Source: https://applift.com/media-partner-terms-conditions/data-protection-addendum
Timestamp: 2020-04-04 15:15:18
Document Index: 324338387

Matched Legal Cases: ['Art. 4', 'Art. 4', 'Art. 26', 'Art. 28', 'Art. 9', 'Art. 32', 'Art. 5', 'Art. 12', 'Art. 15']

Data Protection Addendum - Applift
This Data Protection Addendum (“Addendum”) forms part of the agreement (“Principal Agreement”) entered between Media Partner and AppLift GmbH (“Company”), each a “Party” and collectively the “Parties”. The Parties agree that there may be personal data shared between the Parties, including but not limited to, IP addresses, location data, device identifiers, cookie IDs or other identifiers. This Addendum specifies the data protection obligations of the Parties under the EU General Data Protection Regulation (“GDPR”) from the underlying principal agreement (“Principal Agreement”). The duration of this Addendum corresponds to the duration of the Principal Agreement.
Sect. 1 Definitions
(1) If this Addendum uses the term “personal data”, this shall mean any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
(2) If this Addendum uses the term “data processing” or “processing” of data, this shall be generally understood to mean the use of personal data. Data processing or the processing of data shall mean any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
(3) If this Addendum uses the term “Controller to Controller Standard Contractual Clauses”, this shall mean data protection clauses for the transfer of personal data to controllers outside the European Union adopted by the European Commission.
(4) Reference is made to further definitions set forth in Art. 4 GDPR.
Sect. 2 Scope
The following provisions shall apply to all personal data processing activities carried out by each party under the principal agreement.
Sect. 3 Data protection responsibilities
(1) When processing personal data, each Party is a controller with the meaning of Art. 4 (7) GDPR and hence responsible for complying with applicable data privacy laws. The Parties agree that the data processing activities carried out by each Party under the Principal Agreement neither constitutes a joint controllership pursuant to Art. 26 GDPR nor data processing under Art. 28 GDPR.
(2) Each Party shall process personal data in accordance with this Addendum and/or the Principal Agreement. The Parties shall not process the personal data for secondary purposes which are incompatible with the purpose for which the personal data were initially collected.
(3) A Party shall not share any personal data with the other Party that allows data subjects to be directly identified (for example by reference to their name and e-mail address) and/or that contains any Special Categories of Personal Data pursuant to Art. 9 (1) GDPR.
(4) Annex 1 to this Addendum contains the version of the “Controller to Controller Standard Contractual Clauses” valid at the time of conclusion of this Addendum, included in the Commission Decision 2004/915/EC, dated 27 December 2004 and shall constitute an integral part of this Addendum. Should an updated version of the “Controller to Controller Standard Contractual Clauses” be adopted by the European Commission in the future, the Parties undertake to complete and conclude the new version of “Controller to Controller Standard Contractual Clauses”, if necessary.
Sect. 4 Measure to ensure the security of processing
Each party undertakes to observe the principles of due and proper data processing in accordance with Art. 32 in conjunction with Art. 5 (1) GDPR. Each party shall take all necessary measures to safeguard the data and the security of the processing, in particular taking into account the state of the art, as well as to reduce possible adverse consequences for the affected parties. Measures to be taken include, in particular, measures to protect the confidentiality, integrity, availability and resilience of systems and measures to ensure continuity of processing after incidents. In order to ensure an appropriate level of processing security at all times, each party shall regularly evaluate the measures implemented and make any necessary adjustments.
Sect. 5 Rights of data subjects
Each party undertakes to maintain appropriate privacy notices regarding the processing of personal data of Media Partner’s end users in the context of the provision of services in accordance with Art. 12-14 GDPR. Each party shall observe the rights of data subjects pursuant to Art. 15-21 GDPR.
Sect. 6 Miscellaneous
(1) In case of contradictions between the provisions contained in this Addendum and provisions contained in the Principal Agreement, the provisions of this Addendum shall prevail.
(2) This Addendum is exclusively subject to the laws of the Federal Republic of Germany.
countries (controller to controller transfers)
Data transfer agreement between Company (hereinafter “data exporter”) and Media Partner
(hereinafter “data importer”), each a “party”; together “the parties”.
(d) “clauses” shall mean these contractual clauses, which are a free-standing document that does not incorporate commercial business terms established by the parties under separate commercial
(d) It will respond to enquiries from data subjects and the authority concerning processing of the personal data by the data importer, unless the parties have agreed that the data importer will so respond, in which case the data exporter will still respond to the extent reasonably possible and with the information reasonably available to it if the data importer is unwilling or unable to respond.
(e) It will make available, upon request, a copy of the clauses to data subjects who are third party beneficiaries under clause III, unless the clauses contain confidential information, in which case it may remove such information. Where information is removed, the data exporter shall inform data subjects in writing of the reason for removal and of their right to draw the removal to the attention of the authority. However, the data exporter shall abide by a decision of the authority regarding access to the full text of the clauses by data subjects, as long as data subjects have agreed to respect the confidentiality of the confidential information removed. The data exporter shall also provide a. copy of the clauses to the authority where required.
(h) It will process the personal data, at its option, in accordance with: the data processing principles set forth in Annex A.
(a) Each party shall be liable to the other parties for damages it causes by any breach of these clauses.
Liability as between the parties is limited to actual damage suffered. Punitive damages (i.e. damages intended to punish a party for its outrageous conduct) are specifically excluded. Each party shall be liable to data subjects for damages it causes by any breach of third party rights under these clauses.
This does not affect the liability of the data exporter under its data protection law.
The data exporter is Company, as defined in this Data Protection Addendum.
The data importer is Media Partner, as defined in this Data Protection Addendum.
Media Partner’s end users
IP addresses, cookies, device IDs and other unique identifiers.
The personal data will be processed for the purposes specified in the Principal Agreement and the Data Protection Addendum.