Data Protection Addendum

Effective as of June 15th, 2020

This Data Protection Addendum is referred to and forms an integral part of, the Hownd Terms of Service and any applicable addendum(s) (“Agreement”). It is effective upon acceptance of the Terms of Service.

Where personal data processed under the Agreement is subject to Applicable Data Protection Law, Customers may enter into this Data Protection Addendum (which incorporates the European Commission’s Standard Contractual Clauses): (i) to protect the personal data in accordance with the requirements of Applicable Data Protection Law; and (ii) to provide appropriate safeguards with respect to personal data which may be processed outside of the European Territories.

This Data Protection Addendum reflects the Parties’ agreement with respect to the terms governing the processing of personal data under the Agreement.

1. DEFINITIONS

1. “controller”, “processor”, “data subject”, “personal data”, “processing” (and “process”) and “special categories of personal data” shall have the meanings given in Applicable Data Protection Law; and
2. “Applicable Data Protection Law” shall mean (i) the EU General Data Protection Regulation (Regulation 2016/679); (ii) the EU e-Privacy Directive (Directive 2002/58/EC); (iii) any national legislation made under or pursuant to any of (i) or(ii) and (iv) any law that amends or supersedes (i), (ii) or (iii).
3. Any other capitalized terms not defined in this Data Protection Addendum shall have the meaning given to them in the Agreement.

2. RELATIONSHIP OF THE PARTIES

2.1 The Customer appoints Hownd, Inc. (“Hownd”) to process the Customer CRM Data for the purposes and term described the Agreement (as more particularly described in Annex A) and as otherwise agreed in writing by the parties (the “Permitted Purpose“).

2.2 The Customer shall be the controller and Hownd shall be the processor of Customer CRM Data processed for the Permitted Purpose.

2.3 Each Party shall comply with the obligations that apply to it under Applicable Data Protection Law. If Customer becomes aware that processing for the Permitted Purpose infringes Applicable Data Protection Law, it shall promptly inform Hownd.

3. PROHIBITED DATA

Customer shall not disclose (and shall not permit any data subject to disclose) any special categories of personal data to Hownd for processing.

4. INTERNATIONAL TRANSFERS

4.1. Processing in the United States. Customer acknowledges that, as of the Effective Date of this Addendum, Hownd’s primary processing facilities are in the United States of America.

4.2. Cross Border Data Transfer Mechanisms for Data Transfers. To the extent that Customer’s use of the Hownd Services requires transfer of personal data out of the European Economic Area (“EEA”) or Switzerland then Hownd will take such measures as are necessary to ensure the transfer is in compliance with Applicable Data Protection Law.

5. STANDARD CONTRACTUAL CLAUSES

To ensure that appropriate safeguards are afforded to personal data transferred by the Customer to Hownd, the parties hereby incorporate the Standard Contractual Clauses for data controller to data processor transfers approved by the European Commission in decision 2010/87/EU in their entirety, subject to the following requirements: (a) Appendices 1 and 2 of the Standard Contractual Clauses shall be as set out at Annex A to this Data Protection Addendum; (b) Hownd shall be deemed to comply in full with the subprocessing requirements of Section 11 of the Standard Contractual Clauses if it complies with the requirements of Section 8 of this Data Protection Addendum; and (c) Hownd shall be deemed to comply in full with the rights of audit Customer may have under Sections 5(f) and 12(2) of the Standard Contractual Clauses if it complies with the requirements of Section 13 of this Data Protection Addendum.

6. CONFIDENTIALITY OF PROCESSING

Hownd shall ensure that any person it authorises to process the Customer CRM Data shall protect the Customer CRM Data in accordance with the Customer’s confidentiality obligations under this addendum and the Agreement.

7. SECURITY

Hownd shall implement technical and organisational measures set out in Annex B to protect the Customer CRM Data (i) from accidental or unlawful destruction, and (ii) loss, alteration, unauthorised disclosure of, or access to the Customer CRM Data (a “Security Incident”).

8. SUB-PROCESSORS

Customer consents to Hownd engaging third party sub-processors to process the Customer CRM Data for the Permitted Purpose provided that: (i) Hownd maintains an up-to-date list of its sub-processors at www.Hownd.com/sub-processors (“Sub-Processor Page”), which it shall update with details of any proposed change a reasonable time in advance of appointing or replacing a subprocessor; (ii) Hownd imposes data protection terms on any sub-processor it appoints that require it to protect the Customer CRM Data to the standard required by Applicable Data Protection Law and this Data Protection Addendum; and (iii) Hownd remains liable for any breach of this Data Protection Addendum that is caused by an act, error or omission of its sub-processor. A current list of sub-processors is available at the Sub-Processor Page. To receive notifications of changes in sub-processors, Customers must subscribe to this Sub-Processor Page. Customer may object to Hownd’s appointment or replacement of a subprocessor prior to its appointment or replacement, provided such objection is based on reasonable grounds relating to data protection. Such objection must be made by notifying Hownd promptly in writing within ten (10) business days after receipt of Hownd’s notice via the Sub-Processor Page. In such event, Hownd will either not appoint or replace the subprocessor or, if this is not possible, Customer may suspend or terminate the Agreement (without prejudice to any fees incurred by Customer prior to suspension or termination).

