Snapshot 52923
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Uberflip Data Processing Addendum
DATA PROCESSING ADDENDUM
This Data Processing Addendum, including its schedules and appendices (“DPA”) forms part of the
Uberflip Services Agreement or any other written agreement governing the provision and use of the
Uberflip Services (the “Agreement”) between Flyp Technologies Inc., dba Uberflip, an Ontario,
Canada corporation (“Uberflip”) and Customer. This DPA shall apply to the Agreement to the extent
that Uberflip processes Personal Data (as defined below) in the provision of Uberflip’s Services, By
signing this DPA, Customer enters into this DPA on behalf of itself and, to the extent required under
applicable Data Protection Laws, in the name and on behalf of its Authorized Affiliates. For the
purposes of this DPA only, and except where indicated otherwise, the term “Customer” shall include
Customer and Authorized Affiliates.
All capitalized terms not defined herein shall have the meaning set forth in the Agreement. In the event
of conflict between the terms of this DPA and the Agreement, the terms of this DPA shall control to the
extent of such conflict with respect to the particular subject matter in question.
The Parties agree to comply with the following provisions with respect to any Personal Data, each acting
reasonably and in good faith.
1. DEFINITIONS.
The terms “controller”, “data subject”, “supervisory authority”, “processor”, “process”,
“processing”, “personal data”, and “personal information” as used in this DPA shall have the
meanings given to them in Data Protection Laws. Where CCPA is applicable, the terms “personal
information”, “sell”, “share”, “business purpose” and “de-identified” shall be interpreted in
accordance with the CCPA. The term “controller” includes “business”, the term “data subject”
includes “consumers”, and the term “processor” includes “service provider” (in each case, as defined
by the CCPA).
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common
control with the subject entity. “Control,” for purposes of this definition, means direct or indirect
ownership or control of more than 50% of the voting interests of the subject entity.
“Authorized Affiliate” means a Customer Affiliate who is authorized to use the Services under the
Agreement between Customer and Uberflip, and who has not signed their own Agreement or Order
Form with Uberflip.
“CCPA” means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., as amended,
and its implementing regulations.
“Data Protection Laws” means the data protection and privacy laws and regulations of Canada, the
United States and European Data Protection Laws applicable to Uberflip in the processing of Personal
Data under this DPA.
“European Data Protection Laws” means (a) Regulation 2016/679 (General Data Protection
Regulation) (“EU GDPR”); (b) the EU GDPR as saved into United Kingdom law by virtue of section
3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”); and (c) the Swiss Federal Data
Protection Act and its implementing regulations (“Swiss Data Protection Act”); in each case as may be
amended, superseded or replaced from time to time.
1
v.05.01.24
Uberflip Data Processing Addendum
“Personal Data” means any ‘personal data’ or ‘personal information’ contained within Customer Data,
provided that such data is electronic data and information submitted by or on behalf of Customer. .
“Restricted Transfer” means a transfer (directly or via onward transfer) of Personal Data, that is
subject to European Data Protection Laws, to a third country outside the European Economic Area
(“EEA”), United Kingdom and Switzerland, which is not subject to an adequacy determination by the
European Commission, United Kingdom or Swiss authorities (as applicable).
“Standard Contractual Clauses” or “SCCs” means the standard contractual clauses annexed to the
European Commission's Implementing Decision 2021/914 of 4 June 2021, as may be amended,
superseded or replaced from time to time.
“Sub-processor” means any other processor engaged by Uberflip (including any Uberflip Affiliate) to
process Personal Data.
“UK Addendum” means the International Data Transfer Addendum (version B1.0) issued by the
Information Commissioner’s Office under S.119 (a) of the UK Data Protection Act 2018, as updated or
amended from time to time.
2. DATA PROCESSING AND SECURITY RESPONSIBILITIES.
2.1 Roles of the Parties. This DPA applies when Personal Data is processed by Uberflip as a processor
or sub-processor in its provision of the Services to Customer, who will act as either a controller or
processor of Personal Data.
