Data Processing Addendum

Version: 10.14.2022
This Data Processing Addendum (“DPA”) sets forth the terms and conditions related to the privacy, confidentiality, and security of Personal Data associated with the Services provided by AnyRoad, Inc. (“AnyRoad”) pursuant to the Terms of Service found on www.anyroad.com/terms (the “Agreement”). Capitalized terms not defined herein shall have the meaning ascribed to them in the Agreement. The terms of this DPA are hereby incorporated into the Agreement, Privacy Policy, or any other applicable services agreement between AnyRoad and Company.

RECITALS

(A) AnyRoad provides certain experience relationship management services (collectively the "Service") to Company under an Order Form between AnyRoad and Company ("Main Agreement") which is subject to the Agreement noted above. In connection with the Service, the parties anticipate that AnyRoad may process certain Personal Data in respect of which Company or any affiliate of Company may be a data controller under applicable Data Protection Laws.

(B) AnyRoad and Company have agreed to enter into this Addendum in order to ensure that adequate safeguards are put in place with respect to the protection of such personal data as required by Data Protection Laws.

1. Definitions

1.1 The following definitions are used in this Addendum:

• "Adequate Country" means a country or territory that is recognized under EU Data Protection Laws as providing adequate protection for Personal Data;
• "Affiliate" means, with respect to a party, any corporate entity that, directly or indirectly, Controls, is Controlled by, or is under Common Control with such party (but only for so long as such Control exists);
• "AnyRoad Group" means AnyRoad and any of its Affiliates.
• "Company Group" means Company and any of its Affiliates;
• "Data Subject Request" means a request from or on behalf of a data subject relating to access to, or rectification, erasure or data portability in respect of that person’s Personal Data or an objection from or on behalf of a data subject to the processing of its Personal Data;
• "Data Protection Laws" means any and all privacy, security and data protection laws and regulations that apply to the Personal Data Processed by Anyroad under the Main Agreement, including, as applicable, and not by way of limitation, the GDPR, Member State laws implementing the GDPR, the UK GDPR, and the California Consumer Privacy Act ("CCPA") to the extent applicable to the processing of Personal Data under this Addendum or the Main Agreement;

1.2 An entity "Controls" another entity if it: (a) holds a majority of the voting rights in it; (b) is a member or shareholder of it and has the right to remove a majority of its board of directors or equivalent managing body; (c) is a member or shareholder of it and controls alone or pursuant to an agreement with other shareholders or members, a majority of the voting rights in it; or (d) has the right to exercise a dominant influence over it pursuant to its constitutional documents or pursuant to a contract; and two entities are treated as being in "Common Control" if either controls the other (directly or indirectly) or both are controlled (directly or indirectly) by the same entity.

2. Status of the Party

2.1 The type of Personal Data processed pursuant to this Addendum and the subject matter, duration, nature and purpose of the processing, and the categories of data subjects, are as described in Annex 1.
2.2 Each party warrants in relation to Personal Data that it will comply (and will procure that any of its personnel comply and use commercially reasonable efforts to procure that its sub-processors comply), with Data Protection Laws. As between the parties, Company shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Company acquired Personal Data.
2.3 In respect of the parties’ rights and obligations under this Addendum regarding the Personal Data, the parties hereby acknowledge and agree that Company is the data controller and AnyRoad is the data processor, and accordingly AnyRoad agrees that it shall process all Personal Data in accordance with its obligations pursuant to this Addendum.

3. AnyRoad Obligations

3.1 With respect to all Personal Data, AnyRoad shall:

• Only process Personal Data in order to provide the Service, and shall act only in accordance with: (i) this Addendum, and (ii) Company’s written instructions;
• Inform Company if, in AnyRoad’s opinion, any instructions provided by Company infringe the GDPR;
• Implement appropriate technical and organizational measures.
• Take reasonable steps to ensure that only authorized personnel have access to such Personal Data.

4. Sub-Processing

4.1 Company grants a general authorization (a) to AnyRoad to appoint other members of the AnyRoad Group as sub-processors.
4.2 AnyRoad will maintain its list of sub-processors at the following URL: https://www.anyroad.com/subprocessors and will add the names of new and replacement sub-processors to the list prior to them starting sub-processing of Personal Data.

5. Audit and Records

5.1 AnyRoad will make available written documentation reflecting its current technical and organizational data protection measures.

6. Data Transfers

6.1 The applicable Standard Contractual Clauses set out in Annex 2 will apply in respect of that processing, and AnyRoad will comply with the obligations of the 'data importer' in the Standard Contractual Clauses and Company will comply with the obligations of the 'data exporter'.

ANNEX 1 - Details of the Personal Data and processing activities

Subject matter and duration of the Processing of Company Personal Data

• Nature of the processing: Processing customer user data for experiential relationship management
• Types of Personal Data to be Processed: Email, name, booking information, feedback
• Categories of Data Subject: Customer’s users and customer’s employees

ANNEX 2 - STANDARD CONTRACTUAL CLAUSES

SECTION I

Clause 1: Purpose and Scope

(a) These standard contractual clauses ensure compliance with the requirements of Regulation (EU) 2016/679.
(b) The Parties: (i) the data exporter and (ii) the data importer have agreed to these standard contractual clauses.

Clause 2: Effect and Invariability of the Clauses

(a) These Clauses set out appropriate safeguards, including enforceable data subject rights.

Clause 3: Third-Party Beneficiaries

(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries.

Clause 4: Interpretation

(a) These Clauses shall be read and interpreted in the light of Regulation (EU) 2016/679.

Clauses for data protection safeguards, obligations, liability, and other subjects follow herein as originally required, ensuring compliance with European directives and maintaining definitions and rights for data processing.

OBLIGATIONS OF THE PARTIES

The data importer shall not disclose the personal data to a third party without documented instructions from the data exporter.

Mandatory Clauses

Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.