Effective Date: 2024-07-30
Deliverables are based on Client needs and are to be negotiated between both parties during Contract and Quote negotiations. Final deliverable deadlines will be mutually agreed upon.
Client can receive up to (3) Revisions per item.
Either party may terminate this agreement with a 60-day written notice. Payment for completed work will be invoiced, if applicable.
Confidentiality
Confidentiality. Neither party shall disclose or use any confidential information of the other party, except to the extent reasonably necessary to perform its obligations or exercise its rights under this Agreement, without the prior written consent of the other party.
Protection of information. Each party agrees to protect the other party’s confidential information in the same manner as it protects its own confidential information of a similar kind, but in no event using a lower than reasonable standard of care.
Exclusions. Confidential information does not include information that, at the time of disclosure, is: (a) in the public domain; (b) known to the receiving party at the time of disclosure; (c) lawfully obtained by the receiving party from a third party without obligation of confidentiality; or (d) independently developed by the receiving party without the use of the other party’s confidential information. Notwithstanding the foregoing, each party may disclose confidential information to the limited extent required (i) to comply with the order of a court or other governmental entity, or as necessary to comply with applicable law, provided that, as permitted by applicable law, the party making the disclosure under the order has given prior written notice to the other party and has made an effort. reasonable to obtain a protective order; or (ii) to establish a party’s rights under this Agreement, including the filing of required court documents. Upon expiration or termination of the Agreement, the receiving party shall return within ten (10) calendar days to the disclosing party all copies, whether in written, electronic or other form or medium, of the Disclosing Party’s Confidential Information, or destroy all such copies and certify in writing to the disclosing party that such Confidential Information has been destroyed. Each party’s non-disclosure obligations with respect to Confidential Information are effective upon execution of the Order Form and shall expire five years upon termination or expiration of this Agreement; provided, however, with respect to any Confidential Information that constitutes a trade secret (as determined under applicable law), such non-disclosure obligations shall survive termination or expiration of this Agreement for as long as such Confidential Information remains subject to trade secret protection under applicable law, which may not exceed three years. . Each party acknowledges and agrees that a breach or threatened breach by such party of any of its obligations under this Section 9 may cause irreparable harm to the other party for which monetary damages would not be an adequate remedy and agrees that, in the event of such breach or threatened breach, The other party shall be entitled to an equitable remedy, including a restraining order, court order, specific performance, and any other remedy that may be available in any court, without the need to present a guarantee or other security, or to prove actual damages or that monetary damages are not an adequate remedy. Such remedies are non-exclusive and are in addition to all other remedies that may be available at law, in equity or otherwise.Disclaimer
Statements. Each party represents and warrants that: (a) it has the necessary power and authority to enter into and perform this Agreement; (b) is not subject to any contractual or legal restrictions that prevent the performance of this Agreement; and (c) performance of your obligations under this Agreement will not violate any applicable law or any contract to which you are subject.
Disclaimer. Except for the limited warranty set forth in section 10.1, the service is provided “as is” and TAG disclaims all warranties, whether express, implied, statutory or otherwise. TAG hereby expressly disclaims all implied warranties of merchantability, fitness for a particular purpose, title and non-infringement, and all warranties arising from course of dealing, usage or trade practice.
Limitation of Liability. In no event shall either party be liable to the other for any indirect, special, incidental, punitive or consequential damages, including, but not limited to, lost profits, loss of data, loss of use, or delays in delivery, even if such party has been advised of the possibility of such damages. The amount payable to the affected party for damages regardless of their nature for the proven damage caused shall be limited to the amount paid by the client during the period of twelve (12) months preceding the incident giving rise to liability.
