Source: https://www.userlike.com/en/terms
Timestamp: 2019-04-20 11:00:07+00:00

Document:
Subject matter of these General Terms and Conditions (hereinafter "terms and conditions") is the provision of services (hereinafter "Services") of Userlike UG (limited liability), Probsteigasse 44-46, 50670 Cologne, Germany, (hereinafter "Userlike") regarding the application "Userlike" (all editions) to customers (hereinafter "Customers"), who are not consumers as defined in Section 13 of the German Civil Code (Bürgerliches Gesetzbuch – BGB).
These terms and conditions and any regulations in individual agreements between the Parties shall apply exclusively. Conflicting or deviating terms of Customer shall not apply, even if Userlike despite the knowledge thereof provides its Services without objecting to those conflicting or deviating terms.
Userlike shall have the right to change these terms and conditions within a suitable notice period. Changes shall enter into effect only if Customer has not objected to the changes within one month from the written notification of the intended change (objection period) and if in such notification Userlike informs Customer (a) on his right to object and (b) the objection period. This clause does not apply to obligations of Userlike which are prerequisite for the proper implementation of the agreement, by the breach of which attainment of the purpose of the agreement is jeopardized and on which Customer may duly rely (cardinal obligation).
A completed web-based order form or any other kind of order request of the Customer constitutes a binding contractual offer regarding the requested Services of Userlike. An agreement shall be deemed concluded upon acceptance of such offer by Userlike, at the latest upon provision of the Service by Userlike.
Any offers by Userlike shall be deemed non-binding, unless expressly otherwise agreed. Performance dates or times mentioned in a Customer's request are binding only if designated as binding by Userlike in writing.
Details of the respective contractually agreed Services can be found on the product order pages of Userlike valid at the time of the order.
Insofar as Userlike conducts its Services free of charge (Free Trial and Edition "Free") it may at its own discretion and at any time, in whole or parts, change, limit or cancel such Services. If doing so Userlike will take Customer's legitimate interests into account and will notify Customer within a reasonable timeframe in advance, provided that such notification is technically feasible and reasonable.
Userlike provides its Services 24 hours a day, 365 days a year and ensures an availability rate of at least 99,00% of the annual mean, except for maintenance downtimes. Userlike will inform Customer about necessary maintenance downtimes in good time, if possible. Userlike is not liable for any downtimes which make its Services unavailable via internet, in particular for downtimes because of technical or other problems that are outside Userlike's sphere of influence or control such as force majeure events or acts of third parties.
Customer shall inform Userlike without undue delay in case of malfunction or disruption of the Service.
Customer shall be obligated to keep personal access data (username and password) confidential against access by unauthorized third parties. Customer shall change his password immediately and shall be obligated to inform Userlike without undue delay if there is reason to suspect that unauthorized third parties have access to Customer’s password.
Customer shall be obligated to use the Services in accordance with the legal provisions of the territory of intended use. In particular Customer shall observe the applicable copyrights, trademark rights, patent rights and any other intellectual property or personal rights of third parties. Customer may neither use nor make available to the public any data or any information with illegal content.
Customer may not use the Services, to conduct attacks on Userlike or third parties, such as spamming, hacking, brute force attacks, the use of spy software, virus or worms attacks.
In case of an infringement of section 4 (2) to (4) of these terms and conditions Userlike may delete illegal content at any time and without prior notice or may – to the extent necessary –block access of Customer to the relevant content and/or Services until Customer has redressed the infringement. In case of a severe violation of Customer against the duties stipulated in section 4 (2) to (4) of these terms and conditions Userlike shall have the right to terminate the contract for good cause without prior notice (section 10 (2)). If Customer is responsible for the infringement he shall compensate Userlike for all damages resulting thereof.
Userlike grants to Customer the non-exclusive, non-transferable, non-sublicensable and unlimited right to use the Services within the scope and limited to the term of the agreement. Userlike shall be obligated to provide new versions, upgrades or updates of its Services only insofar as it is strictly necessary for the remedy of defects. Outside the scope of the agreement Customer is not entitled to use, copy or download Userlike’s Services or to make them available to any third parties.
