This Data Processing Addendum (“DPA”) is between MadTech, LLC (d/b/a MadConnect) with offices at 108 W. 39th Street, Suite 1016, New York, NY 10018 ("MadTech") and the counter-party identified in a mutually executed ordering document (“Order”) executed pursuant to the Terms of Service (as defined in Section 1.1 below) (“Client”), each a “Party” and together the “Parties”.
These terms govern the transfer of Personal Data between Client and MadTech and the Processing of that Personal Data under those certain MadTech Terms of Services dated October 07, 2024 between the Parties (the “Terms of Service”), pursuant to which MadTech provides certain services to Client. By agreeing to the Terms of Service, of which this DPA forms an integral part, the Parties agree to be bound by the following terms and conditions of this DPA relating to the Processing of Personal Data.
Except as modified by this DPA, the Terms of Service shall remain in full force and effect.
In this DPA, unless the context otherwise requires, the following words shall have the meanings set forth below.
“CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (the “CPRA”), and any regulations promulgated thereunder, in each case, as amended from time to time.
“Client Personal Data” means Personal Data in any form made Processed by MadTech in connection with and in the provision of the Services to Client.
“Data Protection Laws” means, the laws and regulations, including any amendment, supplement, update, modification to or re-enactment of such laws and regulations, of any relevant jurisdiction applicable to the Processing of Personal Data in connection with the Services, including, as relevant: (i) US Privacy Laws; (ii) the EU General Data Protection Regulation (“EU GDPR”) and the UK General Data Protection Regulation pursuant to the UK Data Protection Act 2018 (“UK GDPR” and together, “GDPR”); (iii) Switzerland’s Federal Act on Data Protection of 19 June 1992 as revised 25 September 2020 (“FADP”); (iv) the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and any related provincial privacy laws in Canada; and (v) all other data privacy and/or security legislation applicable to those jurisdictions whose residents have Client Personal Data that is Processed by MadTech. .
“Data Subject” shall mean a natural person whose personal information/data is Processed.
“Data Subject Request” means an allegation, request or complaint received directly from Data Subjects relating to MadTech’s Processing of Client Personal Data, including any request to exercise such individual’s rights under Data Protection Laws (e.g., to access, correct, delete, opt-out of the sale of Personal Data).
"EEA” means the European Economic Area;
“Information Security Incident” means any actual or reasonably suspected accidental, unauthorized or unlawful destruction, encryption, loss, use, alteration, unavailability, disclosure of, or access to, or any other misuse of, Client Personal Data while in MadTech’s possession or under MadTech’s control.
“Personal Data” means information that (i) relates to an identified or identifiable natural person or (ii) constitutes Personal Data, Personal Information, or any other analogous term under Data Protection Laws.
“Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. “Process“, “Processes” and “Processed” will be interpreted accordingly.
"Restricted Transfer” means a Transfer to another country, territory, sector or international organization which the European Commission has not recognized via an adequacy decision as providing an equivalent level of protection for Personal Data, necessitating the need for contractual clauses ensuring appropriate data protection safeguards (e.g., SCCs).
"SCCs” means (i) the standard contractual clauses set out in Commission Implementing Decision (EU) 2021/914 for the transfer of Personal Data to third countries pursuant to the GDPR as updated, amended, replaced and superseded from time to time ("EU SCCs"); and where applicable (ii) the United Kingdom’s International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A(1) Data Protection Act 2018 as updated, amended, replaced and superseded from time to time (the “UK Addendum”).
“Security Measures” has the meaning given in Section 6.
"Services” means any services provided by MadTech to Client under the Terms of Service.
“Subprocessors” means vendors or other third parties that MadTech engages to Process Client Personal Data relating to the Services.
“US Privacy Laws” means any all federal, state and local data protection and privacy laws, rules and regulations applicable in the United States, including, where and to the extent applicable, federal privacy laws and regulations, state data protection laws and regulations, state security breach notification laws and guidance promulgated by the Federal Trade Commission pursuant to Section 5 of the Federal Trade Commission Act.
The terms “Controller,” “Personal Data Breach,” “Processor,” “Sale,” “Sell,” “Selling,” “Share,” “Sharing,” “Special Categories of Personal Data,” “Supervisory Authority” and “Transfer” (or their corresponding terms in individual Data Protection Laws) have the meanings given to those terms under their relevant Data Protection Laws, as applicable.
The headings in this DPA are inserted for convenience and do not affect the construction of this DPA.
Any words following the terms including, include, in particular or for example or any similar phrase shall be construed as illustrative and shall not limit the generality of the related general words.
