that
guaranteed by the measures applicable at the conclusion of the Agreement. The information about the
current technical and organizational measures along with the information about any changes to the
scope of the implemented measures can be found in materials available at:
https://knowledge.clickmeeting.com/privacy-security/ or elsewhere as specified by ClickMeeting. At
a justified request of the Client, ClickMeeting shall give the Client any further information the Client
needs to demonstrate its compliance with the obligations defined in Article 28 of the GDPR.
2. ClickMeeting shall secure the Personal Data against unauthorized access and unauthorized seizure, as
well as against damage, destruction or loss, and shall take any necessary steps as required by applicable
law to keep the Personal Data and how they are secured confidential. ClickMeeting hereby represents
that all the persons authorized to process the Personal Data have committed themselves to
confidentiality or are under an appropriate statutory obligation of confidentiality as per Article
28(3)(b) of the GDPR, and ClickMeeting shall be liable for their acts or omissions as for their own acts
or omissions.
3. It is the responsibility of the Client to satisfy the requests of Personal Data subjects and to respond to
such requests. ClickMeeting shall reasonably support the Client to the best of its abilities in the
discharge of that obligation, in particular through the application of suitable and possible technical and
organizational measures necessary for the Client to enable individuals to exercise the rights they have
ClickMeeting Sp. z o.o.
al. Grunwaldzka 413, 80-309 Gdansk, Poland
KRS: 0000604194 | NIP: 5842747535 | Share capital: PLN 1,187,500.00
Docusign Envelope ID: D2E80E57-D685-423B-AFA5-B3B7367E66E5
been granted under Chapter III of the GDPR. ClickMeeting shall not communicate with data subjects
directly on behalf of the Client.
4. ClickMeeting shall support the Client in the performance of the tasks provided for in Articles 32-36 of
the GDPR in respect of the Service by providing the Client with the necessary information unless the
personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. In
respect of supporting the Client in data protection impact assessment (Article 35 of the GDPR) and in
prior consultation of the supervisory authority (Article 36 of the GDPR), ClickMeeting shall assist only
insofar as the Client is unable to discharge their obligations using other means. ClickMeeting shall
inform the Client about the costs of such assistance. Once the Client confirms that they will cover such
costs, ClickMeeting shall provide the assistance.
5. ClickMeeting shall inform the Client without undue delay upon receiving any credible and confirmed
information:
a. that ClickMeeting or its subcontractors have been required, under the European Union law or the
law of a country to which ClickMeeting or subcontractor is subject, to process the Personal Data
in a manner going beyond the Client’s instructions; in such a case, ClickMeeting shall inform the
Client of that legal requirement before processing, unless that law prohibits providing such
information on important grounds of public interest; in such an event, the notice to the Client
shall specify the legal requirement arising from the European Union or the law of the relevant
country;
b. about any identified Personal Data breach committed by ClickMeeting or its subcontractor that
affects the Client’s Personal Data hereunder. In such a case, ClickMeeting shall support the Client
in the Client’s discharge, where applicable, of the obligation to inform the supervisory authority
or the data subject by providing the information available to ClickMeeting in accordance with
Article 33(3) of the GDPR.
§5 USE OF SUBCONTRACTORS (FURTHER ENTRUSTING)
1. To ensure proper provision of the Service, the Client agrees that ClickMeeting may use subcontractors
and that it may further entrust Personal Data processing to them.
2. The current list of ClickMeeting’s subcontractors is available in materials available at:
https://knowledge.clickmeeting.com/privacy-security/ or elsewhere as specified by ClickMeeting.
ClickMeeting shall inform the Client about any planned expansion of the list of subcontractors to whom
it will further entrust the Personal Data processing. The Client shall be informed about this through a
notice transmitted through the Client Panel and properly in advance. The Client shall have the right to
object to ClickMeeting’s use of a specific subcontractor within 14 days of receiving a notice on the
planned change. If the Client does not object within 14 days of receiving the information about the
planned change, the Client is deemed to have agreed to the change. Having received an objection,
ClickMeeting has 30 days to determine how to proceed in relation to the objection. On the expiry of that
period, each Party may terminate the Agreement in line with the provisions of the Terms of Service or
the individually concluded Service agreement. Notwithstanding the foregoing, ClickMeeting stipulates
that the Client’s objection to a chosen subcontractor may render the Client unable to use all the
functionalities of the Service.