Customer shall be obligated to indemnify Userlike and its subcontractors against all third party claims that are based on the illegal use of the Services or any such use that happened with his consent, or that arise, in particular, from litigation procedures involving the infringement of laws on data protection, copyright or other laws in conjunction with the use of the Services. If Customer realizes or can be expected to realize that such infringement is about to occur, he shall be obligated to notify Userlike without undue delay.
Userlike collects, processes and uses personal identifiable information ("personenbezogene Daten") solely pursuant to German data protection legislation. Customer may find Userlike’s current privacy notice ("Datenschutzerklärung") at Userlike’s website under the section "Privacy Notice".
It is in Customer’s sole responsibility to collect, process or use personal identifiable information of third parties in accordance with German statutory provisions while using the Services. That applies, in particular, to his obligation to obtain the necessary consent of the parties involved, provided that no statutory provision legitimates the intended data collection, processing or usage.
Insofar as Userlike provides its Services free of charge (Free Trail and Edition "Free") Userlike shall be not obligated to remedy defects.
Insofar as Userlike provides paid Services it shall be entitled to remedy the defect by delivering an update, upgraded or otherwise revised version of the Service or by implementing a workaround.
Liability for defects shall be excluded if the defect is caused because Customer or a third party on behalf of Customer altered Services or in any other way interfered in the Services in an inadmissible manner or because Customer or said third party made use of the Services in a way that is not compliant with the scope of the agreement or Service documentation.
Insofar as Userlike provides its Services free of charge, Userlike’s liability shall be liable in accordance with statutory provisions of German law for any damages based on intent, fraudulent intent, gross negligence or lack of a guaranteed feature. Any further liability shall be excluded. Liability for injury in life, limb or health and liability in accordance with the German Product Liabilty Act (Produkthaftungsgesetz – ProdHaftG) shall remain unaffected.
Insofar as Userlike provides paid Services Userlike shall be liable in accordance with statutory provisions of German law for any damages based on intent or gross negligence or the lack of a guaranteed feature, including intent or gross negligence of its subcontractors.
In the event of slight negligent breach of an obligation of Userlike which is prerequisite for the proper implementation of the agreement, by the breach of which attainment of the purpose of the agreement is jeopardized and on which Customer may duly rely, liability shall be limited to the typical damage expected under the agreement. Any other liability shall be excluded. Liability for injury in life, limb or health and liability in accordance with the ProdHaftG shall remain unaffected.
Userlike shall be liable for the loss of data in the event of slight negligence only under the conditions and within the scope of section 7 (2) and only to the extent that the damage would also have occurred if Customer had performed a duly and regular, at least daily, backup (on his local systems).
Unless otherwise agreed, Customer may find details concerning prices on the product order pages of Userlike, valid at the time of the order.
All prices (including additional costs) are net prices. Userlike shall be entitled to issue electronic invoices. Billing for the respective Service will be processed in accordance with the payment method selected by Customer.
The billing amount is immediately due and payable without deduction upon invoicing. A payment shall only be deemed to have been made when Userlike has disposal over the amount.
Customer shall be in default if he does not make his payment within fourteen days after the due date and receipt of an invoice or equivalent statement of payment. In case of default, Userlike shall be entitled to claim default interest at the statutory rate (Section 288 para. 2 BGB). The assertion of further claims remains unaffected.
In the event that Customer is in default of (a) payment or a significant part thereof, for two consecutive months or (b) in an amount that is at least equivalent to the amount due for a period of two months, Userlike shall be entitled to block access to the Services. Userlike’s right to terminate the contract for good cause without prior notice (section 10 (2)) remains unaffected.
Unless otherwise agreed, the agreement has a minimum term – depending on the chosen edition of the Service – of one, twelve or twenty-four months and may be terminated without notice at the end of each term. Unless terminated in due time the agreement shell be deemed extended each time for the applicable minimum term. As for Custom Customers – depending on the chosen edition of the Service – a minimum term of twelve or twenty-four months with a notice period of three months to the end of each term shall apply.
Notice of Termination can be provided either by using Userlike’s relevant communications tools on its website or in text format (eMail).