Indemnification
Indemnification of TAG. TAG will indemnify, defend and hold Client harmless from and against any loss, damage, liability, cost (including reasonable attorneys’ fees) (“Losses”) incurred by Client as a result of any third party claim, demand, action or proceeding (“Third Party Claim”) that the Service infringes or misappropriates U.S. third party patents, copyrights or trade secrets, provided that Customer immediately notifies TAG within forty-eight (48) hours of becoming aware of or notifying TAG in writing of the claim or cause of the claim , cooperate with TAG and allow TAG exclusive authority to control the defense and settlement of such claim. If such a claim is or appears possible, Client agrees to allow TAG, in TAG’s sole discretion, to (A) modify or replace the Service, or the component or portion thereof, so that it does not infringe, or (B) obtain the right for Client to continue using the Service. If TAG determines that none of the alternatives are reasonably available, TAG may terminate this Agreement, in whole or with respect to the affected component or part, effective immediately upon written notice to Client, and refund a prorated portion of the fees for such Service. This Section shall not apply to the extent that the alleged infringement arises from: (A) use of the Service in combination with data, software, hardware, equipment or technology not provided by TAG; (B) modifications to the Service not made by TAG; or (C) Client Data.
Client Indemnification. Client shall indemnify, hold harmless and, at TAG’s option, defend TAG, its affiliates, and their successors and assigns, from and against any Losses resulting from any Third Party Claim: (i) that Client Data, or any use of Client Data in accordance with this Agreement, infringes or misappropriates the intellectual property or other rights of third parties; or (ii) based on negligence or conduct (b) use of the Service in a manner not authorized by this Agreement; (c) use of the Service in combination with data, software, hardware, equipment or technology not provided by TAG; or (d) modifications to the Service not made by TAG; provided that the client is unable to settle any Third Party Claim against TAG unless TAG consents to such agreement, and in addition TAG shall have the right, in its discretion, to defend against any Third Party Claim or to participate in its defense through counsel of its choice.
Sole remedy and Limitation of Liability. This section sets forth the Client’s sole remedies and TAG’s sole liability and liability for any actual, threatened or alleged claim that the Services infringe, misappropriate or otherwise violate the intellectual property rights of any third party. In no event shall either party be liable under or in connection with this agreement under any legal or equitable theory, including breach of contract, tort (including negligence), strict liability and otherwise, for: (a) consequential, incidental, indirect, exemplary, special, enhanced or punitive damages; (b) lost business, production, revenue or profits; (c) use, inability to use, loss, interruption, delay or recovery of any data or system security breach; or (d) replacement cost of goods or services, in each case regardless of whether a party was advised of the possibility of such loss or damage or whether such loss or damage was otherwise foreseeable. In no event shall TAG’s aggregate liability arising out of or in connection with this Agreement under any legal or equitable theory, including breach of contract, tort (including negligence), strict liability and otherwise exceed the total amounts paid to TAG for this Agreement during the twelve (12) month period preceding the event giving rise to the claim.
Termination
Termination and Asset Retention Clause: For early contract termination, clients must pay all due fees for the remaining contract period, calculated as the average invoice amount plus 20%. If the Client operates under a fixed fee model, the remaining contract value will be calculated based on the agreed monthly fee, with a minimum of $650 USD per month. Assets will be withheld until the contract concludes. Clients can access them earlier by paying for the remaining months of the contract. By signing this contract, the client unequivocally accepts the invoiced terms set by TAG related to contract termination, with no objections or claims against these terms.
Termination by Insolvency or Material Default. Either party may terminate this Agreement at any time during the Term, with written notice to the other party, upon any of the following conditions: (a) immediately, if the other party becomes insolvent, enters bankruptcy, liquidation, judicial or administrative intervention, judicial examination or administration, or a similar event in any jurisdiction; and (b) for material breach by the other party, provided that such breach is not cured no later than thirty (30) calendar days after delivery of written notice of the causes of such breach. In the event this Agreement is terminated under this clause, all products and services set forth in the Order Form will terminate immediately. In the event of insolvency, the affected party must provide a formal legal notice to the other party, clearly stating their financial insolvency, as per relevant legal definitions and regulations.
Effect of termination. The termination or expiration of this Agreement, for any reason, shall not relieve Client of the obligation to pay any Fee to TAG prior to the effective date of such termination or expiration. Upon termination for cause by TAG, all future amounts due under the Order Form shall be accelerated and shall become immediately due and payable by the Client.
Non-Circumnavigate, Non-Compete, Non-Solicitation. Partner shall not circumnavigate TAG in any way by approaching any of TAG’s suppliers, vendors, software partners contractors, team members, clients to create any form of partnership, supply, fulfillment, employment, provision of service or product or creation, management, sale or provision of software or consultative service provision for its own standalone brand or company.