References to the word: (i) “ensure” and its derivatives means to use commercially reasonable efforts to pursue the stated aim and under no circumstances implies or constitutes any guaranty of results or outcomes or any express or implied legal covenant, warranty or representation; (ii) ”best efforts”, “commercially reasonable efforts” or “reasonable efforts” means acting with diligence and good faith in the performance of the obligation; and (iii) “immediately” means promptly and without undue delay.
This DPA shall come into full force and effect on the Effective Date (as defined in the Terms of Service), and remain in effect so long as, MadTech retains any Client Personal Data in its possession or control (“Term”).
For purposes of this DPA, Client is the Controller of the Client Personal Data.
Client will not make accessible, communicate, transfer or transmit to MadTech, or instruct MadTech to Process, any Personal Data that MadTech should not receive in connection with the delivery of the Services or for which Client has not obtained all consents and other legal authorizations necessary to permit MadTech access to such Personal Data.
Client shall at all times during this DPA comply with Client’s obligations under the Data Protection Laws. In the event Client makes a determination that it is no longer able to meet its obligations under the Data Protection Laws, Client shall notify MadTech in writing within five (5) business days of such determination, and MadTech may suspend or terminate this DPA and the Terms of Service upon written notice to Client, unless and until Client first notifies MadTech that it able to resume meeting Client’s obligations under such Data Protection Laws.
For purposes of this DPA, MadTech is a Processor of Client Personal Data.
With respect to the CCPA and Client Personal Data, MadTech will act as a “service provider” and Client will act as a “business”, as each of those terms are defined under Cal. Civ. Code § 1798.140.
Client hereby instructs and authorizes MadTech to receive and Process Client Personal Data on its behalf in the capacity of a Processor and/or Service Provider (as applicable) for the purpose of providing the Services (including to build, enhance or improve the quality of MadTech’s services).
MadTech acknowledges and agrees that it will in all material respects comply with its obligations under Data Protection Laws and will only Process Client Personal Data, which is described in Annex I.B to the SCCs, in order to provide the Services and perform its obligations under this DPA. In the event MadTech makes a determination that it is no longer able to meet its obligations under the Data Protection Laws, MadTech shall notify Client in writing within five (5) business days of such determination, and Client may terminate this DPA and the Terms of Service upon written notice to MadTech, unless and until MadTech first notifies Client that MadTech is able to resume meeting MadTech’s obligations under the Data Protection Laws.
MadTech shall:
Process Client Personal Data only as and to the extent necessary for MadTech to perform its obligations under this DPA and the Terms of Service, in accordance with Client’s instructions (which may be specific instructions or instructions of a general nature as set out in this DPA or the Terms of Service or as otherwise notified by Client to MadTech from time to time), in compliance with MadTech’s obligations under the Data Protection Laws;
provide training to its personnel with respect to Data Protection Laws;
not transfer Client Personal Data to a third country or any party located outside the EEA without the prior consent of Client, unless required or permitted to do so by applicable European Union law; provided however that MadTech may transfer Client Personal Data to any of its Subprocessors located outside the EEA where (i) such Subprocessor is located in a third country in respect of which the European Commission has issued a finding of adequacy with regard to data protection; or (ii) there are appropriate safeguards (at least as protective as the Security Measures) in place in accordance with Article 46 of the GDPR between MadTech and the Subprocessor and at least the same level of privacy protection is provided as required under Annex II attached hereto and Client and MadTech hereby enter into the SCCs in the case of such a transfer;
only use, reproduce or otherwise Process any Client Personal Data collected in connection with providing the Services to (i) the extent necessary to provide the Services, (ii) the extent permitted by Data Protection Laws and (iii) build, enhance or improve the quality of MadTech’s services; the Parties agree that the disclosure, dissemination, transfer, use, reproduction or other Processing of any Client Personal Data under this DPA is not a “Selling” or “Sharing” of Personal Data under US Privacy Laws or any other Data Protection Laws;
not modify, amend, or alter the contents of Client Personal Data, except as directed by Client (explicitly or as directed by the Terms of Service) or expressly permitted by Data Protection Laws (e.g., MadTech will not combine or update Client Personal Data received from, or on behalf of, Client with Personal Data that it received from another source unless and to the extent permitted by Data Protection Laws); and
upon notice, permit Client to take such steps as may be reasonable (i) to stop and remediate any unauthorized use of Client Personal Data, and (ii) to help ensure that MadTech uses Client Personal Data in a manner consistent with Client’s obligations under Data Protection Laws.
MadTech may disclose Client Personal Data to its personnel who (i) need to know for the purpose of providing the Services and (ii) have committed themselves to confidentiality or are subject to a signed agreement which imposes obligations of confidentiality no less strict than as described in this DPA.