3. Further Personal Data processing may only take place within the limits of and for the purpose of
performing the Service. ClickMeeting hereby represents that (i) the subcontractors it has chosen meet
all the requirements arising from the GDPR and from applicable data protection legislation, (ii) it has
entered into Personal Data processing agreements with the subcontractors as required under Article
28(4) of the GDPR and that such agreements include provisions imposing obligations analogical to
those defined in the Agreement in respect of ClickMeeting on the subcontractors, and that (iii) the
personal data protection standard followed by its subcontractors is at least equal to the personal data
protection standard followed by ClickMeeting. If the subcontractor chosen by ClickMeeting is in a third
country within the meaning of the GDPR, ClickMeeting shall make sure that the conditions specified in
Chapter V of the GDPR are fulfilled. The Client agrees that where ClickMeeting engages a subcontractor
for carrying out specific processing activities (on behalf of ClickMeeting) and those processing activities
involve a transfer of personal data within the meaning of Chapter V of the GDPR, ClickMeeting and the
subcontractor can ensure compliance with Chapter V of the GDPR by using standard contractual clauses
adopted by the Commission in accordance with Article 46(2) of the GDPR.
ClickMeeting Sp. z o.o.
al. Grunwaldzka 413, 80-309 Gdansk, Poland
KRS: 0000604194 | NIP: 5842747535 | Share capital: PLN 1,187,500.00
Docusign Envelope ID: D2E80E57-D685-423B-AFA5-B3B7367E66E5
§6 AUDITS
1. The Client shall have the right to audit ClickMeeting’s compliance with the Agreement in terms of
Personal Data processing (“Audit”). In deciding on an Audit, the Client will take into account relevant
certifications held by ClickMeeting. An Audit may also be conducted by an independent auditor
authorized by the Client, provided that ClickMeeting first signs a non-disclosure agreement with the
auditor.
2. The Client shall not appoint as an auditor any entity directly or indirectly competing with ClickMeeting’s
business. Competing shall mean any business, whether or not fee-based, in the country and abroad, of
whatever legal form, engaged in the same or identical subject activities and addressed to the same
group of recipients, overlapping – even partially – with the scope of the main or the side activity of
ClickMeeting or of entities from the ClickMeeting group worldwide. Assessment of whether an entity is
a competitor will include not only the objects of business of such an entity listed in its articles of
association but also any activities actually pursued by that entity. If an Audit is ordered to
ClickMeeting’s competitors, ClickMeeting shall have the right to refuse to allow the Audit until another
entity is appointed to carry out the Audit on behalf of the Client or until the Parties agree on how to
proceed.
3. An Audit shall be subject to the following conditions: (i) it may only apply to the Personal Data entrusted
to ClickMeeting for processing under the Agreement and it shall be limited to ClickMeeting’s registered
office and to the devices used to process the Personal Data and to the staff involved in the processing
hereunder; (ii) it shall be carried out efficiently and as quickly as possible, taking no more than
2 working days, (iii) it shall not take place more than once a year, unless it is required under applicable
laws or by a competent supervisory authority or takes place promptly after a material breach of the
Personal Data processed hereunder is identified, (iv) it may take place during regular working hours of
ClickMeeting, in a manner that does not disrupt ClickMeeting’s business and is in conformity with
ClickMeeting’s security policies; (v) the Client shall inform ClickMeeting about the intention to carry
out the Audit via electronic means of communication or by post at least 14 working days before the
scheduled Audit date. If an Audit cannot be carried out as scheduled for reasons beyond ClickMeeting’s
control or if other unexpected obstacles arise, ClickMeeting shall inform the Client about such
circumstances and shall suggest a new Audit date, which shall not be later than 7 working days after
the date specified by the Client; (vi) the Client shall bear all the Audit costs arising from or connected
with the Audit, except where an Audit reveals a serious breach of Personal Data security rules that
pertains or is a threat to the Client’s Personal Data; (vii) an Audit cannot be intended or lead to the
disclosure of legally protected secrets (including ClickMeeting’s trade secrets). The Client shall create
an Audit report that summarizes the Audit findings. The report shall be submitted to ClickMeeting and
shall represent ClickMeeting’s confidential information which cannot be disclosed to any third parties
without ClickMeeting’s permission unless this is required by the applicable laws.
4. If ClickMeeting holds the certification referred to in Article 42 of the GDPR or follows the code of
conduct referred to in Article 40 of the GDPR, the Client’s auditing rights may also be exercised through
ClickMeeting’s reference to the results of the monitoring of the certification rules or of the code of
conduct. If this is the case, the Audit shall only involve the issues that cannot be sufficiently clarified
through the submission of such results by ClickMeeting.
§7 DATA DELETION, TRANSFER, EXPORT
1. Upon termination or expiration of the Agreement, ClickMeeting will delete Personal Data in accordance
with ClickMeeting’s current data retention and deletion policy, unless ClickMeeting has the right or
obligation to continue processing Personal Data, including Exportable Data, on an independent legal
basis (for example, in cases indicated in this Agreement clause).