The right to terminate the agreement for good cause without notice remains unaffected. A good cause shall apply in particular if the terminating party, taking into account all circumstances of the specific case and weighing the interests of both parties, cannot reasonably be bound to the agreement until expiration of the relevant term.
If Customer opts for deleting his entire account at Userlike, also Customer’s corresponding data will be automatically deleted. It is therefore Customer’s responsibility to backup his data on his local account before deleting his account.
Userlike provides software-based technical support in the communication of its customers with third parties via independent messenger applications such as Facebook Messenger and Telegram.
The telephone numbers Userlike imparts to its customers to use with messenger applications are supplied by cloud communication providers. There is no contractual relationship established between Userlike’s customers and cloud communication providers. Userlike’s customers are not entitled to be provided with a leaving or disclosure of the telephone number, nor with benefits in respect of these cloud communication providers.
Installation or maintenance of the operation of the messenger applications is not included in the scope of services of Userlike’s products. Userlike does not have any contractual relationship with the providers of these messenger applications. Alterations in the settings of the messenger applications or improper handling of these can lead to interruptions and harm its functioning. In such cases, Userlike will work to restore functionality.
If the messenger application’s provider bans individual telephone numbers, Userlike will inform customers about this and impart to them a new number. If customers decide to accept this offer, all recipients will have to be recruited and verified again.
Also not included in the scope of services of Userlike’s products is the equipment of third parties that is necessary for the messenger applications to be used. Userlike does not have any contractual relationship with the third parties.
Userlike shall have the right to provide its Services with the help of subcontractors. Userlike shall be liable for any Services provided by subcontractors to the same extent that Userlike is liable for its own actions.
Information specified on the product order page, in brochures and other documents serves only to describe the products and does not constitute a guarantee, particularly a guarantee of a certain quality. Guarantees must be expressly confirmed by Userlike in writing.
The contractual relations between Userlike and Customer shall be governed by German law under exclusion of the UN Convention on Contracts for the International Sale of Goods.
If Customer is merchant within the meaning of the German Commercial Code (Handelsgesetzbuch – HGB), a legal person governed by public law or a special fund (Sondervermögen) under public law, exclusive place of jurisdiction shall be Cologne, Germany. The same applies, if Customer has no general place of jurisdiction in Germany or if his domicile or his usual place of residence is unknown at the time an action is filed. Userlike’s right to file an action against Customer at its general place of jurisdiction remains unaffected.
Should provisions of an agreement with Customer including these term and conditions are or become invalid in parts or as a whole, validity of the remaining provisions shall remain unaffected and the invalid parts shall be replaced by the relevant statutory provision.
Data protection and data security are of utmost importance for Userlike UG (limited liability), hereinafter "Userlike" or "we". In the following we may provide answers to your most frequent questions to what personal data we collect, process and use in connection with our website and what your possibilities are to influence this data usage.
We would like to point out that this privacy statement applies only to our website https://www.userlike.com and its subpages (hereinafter "Websites") but not to websites of third parties that are linked with our Websites. As Userlike has no measures to influence data usage of said third parties, we recommend that you also assess those third parties’ privacy statements.
Userlike collects and processes personal data exclusively in compliance with the relevant provisions of German data protection law, in particular the General Data Protection Regulation (EU-GDPR) and the Telemedia Act (TMA).
The purpose of the data processing is the selection of applicants for an employment relationship. There are no plans to change these purposes.
Legal basis is § 26 BDSG (2017) in connection with Article 6 (1) (b) (employment contract) and Article 88 DS-GMO.
Applicant data is passed on internally to the responsible and decision-making employees. We also use service providers to process orders for the provision of services, in particular for the provision, maintenance and servicing of IT systems.
The data will be deleted three months after the end of the application process.
Personal data is required for the examination of the application and, if necessary, the subsequent conclusion of an employment contract. Without personal data, an application cannot be considered. However, applications can also be submitted without providing such information marked as voluntary.
In the course of the application process, data is processed by the service provider Hetzner. This processing is based on the conclusion of an order processing agreement under German law. A copy may be made available at any time by the Data Protection Officer.