If MadTech or its respective personnel are required by law and / or an order of any court of competent jurisdiction or any applicable regulatory, judicial or governmental body to disclose Client Personal Data, MadTech shall, to the extent practicable and except where prohibited by law, first:
give Client notice of the details of the proposed disclosure;
give Client a reasonable opportunity to take any steps it considers necessary to protect the confidentiality of Client Personal Data including seeking such judicial redress as Client may reasonably see fit in the circumstances; and
inform the proposed recipient that the information is confidential Client Personal Data.
MadTech will implement and maintain the reasonable technical, administrative and physical measures set forth in Annex II (the “Security Measures”) to protect Client Personal Data against Information Security Incidents. Such Security Measures shall be designed in a manner intended to provide a level of security reasonable and appropriate to the risks presented by the Processing and the nature of Client Personal Data to be protected having regard to the state of the art and the cost of their implementation.
Notice of Information Security Incident. If MadTech becomes aware of any Information Security Incident, MadTech shall (a) notify Client of the Information Security Incident without undue delay and in no event later than two (2) business days after becoming aware of the Information Security Incident and (b) take commercially reasonable steps to identify the cause of such Information Security Incident, minimize harm and reduce the likelihood of a recurrence. Notifications made pursuant to this Section 7.1 shall include, to the extent possible, a description of the Information Security Incident, including the suspected cause, the nature of the information affected and the number and categories of individuals affected.
Cooperation with Client. MadTech will cooperate with Client and take such commercially reasonable steps as may be reasonably directed by Client to assist in the investigation of any such Information Security Incident, including providing Client with facts about the Information Security Incident reasonably necessary to support Client’s own assessment of the associated risk to Client Personal Data. Client shall reimburse MadTech for all such efforts, unless and to the extent the applicable Information Security Incident was caused by MadTech’s breach of its obligations under this DPA.
Notice to Client. If either Party receives any Data Subject Request, such Party shall notify the other Party in writing of such request or complaint promptly and in no event later than five (5) calendar days after such Party’s receipt thereof, providing full details of the request or complaint sufficient to enable the other Party to respond. MadTech shall not take any action in response to such Data Subject Request except in accordance with Client’s written instructions unless otherwise required by Data Protection Laws.
Data Subject Request Assistance. Each Party shall provide the other Party with such assistance as a Party may reasonably request to timely respond to Data Subject Requests within any deadlines imposed by Data Protection Laws.
Co-operation with Supervisory Authority Requests. Each Party shall co-operate with the other Party to the extent necessary to enable such other Party to comply with any requests of any relevant Supervisory Authority or any other competent supervisory or other regulatory authority in respect of Client Personal Data Processed by MadTech under this DPA. In particular, each Party shall:
promptly inform the other Party upon becoming aware if, in its opinion, an instruction given, or request made by such other Party infringes Data Protection Laws;
provide such reasonable co-operation and assistance as the other Party may require to enable such other Party to comply with its obligations under Data Protection Laws; and
notify the other Party as soon as reasonably practicable if it makes a determination that it can no longer meet its obligations under the Data Protection Laws.
Scope. MadTech shall make available to Client the information reasonably necessary for Client to demonstrate compliance with its obligations under Data Protection Laws. Client (or an auditor appointed by Client that enters into a confidentiality agreement with MadTech, in form and substance satisfactory to MadTech) may but is not obligated to audit (including through inspections, manual reviews, and automated scans and other technical and operational testing) MadTech’s compliance with its obligations under this DPA and applicable Data Protection Laws, up to once per year and more often if required by Data Protection Laws or by a governmental authority, and MadTech will reasonably cooperate with such audits. Such audits may require MadTech to complete questionnaires and/or make available relevant documents and records for review and relevant MadTech personnel for interviews. Any audit by or on behalf of Client must be conducted during MadTech’s regular business hours, and may not unreasonably interfere with or disrupt MadTech’s business or operations.
Audit Reports. If the controls or measures to be assessed in the requested audit are addressed in an SOC 2 Type 2, ISO, or NIST audit report performed by a qualified and independent third party auditor within the 12 months preceding Client’s audit request and MadTech has certified in writing that there are no known material changes in the controls audited, Client shall accept such report in lieu of performing an audit of such controls or measures, unless otherwise expressly required by Data Protection Laws or a governmental authority. MadTech will provide Client with a copy of any such audit report obtained by MadTech, upon Client’s request.