9. COOPERATION AND DATA SUBJECTS’ RIGHTS

Hownd shall provide reasonable and timely assistance to Customer (at the Customer’s expense) to enable Customer to respond to: (i) any request from a data subject to exercise any of its rights under Applicable Data Protection Law with respect to Customer CRM Data (including its rights of access, correction, objection, erasure, restriction and data portability, as applicable); and (ii) any other correspondence, enquiry or complaint received from a data subject, regulator or other third party in connection with the processing of the Customer CRM Data. In the event that any such request, correspondence, enquiry or complaint is made directly to Hownd, Hownd shall promptly inform Customer providing full details of the same.

10. DATA PROTECTION IMPACT ASSESSMENT

Hownd shall provide reasonable cooperation to the Customer (at Customer’s expense) in connection with any data protection impact assessment that the Customer may be required to conduct under Applicable Data Protection Law with respect to processing of Customer CRM Data under this Data Protection Addendum.

11. SECURITY INCIDENTS

If it becomes aware of a confirmed Security Incident, Hownd shall inform Customer without undue delay and shall provide reasonable information and cooperation to Customer so that Customer can fulfil any data breach reporting obligations it may have under (and in accordance with the timescales required by) Applicable Data Protection Law. Hownd shall further take such any reasonably necessary measures and actions to remedy or mitigate the effects of the Security Incident and shall keep Customer informed of all material developments in connection with the Security Incident.

12. AUDIT

Hownd will make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in this Data Protection Addendum with respect to Customer CRM Data.

Customer agrees that it shall exercise any right of audit under Applicable Data Protection Law (or the Standard Contractual Clauses incorporated by reference in Section 5) by submitting written audit questions to Hownd. Hownd shall respond to such written audit questions submitted to it by Customer, provided that Customer shall not exercise this right more than once per year.

13. OTHER DATA

In the course of providing the Services, Hownd Limited may also process Service Data and Performance Data. Hownd Limited determines the purposes and means of the processing of Service Data and Performance Data (except the extent that any Performance Data may include Customer CRM Data), including to enable it to better target online advertising and to improve its products and services across all Hownd customers.

As such, Customer acknowledges that Hownd Limited is a controller of such Service Data and Performance Data, and Hownd Limited shall process such data strictly in accordance with (and enable data subjects to exercise their rights with respect to such data under): (i) Applicable Data Protection Law, and (ii) its then-current publicly-accessible privacy policy posted on www.Hownd.com.

Annex A

Appendix 1 to the Standard Contractual Clauses

This Appendix forms part of the Standard Contractual Clauses.

The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix.

Data exporter

The data exporter is (please specify briefly your activities relevant to the transfer):

• Customer is the data exporter who is receiving Services under the Agreement.

Data importer

The data importer is (please specify briefly activities relevant to the transfer):

• Hownd is providing Services to the data exporter under the Agreement.

Data subjects

The personal data transferred concern the following categories of data subjects (please specify):

• Prospective and existing customers of the data exporter

Categories of data

The personal data transferred concern the following categories of data (please specify):

• Contact information including email address and any other affiliated contact information provided by the data exporter to the data importer to perform the Services (e.g. name, address, email, phone number, gender, birthdates,and children’s names and birthdatess and company name, job title).

Special categories of data (if appropriate)

The personal data transferred concern the following special categories of data (please specify):

• None

Processing operations

The personal data transferred will be subject to the following basic processing activities (please specify):

• sending of targeted emails to data subjects;
• matching with Hownd Service Data and third party advertising partner online data in order to recognise data subjects visiting third party publisher websites in order to bid on, and serve them, targeted advertising;
• reporting on impact of email and online advertising campaigns on data subjects;
• transfer and storage of personal data with data importer’s storage and data processing subprocessors, including Amazon Web Services and Mailgun.

Appendix 2 to the Standard Contractual Clauses

This Appendix forms part of the Standard Contractual Clauses.

Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached):

See Annex B.