2.2 Customer Processing. Customer shall have sole responsibility for the accuracy, quality and legality
of Personal Data, including providing notices and obtaining consents, permissions and rights required
to enable Uberflip to process Personal Data. For avoidance of doubt, Customer’s instructions and
processing of Personal Data shall comply with Data Protection Laws.
2.3 Uberflip Processing. Uberflip shall treat Personal Data as Confidential Information and shall
process Personal Data on behalf of and only in accordance with Customer’s documented instructions
for the following purposes: (i) processing in accordance with the Agreement and applicable Order
Form(s); (ii) processing initiated by Customer in its use of the Services; and (iii) processing to comply
with other documented reasonable instructions provided by Customer (e.g., via email) where such
instructions are consistent with the terms of the Agreement.
2.4 Details of Processing. The details of processing of Personal Data by Uberflip under this DPA are
set out in Schedule 1 of the DPA.
3. DATA PROCESSING UNDER THE CCPA.
3.1 Uberflip recognizes that it is a Service Provider for the Customer and acknowledges that it
understands its responsibilities under the CCPA. Uberflip collects Personal Data of California
consumers as instructed by the Customer.
3.2 Uberflip agrees that it shall not: (1) “sell” or “share” Personal Data as such terms defined under the
CCPA; (2) retain, use or disclose Personal Data (i) for any purpose other than for the purposes specified
in the Agreement and the DPA and to meet legal obligations, or (ii) outside of the direct business
relationship between Customer and Uberflip, except as permitted under the applicable Data Protection
2
v.05.01.24
Uberflip Data Processing Addendum
Laws; (3) combine Customer’s Personal Data with Personal Data received from any other source, except
that Uberflip may combine Personal Data to perform any permissible business purpose as defined in
the regulations adopted by the California Privacy Protection Agency.
3.3 Uberflip shall (a) provide the same level of privacy protection as is required by the CCPA; (b) notify
Customer promptly in writing if Uberflip makes a determination that it can no longer meet its
obligations under the CCPA; and (c) grant the Customer the right, upon notice, to take reasonable and
appropriate steps to stop and remediate Uberflip’s unauthorized use of Personal Data. Uberflip, to the
extent it receives de-identified information from Customer, commits to maintain and use the information
in de-identified form.
4. CONFIDENTIALITY
4.1 Authorized Personnel. Uberflip shall ensure that its authorized employees, officers, directors, or
contractors (“Personnel”) engaged in the processing of Personal Data are informed of the confidential
nature of the Personal Data, have received appropriate training on their responsibilities and have
executed written confidentiality agreements.
4.2 Limitation of Access. Uberflip shall ensure that access to Personal Data is limited to those
authorized Personnel who need to have access in order to render the Services in accordance with the
Agreement.
5. SUB-PROCESSORS
5.1 Appointment of Sub-processors. Customer acknowledges and agrees that (a) Uberflip’s Affiliates
may be retained as Sub-processors; and (b) Uberflip may engage third-party Sub-processors in
connection with the provision of the Services. Uberflip has entered into a written agreement with each
Sub-processor containing data protection obligations not less protective than those in the Agreement or
this DPA with respect to the protection of Personal Data to the extent applicable considering the nature
of the Services provided by such Sub-processor.
5.2 List of Current Sub-processors and Notification of New Sub-processors. Uberflip shall make
available to Customer, the current list of Sub-processors for the Services on its website at
https://www.uberflip.com/legal/sub-processors/ (the “Sub-Processor List”) with a mechanism to
subscribe to notifications for any updates to the Sub-Processor List including the addition or removal
of Sub-processors. Uberflip shall update its Sub-Processor List prior to authorizing any new Sub-
processor(s) to process Personal Data in connection with the provision of the Services.
5.3 Objection Right for New Sub-processors. Customer may object (on reasonable grounds pursuant
to applicable Data Protection Laws) to Uberflip’s use of a new Sub-processor by notifying Uberflip in
writing to [email protected] within fifteen (15) days of update to the Sub-Processor List in accordance
with the mechanism set out in Section 5.2. In the event Customer objects to a new Sub-processor, as
permitted in the preceding sentence, Uberflip will use reasonable efforts to: (i) make available to
Customer, a change in the Services or (ii) recommend a commercially reasonable change to Customer’s
configuration or use of the Services to avoid processing of Personal Data by the objected-to new Sub-
processor without unreasonably burdening Customer. If within sixty (60) calendar days, Uberflip is
unable to make the necessary changes to meet its requirements under Data Protection Laws, Customer
may terminate only those Services which cannot be provided by Uberflip without the use of the
objected-to new Sub-processor by providing written notice to Uberflip.
