Data Processing Addendum

Version 1.0 – March 29, 2021

This Data Processing Addendum, including its Schedules, (“DPA”) supplements and forms an integral part of the agreement as governed by the mybrand.center standard terms of service available at mybrand.center/legal (“Terms”) or any other agreement between Customer and mybrand.center governing the use and access of the Product (“Agreement”). This DPA reflects the parties’ agreement with regard to the Processing of Personal Data by mybrand.center on behalf of the Customer in connection with the Product. Unless otherwise defined in this DPA or the Agreement, all capitalized terms used in this DPA will have the meanings given to them in Section 1 of this DPA.

1 — Definitions

Term	Explanation
Controller	means the entity which determines the purposes and means of the Processing of Personal Data.
Customer	means the legal entity that is a party to the Agreement with mybrand.center.
Data Protection Legislation	means all laws and regulations applicable to the Processing of Personal Data under the Agreement.
Data Subject	means the identified or identifiable person to whom Personal Data relates.
EEA	means the European Economic Area.
GDPR	means Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Personal Data	means any information relating to an identified or identifiable natural person where such data is Processed by mybrand.center on behalf of Customer.
Processing	(and all verb tenses) means any operation or set of operations which is performed on Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
Sub-Processor	means a Processor engaged by mybrand.center
Standard Contractual Clauses	means Schedule 4 attached to and forming part of this DPA pursuant to the European Commission Decision C(2010)593 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC.
Supervisory Authority	means an independent public authority which is established by an EU member state pursuant to the GDPR.

2 — Processing of Personal Data

2.1Scope, Roles and Details of the Processing. This DPA, including any Schedules, applies when Personal Data is processed by mybrand.center pursuant to the Agreement. Regarding the Processing of Personal Data, Customer is the Controller, mybrand.center is the Processor and mybrand.center will engage Sub-Processors pursuant to the requirements set forth in Section 6 below. The duration of the Processing, the nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects Processed under this DPA are further specified in Schedule 1 to this DPA.
2.2Customer’s Processing of Personal Data. Customer shall, in its use of the Product, Process Personal Data in accordance with the requirements of Data Protection Legislation, including any applicable requirement to provide notice to Data Subjects of the use of mybrand.center as Processor. For the avoidance of doubt, Customer’s instructions for the Processing of Personal Data shall comply with Data Protection Legislation. Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data. Customer specifically acknowledges that its use of the Product will not violate the rights of any Data Subject that has opted-out from sales or other disclosures of Personal Data, to the extent applicable under the CCPA.
2.3mybrand.center Processing of Personal Data. mybrand,center shall treat Personal Data as Confidential Information and shall Process Personal Data on behalf of and only in accordance with Customer’s documented instructions for the following purposes: (i) Processing in accordance with the Agreement and applicable Order Form(s); and (ii) Processing initiated by Users in their use of the Product.

3 — Instructions

3.1Customer Affiliates. Customer represents that it is authorised to give data processing instructions to mybrand.center and to otherwise act on behalf of any Customer Affiliates under this DPA.
3.2Documented Instructions. This DPA and the Agreement are Customer’s complete and final documented instructions at the time of signature of the Agreement with mybrand.center for the Processing of Personal Data. Any additional or alternate instructions must be agreed upon separately and in writing.
3.3Exception. If mybrand.center is required by law to conduct additional processing, it shall inform Customer of that legal requirement before Processing, unless such notification is prohibited by law.
3.4Instructions likely to violate Data Protection Legislation. If, in mybrand.center’s opinion, Customer’s instructions are either likely to violate Data Protection Legislation, mybrand.center is entitled to refuse to follow such instructions and shall inform Customer of the reasons for its refusal. In such cases, Customer shall provide alternative instructions in a timely manner and mybrand.center may cease all Processing of the impacted Personal Data (other than secure storage thereof) until it receives acceptable instructions.

4 — mybrand.center personnel

4.1Confidentiality Obligations. mybrand.center ensures that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, and have executed written confidentiality agreements.
4.2Limited Access. Mybrand.center ensures that mybrand.center’s access to Personal Data is limited to those personnel performing services in accordance with the Agreement.
4.3Data Protection Officer. mybrand.center has appointed a data protection officer (“DPO”). The appointed DPO may be reached at privacy@mybrand.center.

