This United States Data Processing Agreement (“USDPA”) is effective as of the date both parties sign the underlying Thanks Merchant Partner Agreement Agreement (“MPA”) covering the applicable Services (as defined therein) between the Partner and Thanks (inclusive of any and all schedules, attachments, addendums, amendments, exhibits, order forms and statements of work, the “Agreement”), or by otherwise accepting or using the Thanks Services described therein. You, on behalf of your company specified in the Agreement, agree to be bound by this USDPA. All capitalized terms that are used but not defined in this USDPA shall have the meaning given to them in the Agreement.
1. Background
1.1 Partner will use the Thanks Platform pursuant to the MPA, and in connection with such usage and with Thanks’ provision of the Services, Thanks will have access to and process certain personal data. The personal data that Thanks will process in providing the Services is described in Annex A to this USDPA.
1.2 If any data processed in the provision of the Services contains any personal data of individuals residing in the United States (“U.S. Personal Data”) then the provisions of this USDPA shall apply and will take priority over any of the provisions of Clause 6 (Data sharing and Privacy) of the Agreement if and to the extent only of any conflict or inconsistency between them.
1.3 Each party shall comply with its obligations under this USDPA with respect to the types of U.S. Personal Data that it processes and according to its responsibilities as the Business or Service Provider (as appropriate) in relation to the relevant U.S. Personal Data.
1.4 The parties agree that:
(a) Partner shall be a Business with regard to any U.S. Personal Data described in Annex A constituting Partner Data (as defined in the Agreement), that is processed in connection with the provision of the Services (“Partner U.S. Personal Data”);
(b) Subject to paragraph (c), Thanks shall be a Service Provider with regard to Partner U.S. Personal Data;
(c) Thanks and Partner shall both be Businesses with regard to the limited subset of Partner U.S. Personal Data collected following the End Customer’s acceptance or opting in to the Advertiser’s or Provider’s offer or promotion (“Referral Data”), but Thanks may use Referral Data solely as necessary to deliver or facilitate such offer or promotion in Thanks’ provision of the Services;
(d) Thanks shall be a Business with regard to the Thanks Data, including the Derived Data.
2. Security
Thanks shall implement appropriate technical and organizational measures designed to protect the Partner U.S. Personal Data (i) from accidental or unlawful destruction, and (ii) loss, alteration, unauthorized disclosure of, or access to, the Partner U.S. Personal Data (a “Security Incident“). Such measures shall have regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.
3. Business Obligations
3.1 Each party shall comply with all aspects of U.S. Privacy Law applicable to its data processing activities in the capacity of a Business hereunder, including by processing such data fairly and lawfully, providing any legally required privacy notices and disclosures, obtaining any legally required consents for personal data processing, and implementing appropriate physical, technical, and administrative safeguards designed to protect the security and integrity of U.S. Personal Data under its control.
4. Service Provider Obligations
4.1 Purpose limitation
Thanks shall process the Partner U.S. Personal Data as necessary to perform its obligations under the Agreement, for such other purposes as may be described in this USDPA (including Annex A) and in accordance with the documented instructions of the Partner (the “Permitted Purpose”), except where otherwise required by any U.S. Privacy Law. In furtherance of the foregoing, and except where otherwise required by U.S. Privacy Law, Thanks shall not: (i) sell or share for purposes of cross-context behavioral advertising any Partner U.S. Personal Data for monetary or other consideration; (ii) retain, use, or disclose Partner U.S. Personal Data for any purpose other than the Permitted Purpose; (iii) retain, use, or disclose Partner U.S. Personal Data outside of the direct business relationship between Partner and Thanks; or (iv) combine Partner U.S. Personal Data with U.S. Personal Data that it receives from other sources or collects from its own interactions with an individual; provided that Thanks may combine, merge, or integrate Partner U.S. Personal Data as necessary to perform any legitimate business purpose, including those business purposes described in applicable U.S. Privacy Laws.
4.2 Confidentiality of processing
Thanks shall ensure that any person that it authorizes to process the Partner U.S. Personal Data (including Thanks’ staff, agents and subcontractors) (an “Authorized Person“) shall be subject to a strict duty of confidentiality (whether a contractual duty or a statutory duty), and shall not authorize any person access to Partner U.S. Personal Data who is not under such a duty of confidentiality.
4.3 Subprocessing
Thanks may subcontract its processing of Partner U.S. Personal Data to a subprocessor without the prior written consent of Partner. Thanks shall, however, inform Partner when it adds to or removes the subprocessors (which may be done via a website link notified to Partner) and give Partner a reasonable opportunity to object to the addition of a new subprocessor. Partner consents to and authorizes Thanks to use the subprocessors listed at www.jointhanks.com/thanks-subprocessors in its provision of the Services.
