Data Processing Agreement

The execution of the Subscription requires Personal Data Processing Operations.

The Parties have agreed to determine the conditions under which the Parties will process the Personal Data of Data Subjects under the terms of the DPA.

The DPA supplements the provisions of the Subscription. Consequently, in the event of any contradiction between the stipulations of the Subscription and the stipulations of the DPA, the Parties agree that the stipulations of the DPA shall prevail. The DPA applies to Processing Operations subject to the EU GDPR and/or the UK GDPR, as applicable.

1.DEFINITIONS

Where this Data Processing Agreement (hereinafter: "Agreement") uses terms defined in the General Data Protection Regulation ("GDPR"), those terms shall have the same meaning as in that Regulation.

Applicable Regulations means together (i) Regulation (EU) 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of Personal Data (the "EU GDPR"), (ii) Datenschutzgesetz (DSG) - Federal Act concerning the Protection of Personal Data, (iii) the EU GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the "UK GDPR"), and (iv) the UK Data Protection Act 2018 (the "UK DPA 2018"). References to the "GDPR" in this DPA shall be construed as references to the EU GDPR and/or the UK GDPR, as applicable;

Personal Data: Any information which is related to an identified/identifiable data subject (e.g., name, address and IP address).

Data subject: An identified or identifiable natural person.

Controller: An entity which processes personal data and determines the purpose of processing of personal data.

Processor: An entity that helps the Controller by “processing” data based on its instructions. The processing always happens on behalf of the controller.

DPA: Means this Storyclash’s Data Protection Agreement.

DSB: refers to the « Datenschutzbehörde » which is the Austrian data protection authority responsible for enforcing data protection laws in Austria. References to the DSB in this DPA shall, where the context requires, also be construed as references to the UK Information Commissioner's Office (the "ICO"), which is the supervisory authority responsible for enforcing data protection laws in the United Kingdom.

Influencer: The individual exercising his or her activity in a professional capacity and referenced on the Platform, i.e. a natural or legal person active on social networks and who, by virtue of his or her status, position or media exposure, is capable of being an opinion relay influencing consumer habits for marketing purposes.

Processing Operations: Within the meaning of the Applicable Regulations, all operation or set of operations performed on Personal Data of Data Subjects, whether or not by automated means, and which may be carried out by the Parties (e.g. collection, modification, deletion).

2.SCOPE OF APPLICATION AND DURATION OF THE AGREEMENT

This Agreement forms an integral part of the Main Agreement between the Parties, entered into on [xx.xx.xx], and shall enter into force upon its conclusion.

The duration of this Agreement depends on the duration of the Main Contract. The right of extraordinary termination for good cause shall remain unaffected.

3.DESCRIPTION OF PROCESSING OPERATIONS COVERED BY THE DPA

3.1. Roles of the Parties in Processing Operations

3.1.1. Storyclash’s role in Processing Operations

In the context of the Subscription and the use of the Platform by the Customer, Storyclash may act as the Controller for certain purposes, and alternatively act as the Customer's Processor for other purposes.

The processing operations are governed by the technical and organizational standard measures which can be found in Appendix 2.

Storyclash acting as a Controller

Storyclash is the Controller of the Processing Operations, as it alone determines the purposes and means of the Processing Operations, without the intervention of the Customer, for the following purposes:

• Management of the commercial relationship and invoicing with the Customer arising from the Subscription. The legal basis of this Processing Operation is the Terms and Conditions of Subscription (article 6.1 (b) of the GDPR);
• Management of Users on the Platform, in order to create User access and enable the use of the Platform by Users, in accordance with the licenses subscribed to by the Customer as part of the Subscription, and to ensure that the Platform is used by Users in accordance with its general terms of use. The legal basis of this Processing Operation is the agreement concluded between Storyclash and the Customer, namely the Terms and Conditions of Subscription and the general terms of use of the Platform (article 6.1 (b) of the GDPR);
• Creation of the database of Influencers available on the Platform, which is carried out by
  • the creation of an account on the Platform by an Influencer. In this case, Storyclash will also process the Influencers' Personal Data to manage the commercial relationship arising from the creation of the account on the Platform. The legal basis for this Processing Operation is the agreement concluded by Storyclash and the Influencer composed of the general terms of use of the Platform (article 6.1 (b) of the GDPR); or
  • the consultation of the public accounts of Influencers exceeding a certain subscriber threshold, and collection of Personal Data of the Influencers. In this case the legal basis for this Processing Operation is the legitimate interests pursued by Storyclash (article 6.1 (f) of the GDPR). Storyclash has performed the three-step test of its legitimate interest assessment to rely on this legal basis, in order to ensure that the Processing Operations do not override the interests or the fundamental rights and freedoms of the Influencers;
• to measure the Platform's audience in order to improve it. The legal basis is the legitimate interest pursued by Storyclash (article 6.1 (f) of the GDPR), which consists in improving its products and services to answer the needs and/or requests of the Users and/or Influencers.