5 — security of Processing

5.1 Measures. mybrand.center has implemented and shall maintain appropriate technical and organisational measures to protect Personal Data against accidental, unauthorised, or unlawful destruction, loss, alteration, disclosure, and access (“Security Measures”), as described in Schedule 3 of this DPA, including as appropriate:
5.2 Customer has made an independent determination as to whether these Security Measures meet the Customer’s requirements.

6 — Sub-Processors

6.1General Authorization. Customer agrees that mybrand.center may use Sub-Processors to fulfil its contractual obligations under this DPA or to provide certain services on its behalf.
6.2Sub-Processor Obligations. mybrand.center will enter into a written agreement with the Sub-Processor and, to the extent that the Sub-Processor is performing the same Processing activities that are being provided by mybrand.center, mybrand.center will impose on Sub-Processors data protection obligations not less protective than those in this DPA.
6.3Sub-Processor List. mybrand.center currently uses the Sub-Processors listed in Schedule 2 to this DPA. mybrand.center will update the Sub-Processors with any new Sub-Processor and notify Customer at least 7 calendar days before such Sub-Processors will begin to Process Personal Data.
6.4Objection Right. Customer may object to the use of a new Sub-Processor on a reasonable and legitimate basis. In the event Customer objects to a new Sub-Processor, Customer shall provide written notice to privacy@mybrand.center within the 7 calendar day notice period set out in Section 6.3 outlining Customer’s specific concerns about the new Sub-Processor in order to give mybrand.center the opportunity to address such concerns. mybrand.center may, at its sole discretion, (i) not appoint the Sub-Processor and/or propose an alternate Sub-Processor; (ii) take the steps to address the Customer’s specific concerns and obtain Customer’s written consent to use the Sub-Processor; or (iii) make available to Customer the mybrand.center Product(s) without the particular aspect that would involve use of the objected-to Sub-processor. If mybrand.center is unable or determines in its reasonable judgement, that it is commercially unreasonable to do any of the options in Section 6.4 (i)-(iii), Customer may terminate the Agreement in accordance with section 19.3 of the Terms.
6.5Liability. mybrand.center will remain responsible for the performance of a Sub-Processor to the same extent mybrand.center would be responsible if performing the services of each Sub-Processor directly under the terms of this DPA.

7 — Rights of Data Subject

mybrand.center will, to the extent legally permitted, notify Customer without undue delay if mybrand.center receives a request from a Data Subject to exercise the Data Subject’s rights set forth in Data Protection Legislation, especially Chapter III of GDPR (“Data Subject Request”). Taking into account the nature of the Processing, mybrand.center will assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to Data Subject Requests under Data Protection Legislation. To the extent Customer is unable to address a Data Subject Request, mybrand.center will upon Customer’s request provide commercially reasonable efforts to assist Customer in responding to such Data Subject Request. To the extent legally permitted, Customer will be responsible for any costs arising from mybrand.center’s provision of such assistance.

8 — Assistance

Taking into account the nature of Processing and the information available to mybrand.center, mybrand.center will provide reasonable assistance and cooperation to Customer in respect of its relevant obligations under Articles 32 to 36 GDPR. To the extent legally permitted, Customer will be responsible for any costs arising from mybrand.center’s provision of such assistance.

9 — Personal Data Breach Notification

mybrand.center will notify Customer without undue delay, but always within 48 hours, after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored or otherwise Processed by mybrand.center or its Sub-Processors of which mybrand.center becomes aware (“Personal Data Breach”). Notification of Personal Data Breaches, if any, will be delivered by email at the email address specified for notices in the applicable Order Form, if no email address is specified, to one or more of Customer’s Product administrators. mybrand.center’s obligation to notify Customer of a Personal Data Breach is not an acknowledgement by mybrand.center of any fault or liability with regard to the Personal Data Breach. The obligations under this Section 9 do not apply to incidents that are caused by Customer or its Users.