3
v.05.01.24
Uberflip Data Processing Addendum
6. ASSISTANCE
6.1 Data Subject Requests. Uberflip shall, to the extent legally permitted, promptly notify Customer
if Uberflip receives a request from a Data Subject to exercise the Data Subject’s right of access, right
to rectification, restriction of processing, erasure (“right to be forgotten”), data portability, object to the
processing, or its right not to be subject to an automated individual decision making, each such request
being a “Data Subject Request”. Taking into account the nature of the processing, Uberflip shall assist
Customer insofar as this is possible, for the fulfilment of Customer’s obligation to respond to a Data
Subject Request under Data Protection Laws. In addition, to the extent Customer, in its use of the
Services, does not have the ability to address a Data Subject Request, Uberflip shall upon Customer’s
request provide commercially reasonable efforts to assist Customer in responding to such Data Subject
Request, to the extent Uberflip is legally permitted to do so and the response to such Data Subject
Request is required under Data Protection Laws. To the extent legally permitted, Customer shall be
responsible for any costs arising from Uberflip’s provision of such assistance.
6.2 Data Protection Impact Assessment. Upon Customer’s request, Uberflip shall provide Customer
with reasonable cooperation and assistance needed to fulfil Customer’s obligation under the Data
Protection Laws to carry out a data protection impact assessment related to Customer’s use of the
Services, to the extent Customer does not otherwise have access to the relevant information, and to the
extent such information is available to Uberflip.
6.3 Third-Party Audits. Uberflip’s security operations are audited annually by a third-party. Upon
Customer’s written request but at reasonable intervals, and subject to the confidentiality obligations set
forth in the Agreement, Uberflip shall make available to Customer, that is not a competitor of Uberflip
(or Customer’s independent, third-party auditor that is not a competitor of Uberflip), a copy of
Uberflip’s then most recent third-party audits as applicable.
7. SECURITY
7.1 Security Measures. Uberflip shall maintain appropriate technical and organizational measures for
protection of the security (including protection against unauthorized or unlawful processing and against
accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access
to, Personal Data), confidentiality and integrity of Personal Data as set out in Uberflip’s Data Security
Policy located at https://www.uberflip.com/legal/ under “Data Security Policy”. Uberflip regularly
monitors compliance with these measures. Uberflip will not materially decrease the overall security of
the Services during a subscription term.
7.2 Security Breach Notification. Uberflip maintains security incident management policies and shall
notify Customer without undue delay, but no later than 48 hours after becoming aware of material
accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal
Data, which is transmitted, stored or otherwise processed by Uberflip or its Sub-processors (a “Security
Breach Incident”). Uberflip shall make reasonable efforts to identify the cause of such Security Breach
Incident and take those steps as Uberflip deems necessary and reasonable in order to remediate the
cause of such a Security Breach Incident to the extent the remediation is within Uberflip’s reasonable
control. The obligations herein shall not apply to incidents that are caused by Customer or Customer’s
Users.
8. TRANSFER OF PERSONAL DATA
8.1 Restricted Transfers. Where the transfer of Personal Data to Uberflip is a Restricted Transfer, and
the transfer is to a country not deemed to have an adequate level of data protection, such transfer shall
4
v.05.01.24
Uberflip Data Processing Addendum
be governed by the SCCs, which shall be deemed incorporated into and form an integral part of the
DPA in accordance with Schedule 2 of this DPA.