Consent to Subprocessor Engagement. MadTech shall have the right at its discretion to appoint one or more Subprocessors. Without limiting the generality of the foregoing, Client acknowledges and consents to MadTech’s engagement of the Subprocessors (together with their locations), if any, listed in the space below:
Amazon Web Services, Inc. 410 Terry Avenue North, Seattle, WA 98109-5210, U.S.A.
Aqfer, Inc. 9100 Conroy Windermere Rd., Suite 200, Windermere, FL 34786
Subprocessor Requirements. MadTech shall enter into a written contract with each Subprocessor containing privacy, confidentiality and data security obligations with respect to Client Personal Data at least equivalent in substance to the terms which MadTech is bound relating to this DPA. MadTech will remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of a Subprocessor that cause MadTech to breach any of MadTech’s obligations under this DPA.
Subprocessor Changes. MadTech may engage additional Subprocessors not listed in Section10.1, provided that MadTech shall notify Client of each such engagement (including the name and location of the relevant Subprocessor and the activities it will perform).
With respect to Restricted Transfers the SCCs are hereby incorporated into this DPA by reference and will come into effect upon commencement of any such Restricted Transfer.
Where a Restricted Transfer is subject to the GDPR the following terms shall apply:
Annex IA of the EU SCCs attached hereto will be populated with the details of the Parties, Annex IB of the EU SCCs attached hereto will be populated with the description of the Processing of Personal Data;
For the purposes of Modules 1, 2 and 3 of the EU SCCs: clause 7 and the optional language in clause 11(a) shall not apply;
For the purposes of clause 9, the Parties select Option 2 (General authorization);
The technical and organizational security measures set out in Annex II of the EU SCCs attached hereto shall apply;
The supervisory authority for the purposes of Clause 13(a) shall be determined by the place of establishment of the data exporter; the governing law and choice of forum and jurisdiction stipulated in this DPA shall apply to the extent that it is the law and the courts of an EU member state otherwise it shall be those of the Republic of Ireland; and
The frequency of the transfer shall be continuous, as necessary to deliver the Services, and retention shall be determined by Client, except where Client is required by applicable laws to retain Personal Data in accordance with Client’s corporate record retention schedules and policies.
Where a Restricted Transfer is subject to both EU GDPR and UK GDPR the following terms with respect to the UK Addendum shall, in addition to Clause 11.1 above, also apply:
The EU SCCs shall be read in accordance with, and deemed amended by, the provisions of Part 2 (Mandatory Clauses) of the UK Addendum;
At Clause 2(h) of the EU SCCs, the Parties select option (iii);
The data subjects, categories of Personal Data and the purposes of the transfer are as specified in the EU SCCs, and the recipients are the recipients to whom it is necessary to disclose data to achieve the purposes;
The contact points for data protection enquiries are the usual business contacts for each Party; and
The Parties confirm that the information required for the purposes of Part 1 (Tables) of the UK Addendum is set out in DPA Exhibit 2.
With respect to Restricted Transfers from Switzerland, the EU SCCs, Section 11.1 and the following additional terms shall apply:
For purposes of the EU SCCs, the terms “General Data Protection Regulation” or “Regulation (EU) 2016/679” as utilized in the EU SCCs shall be interpreted to include the FADP;
Clause 13 of the EU SCCs is modified to provide that the Federal Data Protection and Information Commissioner of Switzerland shall have authority over data transfers governed by the FADP and the appropriate EU supervisory authority shall have authority over data transfers governed by the GDPR (subject to the foregoing, all other requirements of Clause 13 shall be observed);
The term “EU Member State” as utilized in the EU SCCs shall not be interpreted in such a way as to exclude Data Subjects in Switzerland from exercising their rights in their place of habitual residence in accordance with Clause 18(c) of the EU SCCs; and;
The law that applies will be the laws of Switzerland.
For the avoidance of doubt (and without prejudice to third party rights for data subjects under the SCCs) the Parties hereby submit to the limitations stipulated in this DPA with respect to their respective liability towards one another under the SCCs and FADP.
To the extent that there is any conflict or inconsistency between the terms of the SCCs or FADP and the terms of this DPA, the terms of the SCCs or FADP shall take precedence.
If, and to the extent that, the European Commission, the United Kingdom or Switzerland issues any amendment to, or replacement of, the EU SCCs, the UK Addendum or the FADP (as applicable), the Parties agree in good faith to take such additional steps as necessary to provide that such replacement terms are implemented across all transfers.
If, at any time, a supervisory authority or a court with competent jurisdiction over a Party mandates that transfers from controllers in the EEA, the United Kingdom or Switzerland to controllers or Processors established outside the EEA, the United Kingdom or Switzerland must be subject to specific additional safeguards (including specific technical and organizational measures), the Parties shall work together in good faith to implement such safeguards and provide that any transfer of Personal Data is conducted with the benefit of such additional safeguards.
