for limited consultancy and creative Services of SuperScale
“Ad” means an individual post or advert within a Campaign;
“Ad Costs” means all costs or amounts paid to the ad networks (including Facebook and Google) to advertise the Game and attract new players via the Campaign Accounts;
“Applicable Privacy and Data Protection Law” means the GDPR, e-Privacy directive No. 2002/58/EC, e-Privacy regulation when and adopted, any applicable EU Member State data protection and privacy laws or implementations, the Swiss Federal Data Protection Act of 19 June 1992, if applicable, UK GDPR and Data Protection Act 2018 if applicable, the CCPA and COPPA if applicable, and any amendments thereof;
“App Stores” mean Apple App Store, Google Play or any other app store or platform specified in the MSA;
“Business Engine” means SuperScale’s know-how, experiences, trade secrets, techniques, methodologies, skills, formulas or generally any knowledge or valuable information, based on its long standing experience with data-based development, testing and improvement of mobile games which is the underlying value and immanent feature of its Services;
“Campaign” shall mean an organised course of action comprising from a series of Ads and/or other Creative Services aimed at promoting or selling of a Game or its features; improving or developing aspects of the Game and/or its technical code, structure, format or layout in order to improve user experience, add additional features and/or comply with requirements as agreed between SuperScale and Client;
“Campaign Accounts” means either: (i) the accounts allocated by the Client to SuperScale; or (ii) SuperScale’s accounts, in each case, at the UA Channel (e.g. Facebook / Google accounts), as specified in the MSA;
“CCPA” means the California Consumer Privacy Act (“CCPA”);
“Fees” means all fees payable by the Client for the Services as set out in the MSA;
“Confidential Information“ means: all information disclosed to the relevant party by or on behalf of theother party in connection with this MSA; know-how, secret processes and inventions disclosed to the relevant party by or on behalf of the other party in connection with the MSA, including in the case of SuperScale, the Business Engine, the Anonymised Data and its associated documentation, know-how, secrets and ancillary information; all other information disclosed to the relevant party by or on behalf of the other party (whether before or after the date of this MSA) which is marked as or has been otherwise indicated to be confidential or which derives value to a party from being confidential or which would be regarded as confidential by a reasonable business person;
“COPPA” US Children’s Online Privacy Protection Act;
“Client IPR” means all Intellectual Property Rights or other proprietary rights in the Game or any materials provided by the Client to SuperScale in connection with the Services (including the Client Data);
“Client Data” means all data (including Client Personal Data), information, applications and other content that the Client provides to SuperScale as part of the Services;
“Creatives” means the content of the Ad or Game including any graphics, pictures, canvases, videos, texts, that delivered by SuperScale as part of the Creative Services;
“Data Processing Agreement” or “DPA” means data processing agreement concluded between the parties as per schedule 1;
“Game” means the mobile game owned, operated, developed or published by the Client for which the Services are requested as set out in the MSA;
“GDPR” means EU regulation No. 2016/679 known as general data protection regulation;
“Intellectual Property Rights” means all intellectual and industrial property rights of any kind whatsoever including patents, supplementary protection certificates, rights in know-how, registered trademarks, registered designs, models, unregistered design rights, unregistered trademarks, rights to prevent passing off or unfair competition and copyright (whether in drawings, plans, specifications, designs and computer software or otherwise), database rights, topography rights, any rights in any invention, discovery or process, and applications for and rights to apply for any of the foregoing, in each case in the United Kingdom and all other countries in the world and together with all renewals, extensions, continuations, divisions, reissues, re-examinations and substitutions;
“SuperScale” means SuperScale, s.r.o., with its seat at Bottova 2A, 811 09, Bratislava, Slovakia, ID No. (ICO): 47 523 697 or any other SuperScale Group Company that is a contractual party under the MSA;
“SuperScale Group Company” means: (i) SuperScale, Sp. Z o.o., with its registered seat at Zacna 2 1, 50-283 Gdańsk, Poland, registered in the register of entrepreneurs of the National Court Register kept by the District Court for Gdańsk-Północ in Gdańsk, VII Commercial Division under KRS No. 0000510468 being the ultimate parent SuperScale entity and/or (ii) any other 100% subsidiary of SuperScale, Sp. Z o.o. or other SuperScale Group Companies, including the subsidiaries established after this MSA was concluded;
“SuperScale IPR” means all Intellectual Property Rights or other proprietary rights in the Services, the Business Engine, Source Materials and SuperScale own software or tools (if any) used in providing the Services; any modifications or updates to these, regardless of whether such modifications or updates are created as part of the Services; and any know how, ideas, methods, processes or techniques which relate to any developments arising out of the provision of or in connection with the Services, but excluding any Client IPR;
“SuperScale Personnel” means any person employed or engaged by any SuperScale, a SuperScale Group Company or a subcontractor of SuperScale or a SuperScale Group Company who is wholly or partly engaged in the performance of SuperScale’s obligations under this MSA whether on an employment-law or business-law basis;
“Services” means the Services to be provided by SuperScale as set out in the MSA as described in the MSA;
“Term” means the period for which the MSA is concluded;
“Source Material” means creatives or IP materials which are bought by SuperScale from 3rd parties other than the Client and/or used by SuperScale as a basis for creation of Creatives delivered to the Client.