8.2 Alternative Transfer Mechanisms. If and to the extent that a court of competent jurisdiction or a
supervisory authority with binding authority orders (for any cause or reason whatsoever) that the
measures described in this DPA cannot be relied on to lawfully transfer Personal Data to Uberflip, the
parties shall reasonably cooperate to agree and take any actions that may be reasonably required to
implement any additional measures or alternative transfer mechanism to enable the lawful transfer of
such Personal Data. Additionally, in the event Uberflip adopts an alternative transfer mechanism
(including any successor version of the Privacy Shield), such alternative transfer mechanism shall apply
instead of the SCCs described in Section 8.1 of this DPA (but only to the extent such alternative transfer
mechanism complies with applicable European Data Protection Laws and extends to the territories to
which Personal Data is transferred).
9. TERMINATION; RETURN AND DELETION OF PERSONAL DATA
9.1 In the event a law, legal requirement, privacy or information security enforcement action,
investigation, litigation or claim, or any other circumstance, is reasonably likely to adversely affect
Uberflip’s ability to fulfill its obligations under this DPA, Uberflip shall promptly notify Customer in
writing. The parties shall negotiate in good faith, alternative processing, and if no other alternative
processing is commercially reasonable to Uberflip, Uberflip may immediately suspend any processing
and/or terminate, in whole or in part, the Agreement and this DPA.
9.2 Upon the termination of the Agreement or at such other times as instructed by Customer in writing,
Uberflip will return or securely dispose of all Personal Data in the possession or control of Uberflip. In
the event applicable law does not permit Uberflip to comply with the delivery or destruction of the
Personal Data, Uberflip shall ensure the strict confidentiality of the Personal Data and shall not process
any Personal Data by or on behalf of Customer after termination of the Agreement.
10. GENERAL
10.1 The parties agree that this DPA supersedes any prior DPA attachment, exhibit or SCCs that the
parties may have previously entered into in connection with the Services.
10.2 No amendment, supplement, modification, waiver or termination of this DPA, except as otherwise
specified, no consent or approval by any Party, will be binding unless executed in writing and approved
by both parties.
10.3 Any provision hereof found by a tribunal of competent jurisdiction to be illegal or unenforceable,
all other provisions will remain in full force and effect.
10.4 Uberflip’s obligations set forth in this DPA shall also extend to Authorized Affiliates, subject to
the following conditions: (a) Customer is solely responsible for communicating any processing
instructions on behalf of its Authorized Affiliates; (b) Customer shall be responsible for Authorized
Affiliates’ compliance with this DPA and all acts and/or omissions by an Authorized Affiliate; and (c)
if an Authorized Affiliate seeks to assert a legal demand, action, suit, claim, proceeding or otherwise
against Uberflip (“Authorized Affiliate Claim”). Customer must bring such Authorized Affiliate
Claim directly against Uberflip on behalf of such Authorized Affiliate, unless Data Protection Laws
require the Authorized Affiliate be a party to such claim, and all Authorized Affiliate Claims shall be
5
v.05.01.24
Uberflip Data Processing Addendum
considered claims made by Customer and shall be subject to any liability restrictions set forth in the
Agreement.
10.5 In the event of any conflict between this DPA and any data privacy provisions set out in any
agreements between the parties relating to the Uberflip Services, the parties agree that the terms of this
DPA shall prevail, provided that if and to the extent the SCCs conflict with any provision of this DPA,
the SCCs control and take precedence.
10.6 Except as otherwise set forth in the Agreement, Uberflip shall be liable for the acts and omissions
of its Sub-processors, to the same extent Uberflip would be liable if performing the services of each
Sub-processor directly under the terms of this DPA. The liability of each party under this DPA shall be
subject to the exclusions and limitations of liability set forth in the Agreement.
10.7 This DPA will be governed by and construed in accordance with the governing law and jurisdiction
provisions in the Agreement, unless required otherwise by Data Protection Laws.
10.8 The obligations placed upon each party under this DPA and the Standard Contractual Clauses shall
survive so long as Uberflip processes Personal Data on behalf of Customer.
[SIGNATURE PAGE FOLLOWS]
6
v.05.01.24
Uberflip Data Processing Addendum
By signing below, each party acknowledges that it has read and understood the terms of this DPA and
agrees to be bound by them.