General
Entire Agreement. This Agreement sets forth the entire agreement between the parties with respect to the subject matter hereof and supersedes and renders invalid any oral or written agreements previously submitted.
TAG visits the property. The Client will provide up to 4 complimentary nights of accommodation per year free of charge for the TAG team to stay on-site when required for the purpose of training team, conducting strategy and account management meetings, product evaluation and campaign building.
Cession. This Agreement may not be assigned, transferred, in whole or in part, without the prior written consent of the other party.
Divisibility. If any part of any provision of this Agreement is held to be invalid or unenforceable by a court of competent jurisdiction, that part shall be ineffective to the extent of such invalidity or unenforceability only, without affecting in any way the remaining provisions of this Agreement.
No Third Party Rights. No person, other than those involved in or authorized by this Agreement , shall have the right to enforce any term of this Agreement.
No compensation. Except as expressly set forth in this Agreement or otherwise expressly agreed, Client may not withhold payment of any amount due, for reasons of set-off, against claim, diminution or analogous deduction.
Force majeure. Neither Customer nor TAG shall be liable for any delay or failure to perform its obligations under this Agreement (except Client’s payment obligations) where such delay or failure is caused by force majeure or acts of God, war, national emergencies, natural disasters, strikes, labor disputes, utility failures, government regulations, riots, adverse weather conditions and other similar causes not under the Control of either party.
Right to publication of public relations and marketing. As of the effective date of this Agreement, Client grants TAG the right to use Client’s name for marketing, advertising, press releases, public announcements, and performance announcements for purposes of demonstrating skill and results obtained through the Service. TAG is entitled to request a case study twice a year from the Client for the purposes of marketing its Service and results to prospective clients. The Client may reject a request for a case study at any time but may not refuse the use of the information for advertising, marketing, communication, or case study purposes once published in the public domain. Client grants TAG the right to utilize the Client’s name with prior approval before release.
Governing Law. This agreement shall be construed and controlled in accordance with the laws of the State of Nevada, U.S.A., without reference to its conflict of law principles. The parties agree that all disputes arising under this agreement shall be submitted exclusively to the proceedings provided in such legislation, by the state and federal courts of Nevada, United States, and all parties irrevocably consent to jurisdiction and venue in such courts. The parties irrevocably waive all rights of trial by jury in any action, proceeding or counterclaim (whether based in contract, tort or otherwise) arising out of or relating to this agreement or the actions of any party in its administration, performance, and enforcement. In the event of a dispute arising out of this agreement, the prevailing or prevailing party in the litigation shall be entitled to its reasonable costs and attorneys’ fees.
Engineering and Software Support
Hours of Operation: Technical support is available from 9:00 am to 5:30 pm (EST) Monday through Friday, and digital account support is available from 9:00 am (EST) to 5:30 pm (EST).
Points of contact: The support team can be contacted by email in support@theanythinggroup.com.
Third Party Disclaimer: TAG will always endeavor to resolve any dispute or complication as quickly as possible. TAG recognizes that it is integral to a hotel’s business and any downtime or other issues may adversely affect revenue. However, as many of the services that TAG provides require integration with other systems, complications may originate outside the Reservation Service and the resolution of them, in such cases, will depend on third parties that must be coordinated by the client, who will assume the cost of them. In such cases, TAG will work with the third party indicated by the client, to resolve any complications as quickly as possible, however, resolution times ultimately depend on the assistance of the third party.
Annex 1: Data Processing Addendum
This Data Processing Addendum (“DPA”), forms part of, and is subject to, the TAG Order Form and Terms and Conditions between TAG and Client that reference this DPA (the “Agreement”). By entering into the Agreement, the parties enter into this DPA on behalf of themselves and, to the extent required under applicable Data Protection Laws, in the name and on behalf of their affiliates, and this DPA shall be effective on the effective date of the Agreement (“Effective Date”).
All capitalized terms not defined in this DPA shall have the meanings set forth in the Agreement.
“Client Data” has the meaning set forth in the Agreement.