Userlike uses a live chat of Userlike UG (haftungsbeschränkt), Probsteigasse 44-46, 50670 Cologne, Germany (yes, we use our own chat :-) ). You can use the live chat as a contact form to chat with our staff in near real time. At the start of the chat, personal data is collected.
Furthermore, Userlike stores the chat record. This shall not only spare you the inconvenience of recalling the whole chat history of past chats when you ask for our assistance via live chat but shall also ensure an continuous quality control regarding our live chat. If you do not want to have your chat record stored please contact us and we will delete it immediately. You may find our contact details at the end of this privacy statement.
If you decide to make use of our services, we may ask you for further personal data. If you make use of services that are free of charge (e.g. Free Trial or Edition "Free") this is the name of your company or your website address, your first name, surname and username, your email address andyour password. If you want to use our fee-based services (e.g. Edition "Team", "Corporate", "Business", "Custom" or "Flex") you must furthermore provide us with the necessary payment details, depending on the chosen payment method (e.g. credit card details, etc.).
If required for investigating the illegal use of the services of Userlike or for legal proceedings, personal data will be transferred to the criminal investigation authorities and, if legally obliged, to injured third parties. We are also legally obliged to give certain public authorities information. These are criminal investigation authorities, public authorities which prosecute administrative offences entailing fines and the German finance authorities.
Occasionally we depend on contractually affiliated external companies and external service providers to supply services such as the supply of advertising measures (only if you have given your explicit prior consent), processing payments (credit card etc.), storing your data and customer service. In such cases, information is transferred to these companies or individuals in order to enable them to process this information further. The service providers may only use the data for the purposes stipulated by Userlike and solely in accordance with German data protection laws.
In order to further develop our business, we may alter the corporate structure of Userlike e.g. by changing its legal form. We may also form, sell or buy subsidiaries, divisions or parts of the company. In such transactions, customer information together with the part of the company to be transferred will be passed on. Every time personal data are transferred to third parties to the extent prescribed, Userlike will ensure that this is done in accordance with this privacy statement and the relevant data protection laws.
Userlike uses Facebook Connect, a service of Facebook Inc., 1601 Willow Road, Menlo Park, CA 94025, USA or its subsidiary Facebook Ireland Ltd., Hanover Reach, 5-7 Hanover Quay, Dublin 2, Ireland (Facebook). By logging in via the Facebook Connect button, personal data is transmitted to Facebook. We do not know what data Facebook links to the personal data received and for what purposes Facebook uses this data.
Facebook stores a cookie on the user’s computer to enable an analysis of the use of our online products and services. If not done manually by the user, the data and cookie are deleted after a predetermined time.
Facebook’s Custom Audiences service also allows us to track user behavior on our website after they have been redirected to the our website by clicking on a Facebook ad. This enables us to measure the effectiveness of Facebook ads for statistical and market research purposes.
Userlike uses AMP, a website publishing technology developed by Google LLC, 1600 Amphitheatre Parkway in 94043 Mountain View, USA (hereinafter: AMP) to reduce the loading time of its website, especially on mobile devices, and improve the user experience.
In this context, Userlike uses the Google AMP Client ID API to receive a Client ID through which a website visitor’s page activity on pages with and without AMP can be connected to Google Analytics via a cookie. The legal basis for data processing is Article 6 (1) (f) GDPR. The website owner's legitimate interest consists in an interest to analyze user behavior in order to optimize website services and advertising.
If the collection of data for Google Analytics is deactivated as described in the section "Google Analytics", no link via AMP Client ID takes place.
Userlike uses the Headwayapp to inform you as a customer about product news in the dashboard area (changelog). Therein we provide information on significant changes, new functions and corrections to the product.
Headwayapp uses so-called "cookies". These are text files that are stored on your computer to allow you to use the dashboard.
This website uses functions of the web analytics service Kissmetrics. The provider is Space Pencil, Inc., 847 Sansome Street, Lower Level San Francisco, CA 94111, USA.
Kissmetrics uses "cookies". These are text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to and stored by Kissmetrics on servers in the United States.