Customer: ________________________ Flyp Technologies Inc., d.b.a. Uberflip
By: ______________________________ By: ______________________________
Name: ___________________________ Name: ___________________________
Title: ____________________________ Title: ____________________________
Date: ____________________________ Date: ____________________________
Contact Person: ___________________ Contact Person: Sarah Ferriter
Contact Title: _____________________ Contact Title: General Counsel
Contact Email: ____________________ Contact Email: [email protected]
Address: Address: 325 Front St. W., 2nd Floor, Box 47,
Toronto ON M5V 2Y1, Canada
7
v.05.01.24
Uberflip Data Processing Addendum
SCHEDULE 1
DETAILS OF PROCESSING AND TRANSFER
SCHEDULE 1 (A): LIST OF PARTIES
Data Exporter Name: The entity set out as “Customer” in this DPA to which this
Schedule 1 is attached.
Address: The address as set out in the DPA to which this Schedule 1 is
attached.
Contact person’s name, position and contact details: The contact
person’s information as set out in this DPA to which this Schedule 1 is
attached.
Activities relevant to the data transferred: The activities specified in
Schedule 1(B) below.
Signature and date: On the signature page of the DPA to which this
Schedule 1 is attached.
Role (Controller/Processor): Controller (for Module 2) or Processor (for
Module 3).
Data Importer Name: Flyp Technologies Inc., d.b.a. Uberflip
Address: 325 Front St. W., 2nd Floor, Box 47, Toronto ON M5V 2Y1,
Canada
Contact person’s name, position and contact details: Sarah Ferriter,
General Counsel, [email protected]
Activities relevant to the data transferred: The activities specified in
Schedule 1(B) below.
Signature and date: On the signature page of the DPA to which this
Schedule 1 is attached.
Role (Controller/Processor): Processor.
Schedule 1 (B): DESCRIPTION OF THE PROCESSING AND TRANSFER
Categories of data Data subjects whose Personal Data is included in Customer Data. Unless
subjects whose otherwise modified by Customer and depending on the nature of the
Personal Data is Services, these data subjects may include (a) individual contacts,
transferred: prospects, customers, business partners and vendors of Customer (who are
natural persons); (b) employees or contact persons of Customer’s
prospects, customers, business partners and vendors; (c) employees,
agents, advisors, freelancers of Customer (who are natural persons); (d)
8
v.05.01.24
Uberflip Data Processing Addendum
Customer’s Users or (e) other individuals whose Personal Data is included
in Customer Data.
Categories of Personal Unless otherwise modified by Customer, the following are the types of
Data transferred: Personal Data transferred: (a) name, address, title, contact details; and/or
(b) IP addresses, cookies data, location data; and (c) any other Personal
Data processed in the course of the Services as Customer Data.
Sensitive data The parties agree that the Services are not to be used for the transfer and
transferred (if processing of sensitive data that is described in Cause 8.7 of the SCCs.
appropriate)
Frequency of the Continuous or on a one-off depending on the services being provided by
transfer Uberflip.
Nature, subject Nature: Uberflip provides a cloud-based content experience platform for
matter and duration marketers to create, measure and improve content experiences for its
of the processing: Customers' website visitors.
Subject Matter: Personal Data.
Duration: The duration of the processing will be for the term of the
Agreement and any period after the termination or expiry of the
Agreement during which Uberflip processes Personal Data.
Purpose(s) of the data Uberflip shall process Personal Data for the following purposes: (a) as
transfer and further necessary for the performance of the Services and Uberflip's obligations
processing: under the Agreement and this DPA, including processing initiated by
Users in their use and configuration of the Services; and (b) further
documented, reasonable instructions from Customer agreed upon by the
parties.
Period for which the Uberflip will retain Personal Data for the term of the Agreement and any
personal data will be period after the termination of expiry of the Agreement during which
retained: Uberflip processes Personal Data in accordance with the Agreement.
Schedule 1 (C): COMPETENT SUPERVISORY AUTHORITY
Competent The data exporter's competent supervisory authority will be determined in
supervisory authority accordance with the EU GDPR.