“Client Personal Data” means any Client Data that is Personal Data.
“Data Protection Laws” means all data protection and privacy laws applicable to the respective party in its role in the Processing of Personal Data under the Agreement, including, where applicable, in the EU, the GDPR and its implementing regulations, the UK GDPR and in the U.S., the California Consumer Privacy Act of 2018 (“CCPA”), the California Privacy Rights Act of 2020, the Virginia Consumer Data Protection Act of 2021, and the Colorado Privacy Act of 2021.
“Data Controller” means an entity that determines the purposes and means of the Processing of Personal Data.
“Data Processor” means an entity that processes Personal Data on behalf of a Data Controller.
“EU Data Protection Law” means (i) prior to 25 May 2018, Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the Processing of Personal Data and on the free movement of such data (“Directive”) and (ii) on and after 25 May 2018, Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (“GDPR”), and repealing Directive 95/46/EC.
“EEA” means, for the purposes of this DPA, the European Economic Area and/or its member states, United Kingdom and/or Switzerland.
“Model Clauses” means the European Commission’s Standard Contractual Clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council set forth in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (C/2021/3972, OJ L 199, 7.6.202), as approved by the European Commission.
“Personal Data” means information that: (i) identifies or can be used to identify an individual (including, without limitation, names, signatures, addresses, telephone numbers, e-mail addresses and other unique identifiers); (ii) can be used to authenticate an individual (including, without limitation, employee identification numbers, government-issued identification numbers, passwords or PINs, financial account numbers, credit report information, biometric or health data, answers to security questions and other personal identifiers); or
(iii) relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual, including inferences about such individual. In the case of subclauses (i) through (iii), this information includes, without limitation, all Sensitive Personal Data. Further, the term “Personal Information” as defined in the CCPA shall have the same meaning as Personal Data used herein.
“Processing” has the meaning given to it in the GDPR and “process,” “processes” and “processed” will be interpreted accordingly.
“Purposes” shall mean the data Processing purposes described and defined in Section 3.4 of this DPA.
“Security Incident” means any (a) unauthorized or unlawful breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Client Personal Data, but does not include any Unsuccessful Security Incident.
“Services” means the Service provided by Provider to Client pursuant to the Agreement.
“Sensitive Personal Data” is a subset of Client Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the Processing of genetic data, biometric data for the purposes of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. Further, the term “Sensitive Personal Information” as defined in the CCPA shall have the same meaning as Sensitive Personal Data used herein.
“Sub-processor” means any Data Processor engaged by Provider or its affiliates to assist in fulfilling its obligations with respect to providing the Services pursuant to the Agreement or this DPA. Sub-processors may include third parties or Provider’s affiliates.
“UK GDPR” means the Data Protection Act 2018, as well as the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of Section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419).
“Unsuccessful Security Incident” means an unsuccessful attempt or activity that does not compromise the security of Client Personal Data, including (without limitation) pings and other broadcast attacks of firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, packet sniffing (or other unauthorized access to traffic data that does not result in access beyond headers) or similar incidents.
2.1 Scope and Applicability. This DPA applies where and only to the extent that Provider Processes Client Personal Data on behalf of Client as Data Processor in the course of providing Services pursuant to the Agreement. Any other Processing of Personal Data with respect to Client and its users conducted by Provider as a Data Controller, including business relationship administration and system security, will be carried out in accordance with Provider’s then-current privacy policy located at https://www.TAG.com/privacy-policy/, as the same may be modified in Provider’s sole discretion from time to time. Notwithstanding expiry or termination of the Agreement, this DPA and Model Clauses (if applicable) will remain in effect until, and will automatically expire upon, deletion of all Client Personal Data by Provider as described in this DPA.
3.1 Role of the Parties. If and to the extent that the Services provided by Provider under the Agreement require Provider to Process Personal Data, then as between Provider and Client, Provider shall process Client Personal Data only as a Data Processor acting on behalf of Client. Under the CCPA, Client shall process Client Personal Data as a “Service Provider” Client is either the Data Controller of Client Personal Data, or in the case that Client is acting on behalf of a third-party Data Controller, then a Data Processor.