The storage of Kissmetrics cookies is based on Article 6 (1) (f) GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both his website and his advertising.
You can prevent Kissmetrics from collecting your information by clicking the following link. An opt-out cookie is set to prevent your data from being collected during future visits to this https://signin.kissmetrics.com/privacy/ (Opt-Out section).
Linkedin stores a cookie on the user’s computer to enable an analysis of the use of our online products and services. If not done manually by the user, the data and cookie are deleted after a predetermined time.
Linkedin’s Matched Audiences service allows us to track user behavior on our website after they have been redirected to the our website by clicking on a Linkedin ad. This enables us to measure the effectiveness of Linkedin ads for statistical and market research purposes.
"Twitter Ads" Retargeting & "Conversion Tracking"
Twitter stores a cookie on the user’s computer to enable an analysis of the use of our online products and services. If not done manually by the user, the data and cookie are deleted after a predetermined time.
Twitter’s Conversion Tracking tracks the actions of users after they have viewed ads or interacted with ads on Twitter. It allows us to distinguish conversions such as link clicks, downloads, purchases, retweets or "like" data.
Userlike may use the services of Userlane GmbH (Georgenstraße 39, 80799 Munich, Germany ("Userlane")) for the purposes of user onboarding, staff training and the subsequent tracking of user behavior during these steps.
The data that we submit to Userlane in the process: tags to distinguish customer groups, language of company contact, operator ID to track how our lanes are used and to save progress. In order for Userlane’s services to function, Userlane uses so-called "cookies", text files stored on your computer.
Userlike uses the Amazon Web service Cloudfront as a Content-Delivery-Network (CDN), which is provided by Amazon Web Services Inc., Box 81226, Seattle, WA 98108, USA. A CDN is a worldwide network of servers that provides content for Userlike. The use of a CDN ensures that Userlike's service can be reached equally quickly in every country in the world. Contents in this context are Java-Script files or the chat widgets, which bring source code for the execution of the chat. Furthermore, the CDN provides images of the page www.userlike.com or stylesheet files that control the appearance of the website.
Userlike uses the Amazon Web Service Simple Email Service (Amazon SES) to send emails sent by Amazon Web Services Inc., Box 81226, Seattle, WA 98108, USA. For example, when you register with Userlike, a welcome email will be sent to you. In this example, the email is sent by AWS SES.
Userlike uses the Amazon Web Service Route 53 (AWS Route 53) to map the Domain Name System (DNS) of the domain userlike.com, which is provided by Amazon Web Services Inc., Box 81226, Seattle, WA 98108, USA. The DNS has the function of a phone book, only for computers. If your computer wants to connect to the servers of the domain userlike.com, the computer first needs an IP address of the Userlike server in Germany. This IP address is requested from AWS Route 53. The data exchange between your computer and our servers can then take place.
Among other things, Userlike offers payment via Wirecard. The provider of this payment service is Wirecard AG, Einsteinring 35, 85609 Aschheim, Germany (hereinafter "Wirecard").
If you select payment via Wirecard, the payment data you have entered will be transmitted to Wirecard.
Your data will be transmitted to Wirecard on the basis of Art. 6 para. 1 lit. a GDPR (consent) and Art. 6 para. 1 lit. b GDPR (processing to fulfil a contract). You have the option to revoke your consent to data processing at any time. A revocation has no effect on the effectiveness of data processing operations in the past.
Userlike offers payment via Recurly. The payment service provider is Recurly Inc., 400 Alabama Street, Suite 202, San Francisco, CA 94110, USA, (hereinafter "Recurly").
If you select payment via Recurly, the payment data you have entered will be transmitted to Recurly.
Your data will be transmitted to Recurly on the basis of Article (6) (a) GDPR (consent) and Article (6) (b) GDPR (processing for the fulfilment of a contract). You have the option to revoke your consent to data processing at any time. A revocation has no effect on the effectiveness of data processing operations in the past.
Userlike offers payment via SEPA direct debit mandate. The provider of this payment service is Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands (hereinafter "Adyen").
If you select payment via SEPA mandate, the payment data you have entered will be transmitted to Adyen.