ANNEX B

Security Exhibit

Hownd will commit to, at a minimum, the following security measures and may also adopt other security measures to ensure an appropriate level of security, including confidentiality, integrity, availability and resilience, taking into account the state of the art and the costs of implementation in relation to the risks and the nature of the service and the data that needs to be protected:

1. Risk Management. A risk management program including:
   
   1. risk register containing key business risks and status reviewed by the executive;
   2. controls against risks; and
   3. a plan determining how to mitigate outstanding risks.
2. Policies. Statements of intent on key areas of risk prevention:
   
   1. Policies, standards, and procedures are reviewed and revised periodically;
   2. Policies, standards, and procedures are publicly accessible to personnel; and
   3. Personnel are trained in areas relevant to their roles.
3. Operational Processes. Including:
   
   1. change control;
   2. incident response; and
   3. breach notification.
4. Security Logs. Centralized logging of security events to facilitate detection of and response to security events:
   
   1. Security and other logs are collected and stored in centrally managed systems;
   2. Security and other logs are protected from modification; and
   3. Security and other logs have defined retention periods.
5. Personnel Management. Management of human resources including:
   
   1. Background checks for US based staff including criminal record. In other countries dependent on what is permitted by local law.
   2. On and offboarding granting and revoking individual accounts and permissions.
6. Vendor Management. A program to manage risk created by use of third parties to manage systems and data. Vendors are assessed annually.
7. Access Control to Processing Areas. Processes to prevent unauthorized persons from gaining access to the data processing equipment where the data is processed or used, to include:
   
   1. establishing secure areas;
   2. protection and restriction of access paths;
   3. data processing equipment and personal computers;
   4. all access to the data centers where data is hosted is logged, monitored, and tracked;
   5. the data centers where data are hosted is secured by a security alarm system, and other appropriate security measures; and
   6. the facility is designed to withstand adverse weather and other reasonably predictable natural conditions, is secured by around-the-clock guards, keycard and/or biometric access (as appropriate to the level of risk) screening and escort-controlled access, and is also supported by on-site back-up generators in the event of a power failure.
8. Access Control to Data Processing Systems. Processes to prevent data processing systems from being used by unauthorized persons, to include:
   
   1. identification of users;
   2. issuance and safeguarding of authentication credentials;
   3. logging of successful and unsuccessful authentication attempts; and
   4. protection against external access by means of an industry standard firewall.
9. Least Privilege Access. Measures to ensure that persons entitled to use data processing systems are only able to access the data within the scope and to the extent covered by their respective access permission (authorization) and that data cannot be read, copied or modified or removed without authorization, to include by:
   
   1. implementing binding employee policies and providing training in the handling of data;
   2. effective and measured disciplinary action against individuals who access data without authorization;
   3. release of data to only authorized persons;
   4. implementing principles of least privileged access to data;
   5. production network and data access management governed by network security, two factor authentication, and role-based access controls;
   6. application and infrastructure systems log information to centrally managed log facility for troubleshooting, security reviews, and analysis; and
   7. policies controlling the retention of backup copies which are in accordance with applicable laws and which are appropriate to the nature of the data in question and corresponding risk.
10. Transmission Control. Procedures to prevent data from being read, copied, altered or deleted by unauthorized parties during the transmission thereof or during the transport of the data media and to ensure that it is possible to check and establish to which bodies the transfer data by means of data transmission facilities is envisaged, to include:
    
    1. use of firewall and encryption technologies to protect the gateways and pipelines through which the data travels;
    2. implementation of VPN connections or other network security measures to safeguard the connection to the internal corporate network;
    3. ensuring the integrity of data transmitted; and
    4. monitoring of network infrastructure for potential security violations.
11. Storage Control. When storing the data:
    
    1. Storage of all backup data as part of a designated backup and recovery processes in encrypted form, using a commercially supported encryption solution and data stored on any portable or laptop computing device or any portable storage medium is encrypted;
    2. encryption solutions will be deployed using commercially reasonable and generally accepted cryptographic algorithms and protocols including pseudonymisation and encryption of data.
12. Input Control. Measures to ensure that it is possible to check and establish whether and by whom data has been input into data processing systems or removed, to include:
    
    1. authentication of the authorized personnel; and
    2. protective measures for the data integrity of data input.
13. Availability Control. Measures to ensure that data are protected from accidental destruction or loss, to include:
    
    1. infrastructure redundancy; and
    2. regular backups performed on database servers.
    3. Regular testing of recovery processes
14. Segregation of Processing. Procedures to ensure that data collected for different purposes can be processed separately, to include:
    
    1. separating data through application security for the appropriate users;
    2. logical separation of data; and
    3. designing systems so data collected for specific purposes is processed separately.
15. Vulnerability Management. Systems are regularly checked for vulnerabilities and any detected are immediately remedied, to include:
    
    1. tests are conducted, as needed, to discover new vulnerabilities; and
    2. systems are monitored for vulnerabilities and vulnerabilities are remediated in a timely manner, prioritized by risk.
16. Incident Management. Establishment of adequate and appropriate incident management will include:
    
    1. established policies and procedures for handling security incidents;
    2. the ability to prepare for, identify, contain, eradicate, and recover from security intrusions;
    3. adequate documentation of security incidents, including any lessons learned.
    4. Regular testing of processes.
17. Business continuity planning. The ability to restore the availability and access to data in a timely manner in the event of a physical or technical incident
18. Auditing. Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing:
    
    1. Penetration tests using an external provider bi-annually;
    2. Ongoing bug bounty program; and
    3. Vulnerability scans of internet facing hosts.