3.2 Client Processing of Personal Data. Client represents and warrants that: (i) it will comply with its obligations under Data Protection Laws in respect of its Processing of Personal Data, including any obligations specific to its role as a Data Controller; (ii) it has provided all notices and obtained all consents, assignments, licenses, authorizations, permissions and/or rights necessary under Data Protection Laws for Provider to lawfully Process Personal Data as contemplated under this Agreement for the Purpose; and (iii) it shall ensure its Processing instructions are lawful, and that Provider’s Processing of Client Personal Data in accordance with such instructions will not violate or infringe upon applicable Data Protection Laws or intellectual property, publicity, privacy or other rights governing such Client Personal Data. If Client is itself a Data Processor acting on behalf of a third-party Data Controller, Client further represents and warrants to Provider that Client’s instructions and actions with respect to that Client Personal Data, including its appointment of Provider as another Data Processor, have been authorized by the relevant Data Controller.
3.3 Provider Processing of Personal Data. Provider will process Client Personal Data only to the extent, and in such a manner, as is necessary for the Purposes and in accordance with Client’s documented lawful instructions. Provider will not, and will ensure its Sub-processors do not, combine Client’s Personal Data with any Personal Data from other sources, or which Provider or its Sub-processor collected on its own behalf, except as permitted by Data Protection Laws, and will not “sell” any Client Personal Data within the meaning of the CCPA or otherwise. The parties agree that the Agreement (including this DPA) sets out the Client’s complete and final instructions to Provider in relation to the Processing of Client Personal Data. Additional Processing outside the scope of these instructions (if any) will require prior written agreement between Client and Provider.
3.4 Details of Data Processing
(a) Subject matter: The subject matter of the data Processing under this DPA is the Client Personal Data.
(b) Duration: As between Provider and Client, the duration of the data Processing under this DPA is determined by Client and as set forth in the Agreement.
(c) Purpose: The purpose of the Processing under the Agreement is the provision of Services by Provider to Client as specified in the Agreement (the “Purpose”).
(d) Nature of the Processing: Provider provides Services and such as other Services as described in the Agreement, which may include the Processing of Client Personal Data upon the instruction of the Client in accordance with the terms of the Agreement.
(e) Categories of data subjects: Client may submit Client Personal Data to the Services or may direct Provider to submit Client Personal Data to the Services, the extent of which is determined and controlled by Client in its sole discretion, and which may include, but is not limited to, Personal Data relating to the following categories of data subjects:
(i) Prospects, customers, business partners and vendors of Client (who are natural persons);
(ii) Employees or contact persons of Client’s prospects, customers, business partners and vendors;
(iii) Employees, agents, advisors, independent contractors of Client (who are natural persons); and/or
(iv) Client’s end-users authorized by Client to use the Services.
(f) Types of Personal Data: Client may submit Client Personal Data to the Services or may direct Provider to submit Client Personal Data to the Services, the extent of which is determined and controlled by Client in its sole discretion, and which may include, but is not limited to, the following types of Personal Data:
(i) Identification and contact data (such as name, title, contact details, address, phone number, device identifiers, email address, Client’s username or other user identifiers, and social media handle); (ii) Financial information (such as purchase details, transactional details, billing details, credit or debit card meta-data, account details, eligibility details, subscription details, and payment information);(iii) Employment details (such as employer, job title, geographic location, and area of responsibility); and/or (iv) IT information (IP addresses, usage data, cookies data, and location data).
3.5 Responsibility for Client Personal Data. Without limiting anything else herein or in the Agreement, Client acknowledges and agrees that is it solely responsible and liable for all Client Personal Data that it submits to the Services and/or directs Provider to submit to the Services, including, without limitation, any Client Personal Data which is misattributed, mislabeled, and/or miscategorized.
3.6 GDPR Compliance.
In accordance with the General Data Protection Regulation (GDPR), TAG commits to adhering to all obligations and provisions set forth under the GDPR. This includes, but is not limited to, ensuring lawful processing of Personal Data, upholding the rights of data subjects, and maintaining appropriate security measures to protect data.