Your data will be transmitted to Adyen on the basis of Art. 6 para. 1 lit. a GDPR (consent) and Art. 6 para. 1 lit. b GDPR (processing to fulfil a contract). You have the option to revoke your consent to data processing at any time. A revocation has no effect on the effectiveness of data processing operations in the past.
1.1. This agreement for data processing on behalf (referred to hereinafter as "DPA") sets out the rights and duties of the parties under data protection law which arise from the contracts which already exist between the parties or will be concluded between them in the future (referred to hereinafter as "main contract") and under which the Processor provides processing of personal data on behalf of the Controller.
1.2. This DPA and all its components apply in all cases where Controller engages the Processor for processing personal data (referred to hereinafter as "data") on the Controller’s behalf according to Art. 28 GDPR (General Data Protection Regulation). This DPA constitutes the framework for a multitude of different data processing procedures.
1.3. In the case of discrepancies, the provisions of this DPA including all its components have priority over the provisions of the appropriate main contract.
1.4. The specifications in terms of data protection law which are applicable for the different processing procedures (referred to hereinafter as "specifications") will be agreed upon before the commencement of the data processing and fixed in annexes to the DPA (referred to hereinafter as "annexes"). They stipulate in particular the subject matter and the duration as well as the mode and purpose of the data processing, the data categories and the categories of persons concerned (data subjects) as well as the technical and organisational measures to be implemented (referred to hereinafter as "TOM").
1.5. The annexes are part of the DPA. In the case of discrepancies, the annexes have priority over the more general provisions of the DPA. If reference is made to the DPA hereinafter or in the annexes, such reference must be deemed to pertain to the DPA including all its components.
2.1. The Controller is solely responsible under this DPA for compliance with the applicable statutory provisions including but not limited to the lawfulness of the disclosures made to the Processor and the lawfulness of data processing ("controller" in terms of Art. 4 no. 7 GDPR).
2.2. The Processor, for the purposes of data processing, acts solely on the instructions given by the Controller except in the case of an exemption according to Art. 28 subs. 3 a) GDPR (statutory processing obligation). Oral instructions, if any, must be confirmed in electronic form without undue delay ("unverzüglich"). If the Controller acts as a data processor on behalf of a third party, the Controller’s obligations under the data processing contract with the third party are deemed to constitute direct instructions by the Controller which are also applicable in the relationship with the Processor if these obligations are stricter than those agreed in this DPA. The Controller will inform the Processor of any such third-party requirements regarding data processing on behalf in electronic form.
2.3. The Processor will rectify or delete the data to be processed under the contract or restrict the processing of such data (referred to hereinafter as "blocking") if the Controller so instructs the Processor and this is within the agreed limits of the authority to give instructions.
2.4. The Processor will inform the Controller without undue delay ("unverzüglich") if it considers an instruction to be contrary to the applicable data protection regulations or this DPA. The Processor is entitled to suspend the implementation of the instruction until it is confirmed or adjusted by the Controller by notice in electronic form. The Processor is entitled to refuse the implementation of instructions which obivously are contrary to data protection law.
2.5. The parties will designate to each other by notice in electronic form one or several mutual contact persons to be addressed for data protection issues, including their appointed Data Protection Officers. If the contact persons or their contact data change, the parties are obliged to mutually inform each other by notice in text form.
2.6. The Processor ensures that the persons who are authorised to process the data (a) are familiar with the instructions given by the Controller and comply with them and (b) have been committed to secrecy or are subject to an appropriate statutory obligation of secrecy. The obligation of secrecy and confidentiality continues in effect even after the termination of the data processing.
2.7. If the Controller acts as a data processor on behalf of a third party, the obligations imposed on the the Processor by this DPA are deemed to apply and be immediately binding also in the relationship between the third party and the Processor. This applies to all services which the Processor provides to the third party on the Controller’s behalf. The third party is in particular entitled to assert the right to control and information according to § 8 directly against the Processor.
3.1. The parties agree TOM according to Art. 32 GDPR to ensure adequate protection of the data (referred to hereinafter as "Annex TOM").