1.1. In consideration for the Client’s payment of the Fees, SuperScale shall provide the Services as set out in the MSA. The Client shall co-operate with SuperScale in all matters relating to the Services and shall provide to SuperScale any reasonable assistance required by SuperScale to provide the Services. Services are provided only for Games defined in the MSA.
1.3. The Client acknowledges that in order to benefit from the Services, it is necessary to comply with SuperScale’s advice on the necessary changes to be introduced to the Game by virtue of the Services.
1.4. SuperScale shall have the discretion and right to subcontract any of the Services from any SuperScale Group Company and SuperScale Personnel. SuperScale shall remain responsible for all acts and omissions of its subcontractors and the acts and omissions of those employed or engaged by the subcontractors as if they were its own.
2.1. SuperScale shall invoice the Client for the Fees as specified in the MSA. Fees do not include any Ad Costs which are borne solely by the Client directly. If it is agreed that SuperScale will pay for the Client’s Ad Costs, such Ad Costs are invoiced in addition to the Fees.
2.2. The Client shall pay no later than 30 days after the date of receipt of invoice. Payment shall be made in Euros to such bank account as SuperScale may nominate from time to time.
2.3. The Fees are exclusive of any applicable VAT or any sales tax which shall be added to such amounts pursuant to any local and international tax legislations. The Client shall pay all applicable taxes if invoiced or as may be applicable.
2.4. If the Client fails to duly pay for any invoice, SuperScale may at its sole discretion suspend the provision of the Services on written notice until all outstanding payments are received in full and/or charge the Client interest on such sum from the due date until the date of actual payment (whether before or after judgment) at the rate of 4% above the base rate of the European Central Bank from time to time (substantial remedy for late payment). In addition, SuperScale may immediately terminate the MSA.
3.1. The Client or its licensors shall retain all right, title and interest in and to the Game and Client IPRs. SuperScale shall retain all right, title and interest in the Business Engine and any SuperScale IPRs.
3.2. Licences. SuperScale may only use Client IPR only to the extent necessary and for the purpose of providing the Services to the Client and performing SuperScale’s other obligations hereunder. Subject to the Client’s compliance with the MSA and these terms (including the payment of the Fees), the Client is entitled to translate the advice, recommendations or suggestions provided by SuperScale by virtue of such Services inside the Game’s source code and its appearance and keep such changes in the Game. If SuperScale uses its own UA dashboards, tools or software for Client Data health checks or test, and Data Health checks, the Client has non-exclusive, limited, revocable licence to use such tools during the Term of the MSA and only for the specified Game.
3.3. Business Engine. The Business Engine has been developed in-house by SuperScale and SuperScale Personnel based on long-term experiences with providing Services to the game developers and publishers prior to the cooperation of the parties. The Business Engine may include recommendations, learnings, observations, rules, ideas or advice generally provided by SuperScale to other clients and/or games which are specifically tailored to the Game’s needs by virtue of the Services based on individual assessment. SuperScale protects the Business Engine as its own intellectual property, property, know-how or trade secret and the Client acknowledges the existence of the Business Engine as an immanent feature of any Services as well as its economic value to the Client. Client acknowledges that the Business Engine itself or its features are or can only be registered as SuperScale’s IPR and therefore, the Client agrees not to take any action to challenge, deny or exploit the Business Engine other than through the allowed use of the Services. In jurisdictions where the Business Engine is not recognized as a copyright work, know-how or trade secret, the parties will apply the same level of protection as if it was and the Client will not legally challenge its existence or agreed protection.