3.7 CCPA Compliance.
TAG acknowledges and agrees to comply with the California Consumer Privacy Act (CCPA) in the handling, processing, and management of Personal Data. This includes respecting the privacy rights of consumers as outlined in the CCPA, such as the right to access, delete, or opt-out of the sale of their personal information.
3.8 Nevada Data Protection Compliance.
In alignment with Nevada Data Protection laws, TAG shall adhere to the stringent data privacy and security measures mandated by these laws. We commit to processing Personal Data in a manner that is consistent with the provisions and protections offered under Nevada’s data protection statutes.
4.1 Authorized Sub-processors. Client agrees that Provider may engage Sub-processors to process Client Personal Data on Client’s behalf. Provider shall (i) provide an up-to-date list of the Sub-processors it has appointed upon written request from Client; and (ii) notify Client (for which publication on Provider’s website or via email will suffice) if it adds or removes Sub-processors at least fourteen (14) days’ prior to allowing such Sub-processor to process Client Personal Data. Client may object in writing to Provider’s appointment of a new Sub-processor within five (5) calendar days of such notice, provided that such objection is based on reasonable grounds relating to data protection. In such event, the parties will discuss such concerns in good faith with a view to achieving resolution. If Provider cannot provide an alternative Sub-processor, or the parties are not otherwise able to achieve resolution as provided in the preceding sentence, Client, as its sole and exclusive remedy, may terminate the Agreement (including this DPA) but shall not be eligible for any refund and Client must immediately pay all fees payable under the Agreement. If Client has not notified Provider of its objection within the time period set forth in this Section 4.1, then Client will be deemed to have approved the use of the new Sub-processor.
4.2 Automated Notification Mechanism. For purposes of providing notice in accordance with Section 4.1 of this DPA, Provider may implement mechanisms by which Client can receive automated notifications of new Sub-processor engagements (each, an “Automated Notification Mechanism”) at no additional cost to Client. If Provider implements an Automated Notification Mechanism, Provider will notify Client and provide detailed instructions on the use of such Automated Notification Mechanism, and Client agrees to register for and use any Automated Notification Mechanism if it is made available by Provider.
4.3 Sub-processor Obligations. Provider will: (i) enter into a written agreement with the Sub-processor imposing data protection terms that require the Sub-processor to Process the Client Personal Data in a manner that is substantially similar to the standards set forth in this DPA, and, to the extent applicable to the Services provided by Provider, to the standard required by Data Protection Laws; and (ii) remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Sub-processor that cause Provider to breach any of its obligations under this DPA.
5.1 Security Measures. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Provider shall implement and maintain appropriate technical and organizational security measures to protect Client Personal Data from Security Incidents and to preserve the security and confidentiality of the Client Personal Data Processed by Provider on behalf of Client to the extent such measures are applicable to Provider’s Processing of Client Personal Data in performance of the Services (“Security Measures”).
5.2 Updates to Security Measures. Client is responsible for reviewing the information made available by Provider relating to data security and making an independent determination as to whether the Services meet Client’s requirements and legal obligations under Data Protection Laws. Client acknowledges that the Security Measures are subject to technical progress and development and that Provider may update or modify the Security Measures from time to time provided that such updates and modifications do not result in a material degradation of the overall security of the Services subscribed to by Client.
5.3 Security Measures by Client. Client is responsible for using and configuring the Services in a manner that enables Client to comply with Data Protection Laws, including implementing appropriate technical and organizational measures.
5.4 Confidentiality of Processing. Provider shall ensure that any person who is authorized by Provider to process Client Personal Data (including its staff, agents and subcontractors) shall be under an appropriate obligation of confidentiality (whether a contractual or statutory duty).
5.5 No Assessment of Client Data by Provider. Client acknowledges that Provider will not assess the contents of Client Data in order to identify information subject to any specific legal requirements. Client is solely responsible for complying with incident notification laws applicable to Client and fulfilling any third-party notification obligations related to any Security Incidents.
