Company is a Controller and Fyllo is a Processor of the Covered Personal Data. Company does not make Covered Personal Data available to Fyllo for consideration but only to enable Fyllo to provide the Services to Company, and Fyllo does not provide any consideration to Company in accessing the Covered Personal Data to provide the Services to Company.
Each Party will comply with applicable Data Protection Laws as applicable to its performance hereunder. Company warrants that for all of the Purposes of Processing set forth in this Addendum: (a) it has notified Consumers through appropriate means that would satisfy the obligations under applicable Data Protection Laws about the Processing of Covered Personal Data by Company, Fyllo, and Media Vendors (including through the use of Tracking Technologies), (b) it has obtained all required and legally enforceable Consents (or other lawful basis) or otherwise has the right under applicable Data Protection Laws to disclose Covered Personal Data to Fyllo or Media Vendors, and (c) where required under applicable Data Protection Laws, it has implemented a Signaling System to obtain Consent or facilitate opt-outs from Consumers on any Sites, Ads or other digital properties on which Company deploys Tracking Technologies to collect Covered Personal Data.
2.3. Processing Instructions
Company hereby appoints Fyllo as its Processor for the Services and instructs Fyllo to Process Covered Personal Data as required to provide the Services. Company’s Instructions to Fyllo shall be lawful and Company will not instruct Fyllo to take any action that would violate applicable Data Protection Laws. Fyllo will only Process the Covered Personal Data on behalf of Company in accordance with Company’s Instructions as necessary for the Specified Business Purpose, including with respect to any Covered Personal Data that Company makes available (directly or indirectly) to Media Vendors or that Media Vendors make available (directly or indirectly) to Company.
Fyllo shall ensure that any person who is authorized by Fyllo to Process Covered Personal Data (including its staff, agents, and subcontractors) shall be under an appropriate obligation of confidentiality (whether a contractual or statutory duty).
2.5. No Processing on Fyllo Systems
For the Services provided by Fyllo under the Agreement, Company acknowledges that Fyllo does not Process Covered Personal Data on Fyllo systems.
2.6. Processing on Media Vendor Systems
Fyllo shall not, and shall not authorize any Media Vendor to process, retain, use, sell, transfer, disclose, or otherwise share Covered Personal Data for any Purposes other than the Advertising Purposes as directed by Company under this Addendum and the Agreement. Company acknowledges that any Processing between Company and Media Vendors is not a data transfer between Fyllo and the Media Vendor but rather a data transfer between Company and the applicable Media Vendor. Where Company’s disclosure of Covered Personal Data to Media Vendor constitutes a Sale or Share or otherwise impacts Company’s legal obligations, Company (not Fyllo) will be deemed to have Sold or Shared the Covered Personal Data and Company is responsible for any resulting regulatory or contractual obligations as required under applicable Data Protection Laws.
2.7. No Assessment of Covered Personal Data by Fyllo
Fyllo has no obligation to assess the contents or accuracy of Covered Personal Data, including to identify information subject to any specific legal, regulatory, or other requirement. Company is responsible for making an independent determination as to whether the Services meet Company’s requirements and legal obligations under Data Protection Laws.
Each Party shall promptly notify the other if, in its opinion, it can no longer comply with its obligations under this Addendum. The Parties shall reasonably assist each other in meeting their respective obligations under applicable Data Protection Laws. Both parties have the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Covered Personal Data.
2.9. Data Protection Impact Assessments
Fyllo shall provide reasonably requested information regarding the Services to enable Company to demonstrate its compliance with Data Protection Laws and to carry out data protection impact assessments or prior consultations with data protection authorities as required by Data Protection Laws, so long as Company does not otherwise have access to the relevant information. No more than once annually, Company may request documentation prepared by Fyllo in the ordinary course of its business evidencing Fyllo’s compliance with this Addendum. The scope of Company’s request may not extend beyond information applicable to Company and Company must share the results of any analysis it conducts related to the Services with Fyllo upon request. All information and materials related to such Company request are Fyllo Confidential Information.
2.10. Government, Law Enforcement, or Third Party Inquiries
If either party receives any correspondence, inquiry, or complaint from any individual, supervisory authority, other relevant regulator, or other third party in connection to the Services, then the parties shall cooperate in good faith as necessary to enable that party to respond. If Fyllo receives a demand to retain, disclose, or otherwise Process Covered Personal Data for any third party, including, but not limited to law enforcement or a government authority, then Fyllo shall attempt to redirect the demand to Company by providing Company contact information to such third party, or, if unable to redirect the demand, Fyllo shall provide Company reasonable notice of the demand as promptly as feasible.
2.11. Right to Suspend Services
If Fyllo reasonably believes that Company’s use of the Services violates Fyllo’s privacy standards and practices, is unauthorized, or violates applicable Data Protection Laws, Company grants Fyllo the right, upon notice, to take reasonable and appropriate steps to stop and remediate, including suspension of Services. Fyllo will endeavor to provide a 10-day notice; however, suspension may occur contemporaneously with such notice if the violation jeopardizes Fyllo’s ability to provide services to its other customers or exposes Fyllo to a violation of law, potential fines, or civil liability. The notice shall include a summary description of the violation. Such action will not limit any of Fyllo’s other rights or remedies at law or in equity.
2.12. California Specific Obligations
To the extent Covered Personal Data contains any data regulated by the CCPA, Fyllo certifies, as a Service Provider to Company, that it understands, and will comply with, the applicable restrictions set forth in the CCPA and agrees that:
2.12.1. Fyllo shall Process Covered Personal Data on behalf of Company only for the Specified Business Purpose; and
2.12.2. As between Company and Fyllo and for purposes of requirements under the CCPA and analogous requirements under applicable Data Protection Laws, Fyllo will not (i) Sell or Share the Covered Personal Data, (ii) retain, use, or disclose the Covered Personal Data for any purpose other than for the Specified Business Purpose, (iii) retain, use, or disclose the Covered Personal Data outside of the direct business relationship between Fyllo and Company, or (iv) combine the Covered Personal Data with Personal Data it receives from other parties except for the Specified Business Purpose or as permitted under applicable Data Protection Laws.