Notwithstanding anything to the contrary in this DPA and/or the Terms of Service, MadTech’s total, cumulative liability under this DPA for all causes of action (whether in contract, tort, strict liability or otherwise) shall be limited to an amount equal to the fees (excluding taxes and reimbursable expenses) actually paid by Client to MadTech for the Services during the twelve (12) months preceding the occurrence giving rise to the applicable claim.
Notwithstanding anything to the contrary in this DPA and/or the Terms of Service, in no event shall MadTech be liable under this DPA for any indirect, incidental, consequential, reliance or punitive damages or lost or imputed profits, lost data, unrealized savings, lost revenue, diminished share price, loss of good will, reputational harm, shareholder derivative suits or other business losses of any kind, in each case regardless of whether MadTech was advised of the possibility of such losses or damages or such losses or damages were otherwise foreseeable, and notwithstanding the failure of any agreed or other remedy of its essential purpose.
Termination. If either Party fails to perform any of its material obligations under this DPA and does not cure such failure within thirty (30) days of receipt of a notice of default from the other Party, then the other Party may, by giving notice to the defaulting Party terminate this DPA as of the date specified in such notice of termination.
Return or Destruction of Personal Data. MadTech, upon Client’s reasonable request upon termination of the Services shall:
cease Processing any Client Personal Data relating to the Services; and
delete or cause the deletion of all Client Personal Data in MadTech’s care, custody or control as soon as reasonably practicable, except to the extent applicable Data Protection Laws permit the retention or storage of the applicable Client Personal Data. Notwithstanding the foregoing, MadTech may retain Client Personal Data in backups of its information technology devices and systems made in the ordinary course of business; provided that it may not seek to access such information except to the extent permitted by law, requested by Client or as part of a system restoration.
Survival. Subsection 13.3 and Sections 1, 2, and 11-14 shall survive the termination of this DPA for any reason.
Entire Agreement. This DPA and the Terms of Service constitute the entire agreement between the Parties relating to the Processing of Client Personal Data and supersede any previous agreements arrangements or understandings between them relating to their subject matter. In the event of any inconsistency or ambiguity between the terms of this DPA and the terms of the Terms of Service or any other agreement between the Parties in relation to the Processing of Client Personal Data, the terms of this DPA shall prevail.
Changes to this DPA. We reserve the right to update this DPA from time to time in order to reflect, changes to our practices or for other operational, legal, or regulatory reasons. When we do update this DPA, we will post the updates and changes on our website. We may elect to notify you of material changes by mail, email, posting of modified DPA, or some other similar manner. However, it is your responsibility to check our website regularly for changes to this DPA. Your continued use of or access to the Services following the posting of any changes to this DPA constitutes acceptance of those changes.
Waiver. No failure or delay by a Party to exercise any right or remedy provided under this DPA or any Data Protection Law shall constitute a waiver of that or any other right or remedy, nor shall it prevent or restrict the further exercise of that or any other right or remedy. No single or partial exercise of such right or remedy shall prevent or restrict the further exercise of that or any other right or remedy.
Invalidity and Severability. Each and every obligation under this DPA shall be treated as a separate obligation and shall be severally enforceable as such, and in the event of any obligation or obligations being found by any authority of competent jurisdiction to be invalid or unenforceable, such invalidity or unenforceability shall not affect the other provisions or parts of such provisions of this DPA, all of which shall remain in full force and effect.
Governing Law / Jurisdiction. Except to the limited extent otherwise provided in Article 11 above, this DPA shall in all respects be governed by and construed in accordance with the laws of the State of Connecticut, without regard to its conflicts of laws principles, and the Parties irrevocably agree that the state courts of Connecticut or the United States District Court of the District of Connecticut (and appellate courts therefrom) shall have exclusive jurisdiction to settle any dispute or claim that arises out of or in connection with this DPA or its subject matter or formation (including non-contractual disputes or claims).
1. Data exporter(s):
Name: Client, to the extent deemed a Controller under this DPA.
Address: Client’s address set forth in the Order between the Parties.
Contact person’s name, position and contact details: Client’s contact details as set forth in the Order between the Parties.
Activities relevant to the data transferred under these Clauses: The Processing of Personal Data in connection with MadTech’s provision of Services to Client pursuant to the Terms of Service.