5.6 Client Responsibilities. Client agrees that, without prejudice to Provider’s obligations under Section 5.1 (Security Measures) and Section 8.3 (Security Incident Response):
(a) Client is responsible for its use of the Services, including making appropriate use of the Services to ensure a level of security and appropriate to the risk in respect of the Client Personal Data, securing its account authentication credentials, managing its data back-up strategies, and protecting the security of Client Personal Data when in transit to and from the Services and taking any appropriate steps to pseudonymize, securely encrypt, and/or backup any Client Personal Data uploaded to the Services; and
(b) Provider has no obligation to protect Client Personal Data that Client elects to store or transfer outside of Provider’s and its Sub-processors’ systems (for example, offline or on-premise storage).
6.1 Information requests. Provider shall also provide written responses (on a confidential basis) to all reasonable requests for information made by Client related to its Processing of Client Personal Data, including responses to information security and audit questionnaires that are necessary to confirm Provider’s compliance with this DPA, provided that Client shall not exercise this right more than once per year, except that this right may also be exercised in the event Client is expressly requested or required to provide this information to a data protection authority, or Provider has experienced a Security Incident, or other reasonably similar basis.
7.1 International Processing. Provider may process Client Data anywhere in the world where Provider, its affiliates or its Sub-processors maintain data Processing operations, including the EEA. Provider will at all times provide appropriate safeguards for the Client Personal Data wherever it is processed, in accordance with the requirements of Data Protection Laws.
7.2 EEA Transfers. To the extent that Provider processes any Client Personal Data protected by applicable Data Protection Laws of the EEA (“EEA Data”), the parties agree that Provider makes available the transfer mechanisms listed below, for any transfers of EEA Data from the EEA to Provider located in a country which does not ensure an adequate level of protection (within the meaning of applicable Data Protection Law) and to the extent such transfers are subject to such Data Protection Laws of the EEA, Provider agrees to abide by and process EEA Data in compliance with the Model Clauses and for these purposes Provider agrees that it is a “data importer” and Client is the “data exporter” under the Model Clauses (notwithstanding that Client may be an entity located outside of the EEA).
8.1 Deletion by Client. Provider will enable Client to delete Client Data during the Term in a manner consistent with the functionality of the Service.
8.2 Deletion on Termination. For thirty (30) days following termination or expiration of the Agreement, Client shall have the option to retrieve any remaining Client Personal Data in accordance with the Agreement. Thereafter, Client instructs Provider to automatically delete all remaining (if any) Client Personal Data (including copies). Provider shall not be required to delete Client Personal Data to the extent (i) Provider is required by applicable law or order of a governmental or regulatory body to retain some or all of the Client Personal Data; and/or (ii), Client Personal Data has been archived on back-up systems, which Client Personal Data Provider shall securely isolate and protect from any further Processing, except to the extent required by applicable law.
8.3 Security Incident Response. Upon confirming a Security Incident, Provider shall: (i) notify Client without undue delay, and in any event such notification shall, where feasible, occur no later than seventy two (72) hours from Provider confirming the Security Incident; (ii) provide timely information relating to the Security Incident as it becomes known or as is reasonably requested by Client; and (iii) Provider shall promptly take reasonable steps to contain, investigate, and mitigate any Security Incident. Provider’s notification of or response to a Security Incident under this Section 8.3 (Security Incident Response) will not be construed as an acknowledgment by Provider of any fault or liability with respect to the Security Incident.
9.1 Cooperation. If a law enforcement agency sends Provider a demand for Client Personal Data (e.g., a subpoena or court order), Provider will attempt to redirect the law enforcement agency to request that data directly from Client. As part of this effort, Provider may provide Client’s contact information to the law enforcement agency. If compelled to disclose Client Personal Data to a law enforcement agency, then Provider will give Client reasonable notice of the demand to allow Client to seek a protective order or other appropriate remedy to the extent Provider is legally permitted to do so.
9.2 Data Subject Access Requests. Taking into account the nature of the Processing, Provider shall (at Client’s request and expense) provide reasonable cooperation to enable Client to respond to any requests from applicable data protection authorities or a data subject to exercise its rights (to the extent available to them under Data Protection Laws) of access, right to rectification, restriction of Processing, erasure (“right to be forgotten”), data portability, objection to the Processing, their right not to be subject to automated individual decision making, to opt-out of the sale of Personal Data, or the right not to be discriminated against, in each case solely to the extent relating to the Processing of Client Personal Data through the Services under the Agreement. For the avoidance of doubt, Client remains responsible for any handling such requests in the appropriate manner on systems it controls, manages or owns, such as Client’s data warehouse hosted on a major cloud provider. In the event that any request is made directly to Provider where such request identifies Client, Provider shall not respond to such communication directly without Client’s prior authorization, unless legally compelled to do so, and instead, after being notified by Provider, Client shall respond. If Provider is required to respond to such a request, Provider will promptly notify Client and provide it with a copy of the request unless legally prohibited from doing so.