3.4. Creatives. Creatives are created, acquired or developed by SuperScale from: (i) Client-owned materials; (ii) 3rd party Source Materials; or (iii) scratch solely by SuperScale’s team; as specified in the MSA. Subject to the Client’s compliance with the MSA and these terms (including the payment of all Fees) SuperScale: a) grants to the Client a non-exclusive, non-transferable, non-sublicensable and revocable licence to use and keep the Creatives created, acquired or developed from 3rd party Source Materials or from scratch by SuperScale; and b) hereby assigns (as a present assignment of future rights) to the Client absolutely with full title guarantee all of its right, title and interest in and to the Creatives created, acquired or developed solely and only from Client-owned materials or any other Creatives which are specifically identified in the MSA as to be owned by the Client (“Exclusive Creatives“). If the Exclusive Creatives cannot be assigned to Client under applicable law, SuperScale to the extent allowed under Applicable Law: (i) waives the right to enforce such rights, and waives all claims and causes of action of any kind against the Client with respect to such rights, and (ii) hereby grants and agrees to grant to the Client an exclusive, irrevocable, perpetual, worldwide, fully paid up and royalty-free license, with rights to sublicense through multiple levels of sublicenses. Where the Creatives are acquired by SuperScale from 3rd party platforms, banks or registries the Client acknowledges that additional licence terms of such 3rd party will apply to the use of such Creatives and the Client agrees to be bound by such terms. The Client shall review such terms before the MSA. The Client agrees that SuperScale is entitled to use Envato Elements (sounds) – licence terms available at https://elements.envato.com/license-terms or any other platforms or banks approved by the Client.
3.5. Restrictions. The Client shall not, without express consent of SuperScale or a separate MSA: (i) copy the changes introduced to the Game by virtue of the Services and/or the Business Engine to other games; (ii) use the Services and/or Business Engine to provide services to third parties; (iii) publish or make available any reports, presentations or materials that materialize or summarize the content of the Services or the Business Engine; or (iv) present, explain, showcase to the public or pass on to the 3rd parties the Business Engine.
3.6. Should the Client breach any terms under this Section 3, SuperScale has the right to revoke the licences granted herein, to immediately suspend or cease to provide the Services and/or terminate the MSA on written notice.
4.1. Subject to following clauses, each Party’s maximum aggregate liability arising out of or in connection with each MSA, whether in contract, tort, misrepresentation, restitution, under statute or otherwise, howsoever caused including by negligence shall be limited to 100% of the total Fees actually paid under such MSA in the 12 months prior to the date on which the first claim under the MSA was made by the other party.
4.2. Nothing in the MSA or these terms will operate to exclude or restrict one party’s liability (if any) to the other for: (a) death or personal injury resulting from negligence; (b) fraud or fraudulent misrepresentation; (c) infringement of any of the other party’s Intellectual Property Rights; (d) in the case of the Client, payment of the Fees.
4.3. Except as expressly stated in the MSA, all warranties, representations and terms and conditions, whether express or implied by statute, common law or otherwise, are excluded to the extent permitted by law. In particular, SuperScale does not provide any warranty or representation, whether express or implied, that the provision of the Services will increase revenue or make the Game more profitable.
5.1. MSA is concluded for term specified in the MSA. In case of a fixed term, MSA cannot be terminated by notice or for convenience by neither party. In case of indefinite term, the notice period is 2 months as of its serving to other party, unless the MSA provides otherwise.
5.2. Either party may terminate the MSA immediately if the other party is in material breach and such breach is irremediable or if the other party commits any remediable material breach and fails to remedy such breach within a period of 10 business day.
5.3. Termination of the MSA does not affect Client’s obligation to pay for the already provided or incurred Services or costs. No already paid Fees or reimbursed costs will be returned by SuperScale in case of any termination.