Role (controller/Processor): Controller
2. Data importer(s):
Name: MadTech, LLC (d/b/a MadConnect)
Address: 108 W. 39th Street, Suite 1016, New York, NY 10018
Contact person’s name, position and contact details:
Nicole Evans
VP of Operations
nicole@madconnect.ai
(908) 656-5450
Activities relevant to the data transferred under these Clauses: The Processing of Personal Data in connection with MadTech’s provision of Services to Client pursuant to the Terms of Service.
Role (controller/Processor): Processor
Categories of Data Subjects:
Client application users
Categories of Personal Data Transferred:
Personal contact details (first name, last name, address, phone number, email address, birthday, social media handles)
Demographic data (age, gender, geography, household income, ethnicity, interests)
Transactional data (sales / purchase history, user account and customer service data, order data, return data)
Behavioral data (product usage and engagement data, marketing campaign engagement data)
Third-party data (data generated by, and ingested from third-party datasets, advertising technology, and marketing technology providers)
Other data categories as included from time-to-time
Sensitive Categories of Data, and associated additional restrictions/safeguards: Not applicable.
Frequency of the Transfer: Continuous basis.
Nature and purpose of the Processing: Provide the Services, as more particularly described in the Terms of Service, and comply with Client instructions thereunder.
Duration of Processing / Retention Period: Different data retention periods apply depending on the applicable Services. When determining the specific retention period, MadTech considers various factors, such as the type of service provided to Client, the nature and length of our relationship with Client, and mandatory retention periods provided by law and the statute of limitations.
For Transfers to Subprocessors, the Subject Matter, Nature and Duration of the Processing: Same as per the above for MadTech.
The competent supervisory authority as determined by the place of establishment of Client.
Security Measures, Including Technical and Organisational Measures To Protect the Security of Personal Data
Written Information Security Program. Develop, implement, maintain, monitor, upgrade and comply with administrative, technical and physical safeguards, including, without limitation, written information security policies and procedures, designed to protect the confidentiality, availability and integrity of Personal Data and any systems that store or otherwise process it, which are: (a) aligned with an industry-standard control framework (e.g., NIST SP 800-53, ISO 27001, SOC 2 Type 2, CIS Critical Security Controls); (b) consistent with the safeguards for protection of Personal Data and information of a similar character set forth in any state, federal or foreign regulations by which MadTech is bound; (c) approved by executive management; (d) reviewed and updated at least annually or whenever there is a material change in business practices that may reasonably implicate the security or integrity of Personal Data; and (e) communicated to all personnel with access to Personal Data. Assign to an individual or a group of individuals the responsibility for developing, implementing, and managing the organization’s written information security program.
Risk Assessment. Maintain risk assessment procedures for the purposes of periodic review, identification and assessment of internal and external risks to the organization and the security, confidentiality, integrity and availability of Personal Data, monitoring and maintaining compliance with the organization’s policies and procedures, and reporting the condition of the organization’s information security and compliance to MadTech’s internal executive management and board of directors or similar body.
Personnel Training. Train personnel on an ongoing basis on the importance of information security, the proper use of computer security and on maintaining the confidentiality, integrity, availability and security of Personal Data and comply with MadTech’s policies and procedures, consistent with the terms of the Terms of Service and Data Protection Laws.
Disciplinary Measures. Impose disciplinary measures on personnel for violations of MadTech’s policies and procedures and information security program.
Subcontractor Management. Conduct reasonable due diligence and monitoring to ensure subcontractors and Subprocessors are capable of maintaining the privacy, confidentiality, security, integrity and availability of Personal Data consistent with this DPA.
Access Controls. Maintain logical access controls designed to limit access to Personal Data and relevant information systems only to authorized personnel and third parties (e.g. granting access on a need-to-know basis, use of unique IDs and passwords (which are not vendor-supplied default passwords) for all users, periodic review and revoking/changing access when personnel are terminated or changes in job functions occur), and storing physical records containing Personal Data in locked facilities, storage areas or containers.
Secure User Authentication. Maintain password controls designed to manage and control password strength, expiration and usage including prohibiting users from sharing passwords and requiring that passwords controlling access to Personal Data must: (a) be at least eight (8) characters in length and meet minimum complexity requirements; (b) not be stored in readable format on the organization’s computer systems; (c) be changed at least every ninety (90) days; (d) have a history threshold to prevent reuse of recent passwords; (e) if newly issued, be changed after first use; and (f) blocking access to user accounts after multiple unsuccessful attempts to gain access.
Multi-factor Authentication and VPNs. Use multi-factor authentication to authenticate access Personal Data by MadTech personnel, and permit remote-access to Personal Data only through a MadTech-controlled virtual private network (VPN).