2. ClickMeeting enables the Client to transfer Exportable Data, including Personal Data, to local
infrastructure or to another provider of services comparable to the Service after termination of the
Service agreement. To this end, ClickMeeting provides a minimum 60-day data transfer period
immediately following the end date of the last Service subscription, during which:
a. the Client has free access to the Service in a scope allowing initiation of subscription renewal and
contact with ClickMeeting personnel to, among others, request Exportable Data for download or
transfer;
b. if Client submits a request within 20 days from the end of the Service subscription, ClickMeeting
will within the next 10 days ("Transition Period"):
ClickMeeting Sp. z o.o.
al. Grunwaldzka 413, 80-309 Gdansk, Poland
KRS: 0000604194 | NIP: 5842747535 | Share capital: PLN 1,187,500.00
Docusign Envelope ID: D2E80E57-D685-423B-AFA5-B3B7367E66E5
i. either provide tools enabling the Client to independently initiate and export the Exportable
Data (including Personal Data), or
ii. provide the Exportable Data, including Personal Data, in a commonly used machine-readable
format;
c. the Client has at least 30 calendar days to download the data made available during the Transition
Period („Data Retrieval Period”);
d. ClickMeeting provides the Client and third parties authorized by the Client with reasonable
assistance in the process of changing provider, including by providing necessary information, also
regarding risks to continuity of functions or services on ClickMeeting’s side;
e. ClickMeeting acts with due diligence to maintain information security and business continuity in
the process of exporting and transferring Exportable Data.
3. In justified cases, the Transition Period may be extended by ClickMeeting, particularly:
a. if compliance is technically impossible for ClickMeeting, or
b. once, upon the Client's request, for a period deemed appropriate by the Client in view of its goals –
but not exceeding an additional 30 days.
4. The specification of Exportable Data and information on the procedure for changing providers, data
transfer, limits, and technical restrictions are described in detail and continuously available at:
https://knowledge.clickmeeting.com/pl/privacy-security/prywatnosc-i-bezpieczenstwo-faq/.
5. Exportable Data exclude those belonging to the category of ClickMeeting’s trade secrets, in particular
data related to the architecture of the ClickMeeting Platform’s infrastructure and applications.
Specifically, non-exportable data include data not owned by the Client (e.g., system data); temporary
system logs used only for diagnostics; structural Service data (e.g., database definitions, relational
structures); data protected by ClickMeeting’s intellectual property rights (e.g., graphics library).
6. The Client bears full responsibility for downloading and transferring Exportable Data to the new
provider or local ICT infrastructure.
7. Throughout the term of the Service agreement, ClickMeeting provides the Client with the possibility to
obtain copies of Exportable Data, including Personal Data. For this purpose, ClickMeeting makes
available in the Service functions for self-export of data and API methods
(https://dev.clickmeeting.com/).
8. ClickMeeting does not charge fees for data export or transfer by the Client to another provider.
§8 LIABILITY
1. ClickMeeting’s liability in contract and in tort shall be limited to direct actual losses incurred by the
Client. ClickMeeting shall not be liable for lost profit, notwithstanding the source, except where this is
caused by willful misconduct.
2. ClickMeeting's total liability, regardless of the number and legal basis of the Client’s or third party's
claims, including those resulting from Terms of Service, shall be limited to the total amount paid by the
Client for the Service during the 12 (twelve) months immediately preceding the date on which the event
causing damage occurred, with the exclusion of any amounts representing setup fees, or any extra
charges or fees for add-ons and ancillary services. In the case of Clients using only the free version of
the Service, the total limit of ClickMeeting's liability corresponds to the equivalent of twelve times the
monthly net price of the cheapest type of paid Account offered by ClickMeeting on the date such Client
creates an Account. The Client hereby releases ClickMeeting from any liability exceeding the limits
provided for in this Chapter.
3. ClickMeeting shall not be liable for not performing or improperly performing the Agreement if this
results from Force Majeure.
4. The Parties agree that the Client shall be liable for satisfying any claims of Personal Data subjects in
connection with any damage arising from improper processing of Personal Data hereunder, unless the
Client demonstrates that the damage arose solely through the fault of ClickMeeting or ClickMeeting’s
subcontractors. If the Client fails to demonstrate this, the Client shall unconditionally indemnify
ClickMeeting and hold it harmless in respect of any claims filed by the individuals whose Personal Data
ClickMeeting is processed based on the Agreement in connection with the processing of such data
hereunder. If action is brought against ClickMeeting, the Client shall, if so required by ClickMeeting, join
the proceedings as a party and assume liability for the claim.
ClickMeeting Sp. z o.o.
al. Grunwaldzka 413, 80-309 Gdansk, Poland
KRS: 0000604194 | NIP: 5842747535 | Share capital: PLN 1,187,500.00
Docusign Envelope ID: D2E80E57-D685-423B-AFA5-B3B7367E66E5
§9 MISCELLANEOUS
1. The Parties jointly agree that save as otherwise provided in the Agreement, ClickMeeting’s
remuneration for the activities hereunder is included in the remuneration due for the provision of the
Service to the Client.