Storyclash acting as a Processor

On the other hand, Storyclash acts on behalf of the Customer and in accordance with the Customer's instructions, for Processing Operations whose purposes are as follows:

• use of the Platform by Users to communicate with each other in order to manage influencer marketing campaigns and exchange information with Influencers;
• enable Users to build up address books, search for Influencers and measure the performance of their campaigns;
• allowing the Customer to pay Influencers directly through the payment feature of the Platform.

3.1.2. The Customer’s role in Processing Operations

The Customer is the Controller of the Processing Operations whose purposes are as follows:

• search for Influencers relevant to its activity via the Platform and communicate with Influencers;
• organizing and monitoring its influencer marketing campaigns with Influencers via the Platform.

The Customer alone decides on the purposes and means of these Processing Operations, as well as their legal basis in the meaning of article 6 of the GDPR.

3.2. Description of the Processing Operations carried out by Storyclash as Processor

Storyclash is authorized to process on behalf of the Customer acting as Controller the Personal Data of the Data Subjects necessary to provide and allow the use of the Platform.

Processing operations will be carried out under the following conditions:

4.OBLIGATIONS OF THE PARTIES

4.1. Obligation of each Party

Within the framework of their contractual relations, the Parties undertake to comply with Applicable Regulations.

To this end, each Party undertakes in particular to:

• ensure compliance with all the essential principles of the Applicable Regulations, in particular by defining the relevant purposes for the processing of Personal Data and the appropriate legal basis;
• implement appropriate technical and organizational security measures in order to (i) ensure and be able to demonstrate that processing is carried out in accordance with Applicable Regulations and (ii) guarantee the integrity and confidentiality of Personal Data;
• ensure that the rights of Data Subjects with regard to their Personal Data are respected and that they are fairly informed about the Processing Operations; and
• maintain and update, when needed, their compliance documentation.

4.2. Obligations of Storyclash acting as a Processor

When acting as a Processor in accordance with article 2 of the DPA and article 28 of the GDPR, Storyclash undertakes to:

• process the Personal Data of Data Subjects:
  • solely for the purposes described in article 2.2 of the DPA;
  • in accordance with the instructions of the Controller. The DPA constitutes the Customer's instructions. These instructions may be updated throughout the duration of the Subscription. If Kolsquare considers that an instruction constitutes a violation of the Applicable Regulations, it will inform the Customer by any means. If Kolsquare is required to transfer Personal Data to a third country or to an international organization, by virtue of the law of the European Union or the law of the Member State to which it is subject, it must inform the Customer of this legal obligation prior to processing, unless the law concerned prohibits such information for important reasons of public interest;
• guarantee the confidentiality of the Personal Data of Data Subjects processed under the DPA and ensure that persons authorized to process the Personal Data of Data Subjects for the performance of the Subscription (i) undertake to respect confidentiality or are subject to an appropriate legal obligation of confidentiality and (ii) receive the necessary training in the protection of Personal Data;
• take into account, with respect to its tools, products, applications or services necessary for the performance of the Subscription, the principles of data protection by design and data protection by default;
• take all measures required pursuant to article 32 of the GDPR;
• keep a register of Processing Operations carried out on behalf of the Customer;
• when needed, assist the Customer if it needs to (i) perform a privacy impact assessment as required by article 35 of the GDPR or (ii) consult the supervisory authority prior to the processing as required by article 36 of the GDPR;
• make available to the Customer the documentation necessary to demonstrate compliance with its obligations and to enable and contribute to audits, including inspections by the Customer or another auditor appointed by the Customer; and
• where applicable, provide the Customer with the name and contact details of its DPO, on request.

4.3. Obligations of the Customer acting as Controller

When acting as Controller in accordance with article 2.1 of the DPA, the Customer undertakes to:

• ensure that the Processing Operations entrusted to Storyclash have a legal basis;
• document in writing any instructions concerning Storyclash's Processing Operations of Data Subjects' Personal Data;
• supervise Processing Operations (including assessing whether the aforementioned conditions for processing operations are met and shall notify the processor if the data to be processed exceed these conditions); and
• if applicable, provide the contact details of its DPO.