Incident Detection and Response. Maintain policies and procedures to detect, prevent and respond to actual or reasonably suspected Information Security Incidents, encourage the reporting of such incidents, and document responsive actions taken in connection with any such incidents (including mandatory post-incident review of events and actions taken, if any, to make changes in business practices relating to the protection of Personal Data).
Encryption. Apply industry standard encryption to Personal Data: (a) stored on any medium (i.e., laptops, mobile devices, portable storage devices, file servers and application databases); and (b) transmitted across any public network (such as the Internet) or wirelessly.
Network Security. Implement network security controls such as up-to-date firewalls, endpoint protection and anti-malware software with up-to-date virus definitions, operating system patches, layered DMZs, updated intrusion detection/prevention systems and other traffic and event correlation procedures designed to protect systems from intrusion and limit the scope of any successful attack.
Vulnerability Management. Implement vulnerability management, threat protection technologies and scheduled monitoring procedures to detect, assess, mitigate, remove and protect against unauthorized use and new and existing security vulnerabilities and threats, including viruses, bots and other malicious code.
Change Control. Follow change management procedures and implement tracking mechanisms designed to test, approve and monitor all changes to MadTech’s technology and information assets.
Physical Security. Physical and environmental security of data center, server room facilities and other areas containing Personal Data designed to: (a) protect information assets from unauthorized physical access; (b) manage, monitor and log movement of persons into and out of MadTech facilities; and (c) guard against environmental hazards such as heat, fire and water damage.
Business Continuity and Disaster Recovery. Maintain business continuity and disaster recovery policies and procedures designed to maintain service and recover from foreseeable emergency situations or disasters.
This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.
The Table 1 information below shall reflect the information set forth in DPA Exhibit 1, Annex I set forth above.
| Start date | ||
|---|---|---|
| The Parties | Exporter (who sends the Restricted Transfer) | Importer (who receives the Restricted Transfer) |
| Parties’ details | Full legal name: As set forth in Exhibit 1, Annex IA Trading name (if different): Main address (if a company registered address): As set forth in Exhibit 1, Annex IA Official registration number (if any) (company number or similar identifier): |
Full legal name: MadTech, LLC Trading name (if different): MadConnect Main address (if a company registered address): 108 W. 39th Street, Suite 1016, New York, NY 10018 Official registration number (if any) (company number or similar identifier): |
| Key Contact | Full Name (optional): As set forth in Exhibit 1, Annex IA Job Title: As set forth in Exhibit 1, Annex IA Contact details including email: As set forth in Exhibit 1, Annex IA |
Full Name (optional): Nicole Evans Job Title: VP of Operations Contact details including email: nicole@madconnect.ai, (908) 656-5450 |
| Signature (if required for the purposes of Section 2) | ||
| Addendum EU SCCs | ✓The version of the Approved EU SCCs which this Addendum is appended to, detailed below, including the Appendix Information: Date: Reference (if any): Other identifier (if any): Or the Approved EU SCCs, including the Appendix Information and with only the following modules, clauses or optional provisions of the Approved EU SCCs brought into effect for the purposes of this Addendum: | |||||
|---|---|---|---|---|---|---|
| Module | Module in operation | Clause 7 (Docking Clause) | Clause 11 (Option) | Clause 9a (Prior Authorisation or General Authorisation) | Clause 9a (Time period) | Is personal data received from the Importer combined with personal data collected by the Exporter? |
| 1 | ||||||
| 2 | X | N/A | N/A | General Authorisation | N/A | |
| 3 | ||||||
| 4 | ||||||
“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:
| Annex 1A: List of Parties |
| Annex 1B: Description of Transfer |
| Annex II: Security measures, including technical and organisational measures to provide security of the data |
| Annex III: List of Sub Processors |
| Ending this Addendum when the Approved Addendum changes | Which Parties may end this Addendum as set out in Section 19 of the Approved Addendum: ✓Importer ✓Exporter neither Party |
|---|
Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.
Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.
Where this Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:
| Addendum | This International Data Transfer Addendum which is made up of this Addendum incorporating the Addendum EU SCCs. |
| Addendum EU SCCs | The version(s) of the Approved EU SCCs which this Addendum is appended to, as set out in Table 2, including the Appendix Information. |
| Appendix Information | As set out in Table 3. |
| Appropriate Safeguards | The standard of protection over the personal data and of data subjects’ rights, which is required by UK Data Protection Laws when you are making a Restricted Transfer relying on standard data protection clauses under Article 46(2)(d) UK GDPR. |
| Approved Addendum | The template Addendum issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18. |
| Approved EU SCCs | The Standard Contractual Clauses set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021. |
| ICO | The Information Commissioner. |
| Restricted Transfer | A transfer which is covered by Chapter V of the UK GDPR. |
| UK | The United Kingdom of Great Britain and Northern Ireland. |
| UK Data Protection Laws | All laws relating to data protection, the Processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018. |
| UK GDPR | As defined in section 3 of the Data Protection Act 2018. |
This Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties’ obligation to provide the Appropriate Safeguards.