6.1. Each party shall treat all Confidential Information as strictly confidential and shall only disclose such Confidential Information in the manner and to the extent expressly permitted. A party may disclose Confidential Information: (i) if and to the extent required by law or order of the public authority having jurisdiction; (ii) on a necessary basis and under conditions of confidentiality to the professional advisers or auditors of such party; (iii) if such Confidential Information has come into the public domain other than by a breach of any obligation of confidentiality; (iv) or with the prior written approval of the other party.
6.2. Parties may disclose Confidential Information to their own subsidiaries or affiliates (including SuperScale Group Company), their personnel and representatives who need access to that Confidential Information in order for such party’s obligations to be performed or to defend any claim.
6.3. Save for any Confidential Information in the Business Engine (which shall continue in perpetuity), the restrictions contained in this clause shall continue to apply after the termination or expiry of the MSA five (5) years after termination of the relevant MSA.
7.1. Parties agree on primarily electronic communication and delivery of any notices or related communication regarding the MSA including any termination notice or invoice using the email contact address mentioned in the MSA. The Client can deliver any notice or communication for SuperScale also to [email protected]. Parties may deliver any notice also by registered mail or courier to the registered seat of the other party mentioned in the MSA.
7.2. Parties are obliged to immediately inform each other about change of their contact details. Any notice will be deemed to have been served as of moment of sending when delivered by email or of receipt when delivered by registered mail or courier. If the notice cannot be delivered to the provided contact details, such notice is deemed delivered as of the moment of delivery’s failure.
8.1. To the extent that SuperScale is processing personal data on behalf of the Client as a consequence of providing the Services according to the MSA, then the parties will comply with the Data Processing Agreement set out in Schedule 1 (Data Processing Agreement) under which SuperScale acts as the Client’s data processor.
8.2. Parties acknowledge that SuperScale, as part of providing the Services creates aggregated, anonymised data by way of patterns, trends, knowledge, metadata or other insights: (i) by aggregating Client Data with other data in a de-identified and anonymised manner; and/or (ii) comprising anonymous learnings, logs and data regarding the use by the Client of the Services (jointly as the “Anonymised Data“). The parties agree that SuperScale may use such Anonymised Data for any lawful business purpose during or after the relevant Term (including without limitation to develop, provide, operate, maintain, and improve SuperScale products and services and to create and distribute reports and other materials).
9.1. Publicity. Neither party shall make any announcement, either written or otherwise, in relation to the existence of or subject matter of the MSA, except with the prior written consent of the other party, such consent not to be unreasonably withheld or delayed, except as required by law. The Client hereby agrees that SuperScale can publish general information about collaboration with the Client and general description of the Services provided to the Client on its websites, social media and marketing channels including using the Client’s business name and trademarks as well as name, marks, trademarks or screenshots of the Game.
9.2. Campaigns. By default, all Campaigns shall be managed by SuperScale via the Client’s allocated Campaign Accounts unless otherwise agreed in the MSA. The costs of Ad Costs and incurred by SuperScale are borne directly by the Client. If not agreed otherwise, the Client is obliged to provide to SuperScale login / access details to the Campaign Accounts before commencement of Services. The Campaign Accounts shall only permit SuperScale to create and manage Campaigns for the Game and SuperScale shall only access and use the Campaign Accounts to perform the Services. If the parties agree in the MSA that SuperScale’s Campaign Accounts shall be used, then SuperScale shall pay for Ads and subsequently recoup the costs of Ads from the Client as an addition to the agreed Fees. Ad Costs due to the UA Channels are not included in the Fees and shall be invoiced to the Client in addition.
9.3. Survival. Any provision of this MSA or these terms that expressly or by implication is intended to come into or continue in force on or after termination or expiry of this MSA shall remain in full force and effect including but not limited to clauses 3, 4, 6, 7 and 8.
9.4. Severance. If any term under MSA or hereunder is or becomes invalid, illegal or unenforceable, the parties shall negotiate in good faith to amend such provision so that, as amended, it is valid, legal and enforceable, and, to the greatest extent possible, achieves the intended commercial result of the original provision. If such modification is not possible, the relevant term shall be deemed deleted. Any modification to or deletion of a term shall not affect the validity and enforceability of the rest of this MSA or terms.