3.2. The right to make changes to the Annex TOM is reserved to the Processor; it must however be ensured that the changes do not cause the protection level to fall below the contractually agreed protection level. The Processor is obliged to notify the Controller of any essential changes by notice in electronic form and such essential changes are subject to prior consent to be given by the Controller by notice in text form.
4.1. The Processor will notify the Controller without undue delay ("unverzüglich") if it becomes aware of any breach of the data entrusted to it by the Controller which has occurred within its sphere of organisation, as described in Art. 4 no. 12 GDPR, or if there is any specific reason to suspect that a data breach has occurred with the Processor.
4.2. The Controller will inform the Processor without undue delay ("unverzüglich") if it becomes aware of any processing errors.
4.3. The Processor will take, without undue delay ("unverzüglich"), all measures which are required to eliminate the data breach described in § 4.1 or the errors described in § 4.2 and mitigate any possible detrimental consequences or impact, in particular with regard to the data subjects concerned. For such purpose, the Processor will consult with the Controller. Oral information about any incidents according to § 4.1 or § 4.2 must be documented and confirmed by notice in electronic form without undue delay ("unverzüglich").
The transfer of data to a recipient in a third country outside the EU and the EEA is permissible if the requirements fixed in Articles 44 et seqq. GDPR are complied with and, in addition, the transfer is subject to prior consent to be given by the Controller by notice in electronic form. The further details are stipulated in one or several annexes.
6.1. The Processor is entitled to have the processing of personal data carried out by other processors acting on behalf in whole or in part (referred to hereinafter as "subcontractors").
6.2. Good cause is deemed given if there is legitimate reason to doubt that the subcontractor will perform the agreed services in accordance with the applicable statutory data protection provisions and requirements or in accordance with this DPA. If this is not possible for the Processor or not reasonable for the Controller, the respective party is entitled to extraordinary termination of the main contract for good cause.
Good cause is deemed given if there is legitimate reason to doubt that the subcontractor will perform the agreed services in accordance with the applicable statutory data protection provisions and requirements or in accordance with this DPA. If this is not possible for the Processor or not reasonable for the Controller, the respective party is entitled to extraordinary termination of the main contract for good cause.
6.3. The Processor will agree with the subcontractor on provisions with exactly the same contents as are stipulated in this DPA. In particular, the TOM to be agreed with the subcontractor must be equivalent in terms of the protection level to those agreed herein.
6.4. Services which the Processor procures as mere subsidiary services to support its business activities outside the data processing on behalf are not deemed to constitute subcontracting within the meaning of this clause. The Processor is however obliged to take adequate precautionary measures for these subsidiary services, too, to ensure protection of the data.
If a data subject asserts claims according to chapter III GDPR against any of the parties, such party will inform the other party without undue delay (unverzüglich"). The Processor will support and assist the Controller within the realms of possibility in handling any such claims and in complying with the duties specified in Art. 33 to 36 GDPR.
8.1. The Processor will provide the Controller with appropriate evidence to demonstrate compliance with its duties. The Controller will check the appropriateness of the evidence provided.
8.2. As to the compliance with and implementation of the agreed protection measures and their proven efficiency, the Processor may refer to adequate certifications or other appropriate testing records or certificates. In particular, certifications according to Art. 42 GDPR and other certifications or evidence according to Art. 40 GDPR are deemed to be adequate certifications or evidence. In addition, the following certifications may be appropriate, too: certification according to ISO 27001 or ISO 27017, an ISO 27001 certification based on IT Grundschutz (IT basic protection), certification according to acknowledged and appropriate industry standards or a testing certificate according to SOC / PS 951. The certification and testing procedures must be conducted by an acknowledged independent third party. The Processor is obliged to make its certificates or testing certificates available to the Controller. Appropriate additional documents (e.g. activity reports of the Data Protection Officer or extracts from auditors’ reports) can also be made available to the Controller to document compliance with the agreed protection measures. The Controller’s right to inspection according to § 8.3 remains unaffected.