2. The Agreement is open-ended but it shall be terminated no later than on the day the individually
concluded Service agreement terminates or expires or the Account is closed upon the Service
Subscription cancellation. If the Client initiates the data transfer procedure described in §7 of the
Agreement, the Agreement is deemed terminated upon successful transfer of data by the Client to
another provider. If the Client does not notify ClickMeeting of the successful data transfer within the
Data Retreival Period, the Agreement is deemed terminated on the last day of that Period.
3. The Agreement shall supersede any arrangements between the Parties in respect of entrusting
Personal Data which the Parties may have made before in connection with the Service, notwithstanding
the form of such arrangements.
4. Any amendments to the Agreement shall be made in document-like form, including electronic form.
5. Any communications between the Parties shall be sent to the email addresses provided by the Client
when creating an Account and to ClickMeeting email address: privacy@clickmeeting.com or Al.
Grunwaldzka 413, 80 – 387 Gdańsk, Poland. Each Party may change the contact details by sending a
relevant notification to the other Party; the change will be effective upon receipt of the notification by
the other Party. The change of contact details is not regarded as an amendment to this Agreement.
6. The Agreement shall be governed by Polish law. To any matters not regulated herein, the provisions of
the GDPR, other applicable Polish laws, the Privacy Policy available at
https://legal.clickmeeting.com/privacy-security/privacy-policy/ and Terms of Service. shall apply.
Any capitalized terms (e.g. Force Majeure etc.) not defined herein shall have the meaning as assigned
to them in the Terms of Service. In the event of any discrepancies between the Terms of Service and
this Agreement, the provisions of this Agreement in relation to personal data protection shall prevail.
7. To the extent that is necessary to ensure that the Agreement complies with generally applicable laws
and ClickMeeting's data protection policies, ClickMeeting may amend the Agreement. If there are
amendments introduced to the Agreement, the Client is entitled to file an objection within 5 days from
the entry into force of the amendments. Having received an objection, ClickMeeting has 30 days to
determine how to proceed in relation to the objection. On the expiry of that period, each Party may
terminate the Agreement in line with the provisions of the Terms of Service or the individually
concluded Service agreement.
8. The following Annex is a part of this Agreement: Annex 1 – Description of Personal Data processing/
ClickMeeting Client
ClickMeeting Sp. z o.o.
al. Grunwaldzka 413, 80-309 Gdansk, Poland
KRS: 0000604194 | NIP: 5842747535 | Share capital: PLN 1,187,500.00
Docusign Envelope ID: D2E80E57-D685-423B-AFA5-B3B7367E66E5
Annex 1 – Description of Personal Data Processing
1. Nature of the processing
ClickMeeting’s processing is fully or partially automated and takes place using the IT systems provided
within the Service.
Processing operations: collection, recording, storage, adaptation, alteration, disclosure, combination,
backup of Personal Data, as well as other operations as required to provide the Service.
2. Categories of data subjects
a. Contacts – people whose data are on the Contact List or whose Personal Data are collected and stored
using the Service, Participants – people participating in a Conference;
b. Presenters – Conference Speaker;
c. Users of the Account; Subaccount or Service: people authorized by the Client to use the Account, and in
particular the Main Account Users, multi-users, Subaccount Users.
3. Type of Personal Data
The extent of Personal Data processed depends on the use of the Service and the features used.
A. Categories of Personal Data defined in the Service by ClickMeeting:
a. name;
b. last name;
c. company's name;
d. address;
e. email;
f. telephone number;
g. image of the person recorded in the profile picture;
h. hyperlink;
i. country.
B. Categories of Personal Data defined in the Service by the Client (any text value in the meaning given by
the Client, without verification of the content, format and meaning of the data by ClickMeeting), for
example:
a. URL address of the website through which Contact provided its data to the Client
b. address of the website from which the Contact was redirected [http_referer];
c. gender, age, date of birth;
d. workplace;
e. additional information about the Contact, Presenter and other information based on the fields defined
by the Client;
f. additional information collected by the Client during Conferences.
If the above data are collected through the Service, the Client entrusts them to ClickMeeting in this respect
as well.
ClickMeeting also automatically processes data that may be generated in the course of using the Service
(depending on the scope of Service use): data about the use of the Service, data processed using cookies,
data processed using website tracking files, location data, browser data, operating system information,
device IP data.
ClickMeeting Sp. z o.o.
al. Grunwaldzka 413, 80-309 Gdansk, Poland
KRS: 0000604194 | NIP: 5842747535 | Share capital: PLN 1,187,500.00