If the provisions included in the Addendum EU SCCs amend the Approved SCCs in any way which is not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not be incorporated in this Addendum and the equivalent provision of the Approved EU SCCs will take their place.
If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data Protection Laws applies.
If the meaning of this Addendum is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies.
Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Addendum has been entered into.
Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the Parties, the Parties agree that, for Restricted Transfers, the hierarchy in Section 1 will prevail.
Where there is any inconsistency or conflict between the Approved Addendum and the Addendum EU SCCs (as applicable), the Approved Addendum overrides the Addendum EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the Addendum EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved Addendum.
Where this Addendum incorporates Addendum EU SCCs which have been entered into to protect transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties acknowledge that nothing in this Addendum impacts those Addendum EU SCCs.
This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so that:
together they operate for data transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s Processing when making that data transfer, and they provide Appropriate Safeguards for those data transfers;
Sections 9 to 11 override Clause 5 (Hierarchy) of the Addendum EU SCCs; and
this Addendum (including the Addendum EU SCCs incorporated into it) is (1) governed by the laws of England and Wales and (2) any dispute arising from it is resolved by the courts of England and Wales, in each case unless the laws and/or courts of Scotland or Northern Ireland have been expressly selected by the Parties.
Unless the Parties have agreed alternative amendments which meet the requirements of Section 12, the provisions of Section 15 will apply.
No amendments to the Approved EU SCCs other than to meet the requirements of Section 12 may be made.
The following amendments to the Addendum EU SCCs (for the purpose of Section 12) are made:
References to the “Clauses” means this Addendum, incorporating the Addendum EU SCCs;
In Clause 2, delete the words:
“and, with respect to data transfers from controllers to Processors and/or Processors to Processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679”;
Clause 6 (Description of the transfer(s)) is replaced with:
“The details of the transfers(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply to the data exporter’s Processing when making that transfer.”;
Clause 8.7(i) of Module 1 is replaced with:
“it is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer”;
Clause 8.8(i) of Modules 2 and 3 is replaced with:
“the onward transfer is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer;”
References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the Processing of personal data and on the free movement of such data (General Data Protection Regulation)” and “that Regulation” are all replaced by “UK Data Protection Laws”. References to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK Data Protection Laws;
References to Regulation (EU) 2018/1725 are removed;
References to the “European Union”, “Union”, “EU”, “EU Member State”, “Member State” and “EU or Member State” are all replaced with the “UK”;
The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one, is replaced with “Clause 11(c)(i)”;
Clause 13(a) and Part C of Annex I are not used;
The “competent supervisory authority” and “supervisory authority” are both replaced with the “Information Commissioner”;
In Clause 16(e), subsection (i) is replaced with:
“the Secretary of State makes regulations pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data to which these clauses apply;”;
Clause 17 is replaced with:
“These Clauses are governed by the laws of England and Wales.”;
Clause 18 is replaced with:
“Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”; and
The footnotes to the Approved EU SCCs do not form part of the Addendum, except for footnotes 8, 9, 10 and 11.
Amendments to this Addendum
The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.
If the Parties wish to change the format of the information included in Part 1: Tables of the Approved Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.
From time to time, the ICO may issue a revised Approved Addendum which:
makes reasonable and proportionate changes to the Approved Addendum, including correcting errors in the Approved Addendum; and/or
reflects changes to UK Data Protection Laws;
The revised Approved Addendum will specify the start date from which the changes to the Approved Addendum are effective and whether the Parties need to review this Addendum including the Appendix Information. This Addendum is automatically amended as set out in the revised Approved Addendum from the start date specified.
If the ICO issues a revised Approved Addendum under Section 18, if any Party selected in Table 4 “Ending the Addendum when the Approved Addendum changes”, will as a direct result of the changes in the Approved Addendum have a substantial, disproportionate and demonstrable increase in:
its direct costs of performing its obligations under the Addendum; and/or
its risk under the Addendum,
and in either case it has first taken reasonable steps to reduce those costs or risks so that it is not substantial and disproportionate, then that Party may end this Addendum at the end of a reasonable notice period, by providing written notice for that period to the other Party before the start date of the revised Approved Addendum.
The Parties do not need the consent of any third party to make changes to this Addendum, but any changes must be made in accordance with its terms.
| Mandatory Clauses | Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses. |