10 — Return and Deletion of Personal Data

10.1Upon Customer’s request to privacy@mybrand.center mybrand.center will return or delete Personal Data in accordance with the timeframes specified in the Agreement, unless European Union law or the laws of a EU member state requires that mybrand.center retains the Personal Data. mybrand.center may delete Personal Data six months after termination or expiration of the Agreement. mybrand.center shall dispose Personal Data in accordance with the latest method(s) of data sanitizing, as detailed in NIST 800-88 (“Guidelines for Media Sanitization”).
10.2Notwithstanding anything to the contrary in this DPA, mybrand.cneter may retain Personal Data if and for as long as required by law.
10.3Personal Data stored in mybrand.center’s auto-backup or archival systems will be deleted automatically after 180 days after back-up, or otherwise as soon as technically possible.
10.4If Customer provides Personal Data on a hard drive or other forms of removable media, such removable media must be encrypted or password protected. In collaboration with Customer, mybrand.center shall either return the removable media to Customer, or securely destroy such removable media by using a certified third party.

11 — Transfers of Personal Data to Third Countries.

11.1Regions. Data is stored within West-Europe. Except as necessary to provide the Product and services initiated by Customer, or as necessary to comply with the law, mybrand.center will not transfer Personal Data from Customer’s selected Region. A transfer to a third country shall take place only if the conditions of Chapter V. GDPR are complied with.
11.2Application of Standard Contractual Clauses. Mybrand.center will enter into Standard Contractual Clauses with each affiliate and/or Sub-Processor where the Processing of Personal Data is transferred outside the EEA, either directly or via onward transfer, to any third country not recognized by the European Commission as providing an adequate level of protection for Personal Data. Customer hereby authorises mybrand.center to enter into Standard Contractual Clauses (also) on its behalf and commissions mybrand.center to enforce them against the relevant Sub-Processor on the Customer’s behalf where appropriate. The Standard Contractual Clauses will not apply to Personal Data that is not transferred, either directly or via onward transfer, outside the EEA.
11.3Order of precedence. If the Standard Contractual Clauses apply, nothing in this Section 11 varies or modifies the Standard Contractual Clauses.

12 — Limitation of liability

Each party’s liability, taken together in the aggregate, arising out of or related to this DPA, whether in contract, tort or under any other theory of liability, is subject to the ‘Limitation of Liability’ section of the Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and all DPAs together.

13 — Entire Agreement, Hierarchy

Except as amended by this DPA, the Agreement will remain in full force and effect. If there is a conflict between any other agreement between the parties including the Agreement and this DPA, the terms of this DPA will take precedence to the extent of such conflict.

14 — Term and termination

This DPA shall enter into force at the same time as the Agreement and shall automatically terminate upon any termination or expiration of the Agreement.

15 — List of Schedules

Schedule 1: Details of the Processing of Personal Data

Nature and Purpose of Processing
mybrand.center will Process Personal Data as necessary to provide the Product pursuant to the Agreement and as further instructed by Customer in its use of the Product.

Duration of Processing
Subject to Section 10 of this DPA, mybrand.center will Process Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing

Categories of Data Subjects
Customer may store Personal Data in the Product, the extent of which is determined and controlled by Customer in its sole discretion. The sole Personal Data required for the use of the Product relates to the following categories of Data Subjects:

Employees of Customer
Customer’s Users

Types of Personal Data
Customer may store Personal Data in the Product, the extent of which is determined and controlled by Customer in its sole discretion. The sole categories of Personal Data required for the use of the Product are:

First and last name
Email address
Password (in case of non-SSO users)

The following data is optional:

Company
Telephone number
Function
Avatar

Special categories of data
Customer may not store special categories of data in the Product(s). The Product is not intended for Customer to store sensitive categories of data, which is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation, or personal data relating to criminal convictions and offences.

Schedule 2: List of Sub-Processors and mybrand.center Entities

Infrastructure provider
mybrand.center engages the following Sub-Processor(s) to host and store Customer Data.

Entity name	Sub-processors activity	Entity country
Microsoft Azure	Cloud Service Provider	The Netherlands

Other Sub-Processors

Entity name	Sub-processors activity	Entity country
None

Other Sub-Processors
The following entities are part of the corporate structure of Supplier. Depending on the geographic location of a customer, Supplier may also engage one or more of the following entities as sub-processors:

Entity	Country
Restyle Groep Nederland B.V.	The Netherlands
Arbor Natalis B.V.	The Netherlands

Updates
As mybrand.center is continuously improving its product(s), the sub-processors used may also change. Supplier will promptly update this page with any new or replacement sub-processors and notify customers before, and how, such sub-processors will process personal data. Please check back frequently for updates.

Policies