5.INFORMATION AND RIGHTS OF DATA SUBJECTS

5.1. Information of Data Subjects

The Parties agree to organize the provision of information as required by article 13 and article 14 of the GDPR to Data Subjects as follows:

• Storyclash provides Users and Influencers (when the latter create an account on the Platform) at the time of collection of Personal Data with information as provided for by Applicable Regulations and relating to the Personal Data Processing Operations it carries out. This information is provided via the Platform's privacy policy;
• The Customer, when contacting an Influencer in order to organize an influencer marketing campaign, undertakes to inform the Influencers of the Processing Operations for their Personal Data that it will implement within this framework. This information must comply with Applicable Regulations and be provided when the Influencers are first contacted. The Customer guarantees that Users will respect this undertaking.

5.2. Rights of Data Subjects

Insofar as possible, Storyclash will assist the Customer in fulfilling its obligation to respond to Data Subject’s requests to exercise their rights in respect of Processing Operations carried out by Storyclash according to the Customer’s instructions.

Where the scope of the data subject request requires Storyclash to comply with its obligations as Processor and support the Customer in fulfilling the request, the Customer undertakes to forward the request to Storyclash as soon as possible after receipt thereof. Storyclash will take all relevant measures to assist the fulfilment of the request and to justify in writing to the Customer as soon as possible.

When the Data Subjects (Users or Influencers having taken part in a campaign for the Customer) make requests to Storyclash to exercise their rights, Storyclash will send these requests as soon as possible by e-mail to the Customer.

6.NOTIFICATION OF PERSONAL DATA BREACHES FOR DATA SUBJECTS

When Storyclash acts as a Processor of the Customer, Storyclash will, in accordance with article 33(2) of the GDPR, notify the Customer of any violation of the Personal Data of the Data Subjects within the framework of the use of the Platform without undue delay after becoming aware of it and by sending an e-mail to the Customer's DPO. The Customer will then inform the DSB, the ICO, or the supervisory authority competent in accordance with article 55 of the GDPR, as applicable, and the Data Subjects, if necessary.

This notification must:

• be accompanied by any useful documentation to enable the Controller, if necessary, to notify this violation to the DSB, the ICO, or the competent supervisory authority in compliance with article 55 of the GDPR, as applicable;
• where possible, include:
  • a description of the nature of the Personal Data breach including, if possible, the approximate number of Data Subjects affected by the breach and the approximate number of Personal Data records affected;
  • a description of the consequences of the Personal Data breach and the measures taken to remedy the breach, including, where applicable, measures to mitigate any negative consequences.

Storyclash will cooperate and assist the Controller for the Controller to comply with its obligations under articles 33 and 34 of the GDPR, taking into account the nature of processing and the information available to Storyclash.

When the violation of Personal Data concerns Processing Operations for which Storyclash acts in its capacity as Controller, Storyclash will implement all the obligations applicable under the Applicable Regulations, including articles 33 and 34 of the GDPR.

7.SECURITY MEASURES TO PROTECT DATA SUBJECTS' PERSONAL DATA

To ensure the protection of the Personal Data of the Data Subjects and processed through the Platform, Storyclash undertakes to implement appropriate security measures in compliance with article 32 of the GDPR, including:

• pseudonymization and encryption of Personal Data;
• means to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
• the means to restore availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
• a process for regularly testing, analyzing and evaluating the effectiveness of technical and organizational measures to ensure the security of processing.

Storyclash also guarantees that the persons authorized to process personal data are subject to an obligation of confidentiality or are subject to an appropriate legal obligation of confidentiality.

The main technical and organizational security measures implemented by Storyclash to comply with article 32 of the GDPR are listed in Appendix 3 of the DPA.

8.FATE OF PERSONAL DATA AFTER TERMINATION OF SUBSCRIPTION

At the end of the Subscription, depending on the Customer's choice, when Storyclash acts as a Processor, Storyclash undertakes to:

• destroy the Personal Data subject to this DPA; or
• return to the Customer, or to the Processor designated by him, in a format commonly used and readable by the Customer or in an interoperable format the Personal Data processed by Storyclash as a Processor. The return will be accompanied by the destruction of all existing copies in Storyclash’s information systems.

Storyclash may nevertheless retain some Personal Data in order to satisfy its legal obligations, namely for accounting purposes and if needed, for the establishment, exercise or defense of legal claims. In such case, Personal Data will be stored on an archiving database with access limited to a certain number of people and Storyclash will inform the Customer of the applicable retention period.