9
v.05.01.24
Uberflip Data Processing Addendum
SCHEDULE 2:
STANDARD CONTRACTUAL CLAUSES (Module 2 and 3)
1. Subject to Section 8.1 of the DPA, such transfer shall be governed by the Standard Contractual
Clauses, which shall be deemed incorporated into and form part of the DPA as follows:
a. In relation to transfers of Personal Data protected by the EU GDPR, the SCCs shall
apply as follows:
i. Module Two terms shall apply where Customer is the controller of Personal
Data and the Module Three terms shall apply where Customer is the processor
of Personal Data;
ii. in Clause 7, the optional docking clause shall apply and Authorized Affiliates
may accede the SCCs under the same terms and conditions as Customer,
subject to mutual agreement of the parties;
iii. in Clause 9, option 2 (“general authorization”) is selected, and the process and
time period for prior notice of Sub-processor changes shall be as set out in
Sections 5.2 and 5.3 of the DPA;
iv. in Clause 11, the optional language shall not apply;
v. in Clause 17, option 1 shall apply and the SCCs shall be governed by Irish law;
vi. in Clause 18(b), disputes shall be resolved before the courts of Ireland;
vii. Annex I shall be deemed completed with the information set out in Schedule 1
to the DPA; and
viii. Annex II shall be deemed completed with the information set out in the
Security Addendum, subject to Section 7.1 (Security Measures) of the DPA
b. In relation to transfers of Personal Data protected by the UK GDPR, the SCCs as
implemented under Section 1(a) above shall apply with the following modifications:
i. the SCCs shall be modified and interpreted in accordance with Part 2 of the
UK Addendum, which shall be deemed incorporated into and form an integral
part of the DPA;
ii. Tables 1, 2 and 3 in Part 1 of the UK Addendum shall be deemed completed
with the information set out in Schedule 1 and Schedule 2 to the DPA and the
Data Security Policy respectively, and Table 4 in Part 1 of the UK Addendum
shall be deemed completed by selecting "neither party"; and
iii. any conflict between the terms of the SCCs and the UK Addendum will be
resolved in accordance with Section 10 and Section 11 of the UK Addendum.
10
v.05.01.24
Uberflip Data Processing Addendum
c. In relation to transfers of Personal Data protected by the Swiss Data Protection Act, the
SCCs as implemented under Section 1(a) above will apply with the following
modifications:
i. references to “Regulation (EU) 2016/679” and specific articles therein shall be
interpreted as references to the Swiss Data Protection Act and the equivalent
articles or sections therein;
ii. references to “EU”, “Union”, “Member State” and “Member State law” shall
be replaced with references to “Switzerland” and/or “Swiss law” (as
applicable);
iii. references to the “competent supervisory authority” and “competent courts”
shall be replaced with references to the “Swiss Federal Data Protection
Information Commissioner” and “applicable courts of Switzerland”;
iv. the SCCs shall be governed by the laws of Switzerland; and
v. disputes shall be resolved before the competent Swiss courts.
2. Where the SCCs apply pursuant to Section 8.1 of this DPA, this section sets out the parties'
interpretations of their respective obligations under specific provisions of the Clauses, as
identified below. Where a party complies with the interpretations set out below, such party shall
be deemed, by the other party, to have complied with its commitments under the SCCs:
a. where Customer is itself a processor of Personal Data acting on behalf of a third party
controller and Uberflip would otherwise be required to interact directly with such third
party controller (including notifying or obtaining authorizations from such third party
controller), Uberflip may interact solely with Customer and Customer shall be
responsible for forwarding any necessary notifications to and obtaining any necessary
authorizations from such third party controller;
b. the certification of deletion described in Clause 16(d) of the SCCs shall be provided by
Uberflip to Customer upon Customer's written request;
c. for the purposes of Clause 15(1)(a) the SCCs, Uberflip shall notify Customer, not the
relevant data subject(s), in case of government access requests and Customer shall be
solely responsible for notifying the relevant data subjects as necessary; and
d. taking into account the nature of the processing, Customer agrees that it is unlikely that
Uberflip would become aware of processing any inaccurate or outdated Personal Data.
To the extent Uberflip becomes aware of such inaccurate or outdated Personal Data,
Uberflip will inform Customer in accordance with Clause 8.4 SCCs.
11
v.05.01.24