8.3. The Controller is entitled to conduct, during usual business hours and without interfering with the Processor’s operations and, as a rule, following an appropriate notification to be given reasonable time before the intended audit, audits/ inspections at the Processor’s premises to verify compliance with the applicable data protection regulations. The Processor may request as a prerequiste for the audit/ inspection the prior signing of a non-disclosure agreement to ensure confidentiality of the data of other customers and the TOM implemented by the Processor.
8.4. The parties, for the purpose of remedying any insufficiencies found in the audit/ inspection, will consult on the measures to be implemented.
8.5. If a supervisory authority makes use of its powers according to Art. 58 GDPR, the parties will inform each other without undue delay ("unverzüglich"). They will support and assist each other within their respective sphere of control and responsibility in fulfilling the obligations imposed on them by the competent supervisory authority.
9.1. If a data subject asserts claims for damages against either of the parties for breach of data protection regulations, the party against which the claims are asserted is obliged to inform the other party without undue delay ("unverzüglich").
9.2. The Controller and Processor are liable to the data subjects according to the regulation contained in Art. 82 GDPR.
9.3. The parties will support and assist each other in defending themselves against the claims for damages asserted by data subjects unless this would endanger the legal position of one party in relation to the other party or the supervisory authority or to third parties.
The Processor will bear the costs incurred by it in connection with the measures taken by the Controller. This includes in particular the costs incurred by the Processor in connection with controls and inspections carried out by the Controller according to § 8.
An annex is deemed terminated upon termination of the main contract without a separate notice of termination being required to end the annex. In this case, the Processor is obliged, at the Controller’s choice, either to return the data processed under the annex or delete the data in accordance with the applicable data protection requirements without undue delay ("unverzüglich") and confirm this to the Controller by appropriate notice in electronic form. The Processor will also notify the Controller by appropriate notice in text form if the Processor is itself subject to a statutory obligation to store the data in question.
The DPA, as of its signing, supersedes the existing contracts according to § 11 BDSG (German Federal Data Protection Act). If the parties, prior to concluding this DPA, have agreed on specifications according to § 1, these will continue in effect and apply analogously under the DPA unless they are superseded by annexes which pertain to the same data to be processed.
The provider allows the client to individualize the chat widget and extend the functional scope of the service. All settings are stored in the client's customer account. The activation of optional chat functions is not necessary for the operation of the core service of the chat and is a free decision of the client.
Depending on the function used, the activation of these optional functions may result in personal data of the client's end customers being forwarded to subcontractors of the provider for further processing. All the subcontractors are listed in the appendix, point 9: Optional add-on providers.
Upon activation of the respective function, the subcontractor shall be deemed to have been approved by the customer; a right of objection pursuant to Clause 6.2 shall then not exist. If the client activates optional functions in the chat widget, the client undertakes to inform the users of the chat widget about the use of these functions in conformity with data protection. Furthermore, the client undertakes to check the functional scope of the chat widget and to ensure that the data protection settings of the account are correctly configured.
14.1. .If the Controller’s data should be endangered while under the Processor’s custody due to seizure or confiscation, insolvency or composition proceedings or other incidents or measures taken by third parties, the Processor will be obliged to inform the Controller by notice in electronic form without undue delay ("unverzüglich"). The Processor will inform all responsible parties involved without undue delay ("unverzüglich") that the responsibility for the data lies exclusively with the Controller.
14.2. There are no oral side agreements. Changes and amendments to the DPA require appropriate agreement in electronic form to be valid as well as explicit reference to this DPA. Any non-compliant oral agreements between the parties will be deemed to be invalid. This also applies to any changes to the present clause.
14.4. This DPA is governed by German law with the exception of the conflict of laws rules; Art. 3 subs. 3 and subs. 4 of the Rome I Regulation remain unaffected.
On request, we will gladly send you the documents on technical and organizational measures that we refer to in our data processing agreement.

References: § 26
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 28
 Art. 4
 Art. 28
 § 8
 Art. 32
 Art. 4
 § 4
 § 4
 § 4
 § 4
 Art. 33
 Art. 42
 Art. 40
 § 8
 Art. 58
 Art. 82
 § 8
 § 11
 § 1
 Art. 3