9.STORYCLASH SUB-PROCESSORS

Storyclash, when acting as a Processor, may call upon other processors (the “Sub-Processor”) to carry out specific Processing Operations, which the Customer accepts.

Storyclash will inform the Customer in advance in writing of any changes envisaged concerning the addition or replacement of Sub-Processor involved in the Processing Operations. This information will indicate the Processing Operations entrusted to Sub-Processor and the identity of the next Sub-Processor. The Customer will have a maximum of ten (10) days from the date of receipt of this information to present any objections. This sub-processing may only be carried out if the Customer has not raised any objections within the agreed period.

On the date the Subscription is taken out, Storyclash’s Sub-Processors are listed in Appendix 1 of the DPA.

The Sub-Processor is required to comply with the obligations of the DPA on behalf of and in accordance with the instructions of the Customer. Storyclash will ensure that the Sub-Processor presents the same sufficient guarantees regarding the implementation of appropriate technical and organizational measures so that the processing meets the requirements of the Applicable Regulations.

In any case, Storyclash shall remain fully liable to the Customer for the performance of the Sub-Processor’s obligations.

10.LOCATION AND TRANSFERS

Storyclash undertakes to host the Personal Data of Data Subjects on servers located within the territory of the European Union (the “EU”) or the United Kingdom (the "UK"). Storyclash informs the Customer that the Personal Data of Data Subjects hosted on the Platform will be hosted on servers located in Austria.

In the event of a change in the countries of destination by Storyclash, the latter must inform the Customer in advance, if this change concerns Processing Operations performed by Storyclash as a Processor, without delay. Where applicable, Storyclash shall provide the Customer with an updated list of recipient countries.

Storyclash may also use Sub-Processors located outside the European Union and/or the United Kingdom. In this case, Storyclash undertakes to do so on the basis of an adequacy decision, or to put in place the appropriate safeguards in accordance with the Applicable Regulations, in particular articles 45 and 46 of the GDPR, and to inform the Customer when the Sub-Processors are located outside of the European Union and/or the United Kingdom.

11.WARRANTY AND LIABILITY

Each Party shall be responsible for:

• in accordance with common law, of its failures vis-à-vis the other Party in the performance of the DPA;
• of compliance with the Applicable Regulations and guarantees the other Party in the event of non-compliance with its obligations and if such non-compliance causes it direct and certain harm.

In compliance with article 82 of the GDPR:

• Parties acknowledge that any Data Subject who has suffered material or non-material damage as a result of an infringement of the GDPR shall have the right to receive compensation from the Controller or Processor for the damage suffered. Acting as a Processor, Storyclash will be liable in the event of non-compliance with the Customer's instructions for the Processing Operations described in article 2.2 of the DPA or where Storyclash has not complied with obligations of the Applicable Regulations specifically directed to Processors. Parties shall be exempt from liability if they prove that they are not in any way responsible for the event giving rise to the damage.
• If Storyclash and the Customer are involved in the same processing, and where they are responsible for any damage caused by this processing to Data Subjects, each Party shall be held liable for the entire damage in order to ensure effective compensation of the Data Subjects;
• where a Party has paid full compensation for the damage suffered by the Data Subjects, that Party shall be entitled to claim back from the other Party involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage.

12.FINAL PROVISIONS

Requirement of written form

This Agreement is conclusive. No verbal ancillary agreements exist at the time of the conclusion of the Agreements; any amendments must be made in writing.

Governing law

This Agreement shall be governed by Austrian law to the exclusion of the conflict of law rules of Austrian private international law.

Any disputes arising out of or in connection with this Agreement, including its conclusion, breach, dissolution, validity or invalidity, shall be subject to the exclusive jurisdiction of the courts having subject-matter jurisdiction for Linz.

APPENDIX 1 – DESCRIPTION OF PURPOSE OF PROCESSING

Storyclash GmbH (further called Storyclash) is a social media content discovery tool for publishers, brands, agencies and corporate communication. We give them a real-time view of what’s trending right now by analyzing social media interactions like shares, comments, likes and other reactions. Storyclash users are able to discover viral articles, watch competitors in real-time and make data driven decisions to get more website traffic and higher engagement.

For that purpose, Storyclash captures data from the users including (as data processor):

• Email address
• Full name if specified
• IP address
• geographical location (based on IP address)
• time of visit
• screen resolution & screen size
• device type, based on the user agent string.

For that purpose Storyclash captures data from the contractor’s employees (users which are working with the Storyclash dashboard) including (as data controller):

• Email address
• IP address
• Full Name

APPENDIX 2 – SUB-PROCESSORS