9.3 Records. Client acknowledges that Provider is required under the GDPR or the UK GDPR, as applicable to:
(a) collect and maintain records of certain information, including the name and contact details of each Data Processor and/or Data Controller on behalf of which Provider is acting and, where applicable, of such Data Processor’s or Data Controller’s local representative and data protection officer; and (b) make such information available to the supervisory authorities. Accordingly, if the GDPR or UK GDPR applies to the Processing of Client Personal Data, Client will, where requested, provide such information to Provider via the Services or other means provided by Provider, and will ensure that all information provided is kept accurate and up-to-date.
9.3 DPIA. To the extent Provider is required under EU Data Protection Law, Provider shall (at Client’s request and expense) provide reasonably requested information regarding the Services to enable the Client to carry out data protection impact assessments or prior consultations with data protection authorities as required by law.
10.1 The parties agree that this DPA shall replace and supersede any existing data processing addendum, attachment or exhibit (including the Model Clauses (as applicable) the parties may have previously entered into in connection with the Services.
10.2 Except for the changes made by this DPA, the Agreement remains unchanged and in full force and effect. If there is any conflict between this DPA and the Agreement, this DPA shall prevail to the extent of that conflict in connection with the Processing of Client Personal Data.
10.3 Notwithstanding anything to the contrary in the Agreement or this DPA, the liability of each party and each party’s affiliates under this DPA shall be subject to the limitations on liability set out in the Agreement. Without limiting either of the parties’ obligations under the Agreement, Client agrees that any regulatory penalties incurred by Provider in relation to the Client Personal Data that arise as a result of, or in connection with, Client’s failure to comply with its obligations under this DPA or any applicable Data Protection Laws shall count toward and reduce Provider’s liability under the Agreement as if it were liability to the Client under the Agreement.
10.4 Any claims against Provider or its affiliates under this DPA shall only be brought by the Client entity that is a party to the Agreement against the Provider entity that is a party to the Agreement. In no event shall this DPA or any party restrict or limit the rights of any data subject or of any competent supervisory authority.
10.5 This DPA will be governed by and construed in accordance with governing law and jurisdiction provisions in the Agreement, unless required otherwise by applicable Data Protection Laws.
Statements: Each party represents and warrants that:
This Data Processing Addendum (“DPA”), forms part of, and is subject to, the TAG Agreement and Terms and Conditions between TAG and Client that reference this DPA (the “Agreement”). By entering into the Agreement, the parties enter into this DPA on behalf of themselves and, to the extent required under applicable Data Protection Laws, in the name and on behalf of their affiliates, and this DPA shall be effective on the effective date of the Agreement (“Effective Date”).
All capitalized terms not defined in this DPA shall have the meanings set forth in the Agreement.
(e) Categories of data subjects: Client may submit Client Personal Data to the Services or may direct Provider to submit Client Personal Data to the Services, the extent of which is determined and controlled by Client in its sole discretion, and which may include, but is not limited to, Personal Data relating to the following categories of data subjects:
(f) Types of Personal Data: Client may submit Client Personal Data to the Services or may direct Provider to submit Client Personal Data to the Services, the extent of which is determined and controlled by Client in its sole discretion, and which may include, but is not limited to, the following types of Personal Data:
Client agrees that, without prejudice to Provider’s obligations under Section (Security Measures) and Section (Security Incident Response):
Upon confirming a Security Incident, Provider shall:
Provider’s notification of or response to a Security Incident under this Section (Security Incident Response) will not be construed as an acknowledgment by Provider of any fault or liability with respect to the Security Incident.
Client acknowledges that Provider is required under the GDPR or the UK GDPR, as applicable to:
