Privacy and Terms of Use

2.1. Supersedence. This Data Processing Addendum shall supersede any and all provisions of the General Terms inconsistent herewith.
 

2.2. Data Controller and Data Processor. The Parties acknowledge that the Customer is the Data Controller and BalanceWise IQ is the Data Processor of the Customer Personal Information. BalanceWise IQ will Process Personal Information in accordance with Section 3 of this Data Processing Addendum.
 

2.3. Customer’s Obligations as Data Controller. The Customer warrants that the Customer Personal Information has been obtained fairly and lawfully and, in all respects, in compliance with the Privacy Laws.
 

2.4. BalanceWise IQ’s Obligations as Data Processor. BalanceWise IQ shall:
 

2.4.1. Process the Customer Personal Information only in accordance with Section 3 of this Data Processing Addendum and any other reasonable documented instructions as provided by the Customer to BalanceWise IQ from time to time (“Instructions”), including with regard to transfers of Customer Personal Information to a third country, save where:
 

2.4.1.1. such Instructions are unlawful;
 

2.4.1.2. such Instructions would cause BalanceWise IQ to breach its own obligations under Privacy Laws or the General Terms or any other agreement with a third party;
 

2.4.1.3. such Instructions would negate the Survey Respondents’ right under the General Terms to remain anonymous;
 

2.4.1.4. BalanceWise IQ is under a legal obligation to Process the Customer Personal Information, in which case BalanceWise IQ shall inform the Customer of the legal obligation, except to the extent the law prohibits it from doing so; and/or
 

2.4.1.5. such Instructions would impact the overall availability of the Services or the performance of the BalanceWise IQ Platform in an undue manner.
 

2.4.2. inform the Customer if, in its opinion, an Instruction received from the Customer infringes the Privacy Laws;
 

2.4.3. ensure that all BalanceWise IQ employees and personnel who are involved in the Processing of Customer Personal Information have committed themselves to confidentiality or are under statutory obligations of confidentiality;
 

2.4.4. not provide any new third party with access to the Customer Personal Information or subcontract any of its obligations under the General Terms that involve Processing Customer Personal Information without providing at least thirty (30) days advance notice to the Customer via email. The Customer hereby approves those third parties listed in Schedule 1 hereto (the “Sub-processors”), which are compliant with requirements under Privacy Laws, as applicable to this Data Processing Addendum, regarding transfers of Customer Personal Information to a third country.
 

2.4.5. ensure that any sub-contract entered into by BalanceWise IQ (where Customer Personal Information is Processed by a Sub-processor) contains provisions which comply with Privacy Laws and in any event are no less onerous than those imposed under Section 2 of this Data Processing Addendum, and where a Sub-processor fails to fulfill its data protection obligations under the Privacy Laws, BalanceWise IQ shall remain liable to Customer for the performance of that Subprocessor’s obligations;
 

2.4.6. implement and maintain appropriate technical and organizational security measures to protect against unauthorized or unlawful Processing of the Customer Personal Information and against accidental loss, disclosure or destruction of, or damage to, the Customer Personal Information, taking into account the state of the art, costs of implementation and nature, scope, context and purposes of Processing, as described in the Privacy Policy, found at https://www.balancewiseiq.com/privacy-notice, and including:
 

2.4.6.1. the anonymization, pseudonymization and/or encryption of Customer Personal Information;
 

2.4.6.2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of Processing systems and services;
 

2.4.6.3. the ability to restore the availability and access to Customer Personal Information in a timely manner in the event of a physical or technical incident; and
 

2.4.6.4. a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the Processing.
 

2.4.7. taking into account the nature of the Processing, assist the Customer by appropriate technical and organizational measures, as further described in Schedule 2 hereto, to enable the Customer to comply with its obligations under Privacy Laws in responding to requests from Data Subjects or the Data Protection Regulator, insofar as this is possible, to the extent the anonymity of the Personal Information shall be kept confidential by BalanceWise IQ , and not shared with Customer;
 

2.4.8. assist the Customer (at the Customer’s reasonable cost), to comply with the following obligations under the Privacy Laws, taking into account the nature of Processing and information available to BalanceWise IQ, including:
 

2.4.8.1. notification and assistance to Customer without undue delay, in accordance with the provision set forth in Section 11 of the Privacy Policy, and notification to the Data Protection Regulator and Data Subjects of a Data Incident, as defined in the Privacy Policy, with regards to Customer Personal Information transmitted, stored or otherwise Processed; and
 

2.4.8.2. the Customer’s obligations to carry out data protection impact assessments and any subsequent consultation with the Data Protection Regulator;
 

2.4.9. make available to Customer or an independent third party auditor mandated by the Customer (but not being a competitor of BalanceWise IQ), to a maximum of once a year or when a breach of Customer Personal Information is reasonably suspected, all reasonable information that BalanceWise IQ deems necessary to demonstrate compliance with the obligations imposed on BalanceWise IQ under Section 2 of this Data Processing Addendum, and allow for and contribute to audits, including inspections for the sole purpose of demonstrating such compliance; and
 

2.4.10. unless required by law, at Customer’s request following termination or expiry of the General Terms for whatever reason, securely delete all of the Customer Personal Information.
 

2.4.11. comply with the relevant Controller to Processor provisions of the 2021 Standard Contractual Clauses which are incorporated by reference and are an integral part of this Data Processing Addendum, for the purpose of which the Parties agree that:
 

2.4.11.1. Customer is the data exporter and BalanceWise IQ is the data importer.
 

2.4.11.2. Module Two of the 2021 Standard Contractual Clauses will apply where Customer is a Controller and BalanceWise IQ is a Processor.
 

2.4.11.3. Clause 7 of the 2021 Standard Contractual Clauses will apply.
 

2.4.11.4. For the purpose of Clause 9, paragraph (a) of the 2021 Standard Contractual Clauses, option 2 shall apply, as per the time period specified under section 2.4.4 hereof.
 

2.4.11.5. The Parties agree that any direct claims brought under the Standard Contractual Clauses by a Party shall be subject to the limitation of liability set out in the General Terms, provided however that nothing in this Data Processing Addendum shall be construed as a limitation or exclusion of a Party’s liability toward a Data Subject under the Standard Contractual Clauses.
 

2.4.11.6. For the purpose of Clause 17 of the 2021 Standard Contractual Clauses the parties choose option 1 and the law of the State of California.
 

2.4.11.7. For the purpose of Clause 18 of the 2021 Standard Contractual Clauses, paragraph (b), the Parties choose the courts of the State of California.
 

2.4.11.8. The contents of Appendix I of the Standard Contractual Clauses are deemed completed with the information found in Sections 2 and 3 hereof. The contents of Appendix II are described in Schedule 2 hereof.
 

2.4.11.9. In the event of any conflict between the provisions of the Standard Contractual Clauses and this Data Processing Addendum, the Standard Contractual Clauses shall prevail.
 

2.4.12. comply with the UK International Transfer Addendum, as set out in Schedule 3 hereto.
 

2.4.13. Additional Provisions for California. To the extent that BalanceWise IQ processes Personal Information of consumers subject to the CCPA, the CPRA and applicable regulations thereunder, the Parties shall comply with all applicable provisions of the CCPA, of the CPRA and of applicable regulations thereunder, as amended from time to time. The Parties shall agree to act in good faith to enter into a modified agreement in order to address any such amendment and ensure ongoing compliance with California laws. BalanceWise IQ shall not (a) retain, use or disclose such Personal Information for any purpose other than for the specific purposes described under the General Terms or this Data Processing Addendum, or as otherwise permitted by the CCPA, the CPRA or applicable regulations; (b) retain, use or disclose such Personal Information for a commercial purpose other than the specific purposes described under the General Terms or this Data Processing Addendum; or (c) “sell” or “share” such Personal Information (the terms “sell” and “share” having the meaning ascribed to them in the CCPA, CPRA or applicable regulations).