4.4 Data subjects’ rights
Thanks shall:
(a) respond to any verified and valid request from a data subject to exercise its rights to deletion under U.S. Privacy Law by deleting all personal data held by Thanks that relates to the data subject and is contained within the Partner U.S. Personal Data; provided that Thanks may retain personal data as described in this DPA (including Annex A); and
(b) provide all reasonable and timely assistance (including by appropriate technical and organizational measures) to Partner (at Partner’s expense) to enable Partner to respond to:
(i) any verified and valid request from a data subject to exercise any of its other statutory rights given under applicable U.S. Privacy Law, including rights of access, correction, and data portability, as applicable; and (ii) any written correspondence, inquiry, or complaint received from a regulator in connection with the processing of the Partner U.S. Personal Data. In the event that any request, correspondence, inquiry, or complaint is made directly to Thanks, Thanks will promptly do either of the following: inform Partner of the request, correspondence, inquiry, or complaint; or direct the data subject or regulator to contact the Partner.
4.5 Data Protection Impact Assessment
If Thanks determines that its processing of Partner U.S. Personal Data is likely to result in a high risk to the privacy rights and freedoms of End Customers, Thanks will provide such reasonable and timely assistance at Partner’s cost as Partner may require in order to conduct a data protection impact assessment.
4.6 Security incidents
Upon becoming aware of a confirmed Security Incident involving Partner U.S. Personal Data, Thanks shall inform Partner without undue delay and provide reasonable information and cooperation as Thanks may reasonably require in order for Partner to fulfill its data breach reporting obligations under U.S. Privacy Law.
4.7 Deletion or return of Partner U.S. Personal Data
Upon termination or expiry of the MPA, Thanks shall (if the Partner so requests) destroy or return to the Partner all Partner U.S. Personal Data (including all copies of the same) in its possession or control (including any Partner U.S. Personal Data residing with a subprocessor) for which Thanks is acting as a Service Provider. This requirement shall not apply to the extent that: (i) Thanks is acting as a Business with respect to Referral Data; (ii) Thanks is required by any U.S. Privacy Law to retain some or all of that Partner U.S. Personal Data; or (iii) Thanks retains Partner U.S. Personal Data for the purposes of establishment, exercise, or defense of legal claims, in which events Thanks shall protect the Partner U.S. Personal Data from any further processing except to the extent required by any law.
4.8 Audit
Upon Partner’s written request, Thanks shall make available to Partner information in its possession that is necessary to demonstrate Thanks’ compliance with the terms of this USDPA and/or allow Partner to conduct reasonable assessments of Thanks’ policies and technical and organizational measures in support of Thanks’ obligations hereunder. Partner must give Thanks reasonable prior written notice of its intention to conduct any such assessment, conduct the assessment during normal business hours, and take all reasonable measures to prevent unnecessary disruption to Thanks’ operations. Partner may not exercise its audit rights more than once in any twelve (12) calendar month period.
4.9 Certification
Thanks certifies that it understands and will comply with the foregoing restrictions.
5. Consents
Where required under U.S. Privacy Law, the Partner shall include the relevant disclosures for the operation of the Thanks Placement to each End Customer; in which case Thanks will provide directions with respect to the form of consent and information about how End Customers’ device information is processed to be included in relevant disclosures.
6. Costs
Each party shall bear its own costs for complying with its obligations under this USDPA, unless otherwise stated, and shall not be entitled to charge any additional fees to the other party for such compliance, except as may otherwise be expressly agreed in writing by the other party.
7. Definitions
In this USDPA:
(i) “Business” means the entity that, alone or jointly with others, determines the purpose and means of processing of personal data, and includes the term “controller” as used in U.S. Privacy Law;
(ii) “Service Provider” means the entity that processes personal data on behalf of a Business, and includes the term “processor” as used in U.S. Privacy Law;
(iii) “U.S. Privacy Law” means the California Consumer Privacy Act, California Privacy Rights Act, Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, Virginia Consumer Data Protection Act, and any other state or federal law relating to the protection of the privacy of United States residents, each of the foregoing upon such law’s effective or implementation date.
ANNEX A TO USDPA
Data Processing Description
This Annex A forms part of the USDPA and describes the data processing that Thanks will perform on behalf of Partner.
Duration of the processing
For the duration of the Agreement, or as required by any applicable law, or for the purposes of legal claims.
Nature and purposes of the processing
Partner U.S. Personal Datapresenting and optimizing relevant offers or promotions to End Customers on Partner’s sites and platforms;concluding offers and promotions set out in Promotional Content;pre-populating End Customer data fields to make online experience more convenient on Partner’s sites and platformsbilling and measurement of offers and promotions, and otherwise providing the Services under the AgreementReferral Data (Thanks as Business)delivering and facilitating offers or promotions, and enabling an End Customer’s uptake thereof
Type of personal data
First Name, Last Name, Email Address, Mobile Number, Zip/Postcode, Age (or DOB), Gender, Transaction Details, Address, Location, Device information
Sensitive personal data (if any)
None.
Categories of Data Subject
End Customers.
Contact points for data protection enquiries
Thanks: privacy@jointhanks.comPartner: As set forth in Section 2 of the MPA.