9.5. Governing law and jurisdiction. The MSA and any disputes or claims arising out of or in connection with it or its subject matter or formation shall be governed by and construed in accordance with Slovak law. The parties irrevocably agree that the Slovak courts shall have non-exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this MSA or these terms. In addition, each party may initiate arbitration administered by London Court of Arbitration under its LCIA Rules, and judgment on the award(s) rendered by the arbitrator(s) may be entered in any court having jurisdiction thereof. The place of the arbitration shall be London and the language of the arbitration shall be English. If a court action has been initiated by the Client at the time that SuperScale chooses to submit the matter to arbitration, then it is agreed that such court action is to be discontinued, unless the arbitrator finds that SuperScale has waived such right by substantially participating in the court action without having raised its right under this clause. Nothing in this MSA shall prevent, restrict or hinder a party from taking proceedings to protect its Intellectual Property Rights in any jurisdiction.
9.6. Amendments. These Terms may be updated and amended unilaterally by SuperScale from time to time with the effect as of their publishing at www.superscale.com/platform-terms or at different domain determined by SuperScale. New version of the Terms is effective as of their publishing or as of the later effective date specified there in. Since the MSA provisions prevail over the Terms (including their future amendments), such amendments cannot without Client’s consent alter business terms agreed upon in the MSA.
9.7. Assignment. Neither the MSA nor any of the rights, interests or obligations hereunder shall be assigned by any of the parties hereto without the prior written consent of the other party, except by operation of law and except for assignment to a new entity in case of any merger, acquisition, fusion, sale of substantially all assets, or corporate re-organization.
Schedule 1 – Data Processing Agreement
This Data Processing Agreement is made as an integral part of the MSA by and between the Client as the data controller and SuperScale as its data processor with regards to the processing of personal data by SuperScale on behalf of the Client within the context of provision of Services under the MSA pursuant to the Article 28 of the GDPR. Terms used in this Data Processing Agreement shall be interpreted in line with Article 4 of the GDPR.
- Subject-matter. The Client hereby appoints SuperScale as its data processor to process the personal data on its behalf. Each party shall comply with its obligations under the Applicable Privacy and Data Protection Law.
- Duration and termination. This DPA forms an inseparable part of the MSA. The Client acknowledges that it might be impossible to provide Services in accordance with the MSA without processing the personal data pursuant to this DPA. Therefore, this DPA can only be terminated by termination of the MSA as a whole. Upon termination of the MSA, SuperScale shall at the choice of the Client either return or securely delete all personal data processed under such MSA, unless there is a requirement or entitlement to store such data longer under the EU law or the EU member state law that applies to SuperScale. If the personal data is only processed via Campaign Accounts, removal of access rights to such Campaign Accounts is compliant with previous sentence.
- Nature of processing. The nature of personal data processing under this DPA is determined by the nature of Services provided by SuperScale with the following characteristics: (i) the business model of SuperScale is not based on data monetization techniques like brokerage of data or databases or selling of data to third parties (there will be no sale of personal data under CCPA); (ii) SuperScale respects ownership-like rights regarding the personal data by the Client and/or data subjects, where such personal data falls under the Client Data; (iii) processing of personal data shall only be made as far as necessary to provide the Services; (iv) SuperScale does not have a direct contractual relationship with data subjects; (v) the processing should generally appear as done by the Client as the principal / data controller; (vi) SuperScale does not have access to all data held by the Client or third party, which can be used for the potential identification of users pursuant to the recital 26 of the GDPR.
- Purposes of personal data processing. The Client appoints SuperScale to process the personal data for the following purposes of processing undertaken by the Client: (i) product improvement purposes, e.g. improvement, development, maintenance and testing of the app/software (the Game) and its new features or updates; (ii) direct marketing communication, conducting marketing campaigns and related marketing analytics; and (iii) raising awareness about the organization, its products and services online including via social media, as necessary to provide the Services.
- Types of personal data. Parties do not foresee processing of special categories of personal data pursuant to the Article 9 of the GDPR or personal data about criminal convictions pursuant to the Article 10 of the GDPR. SuperScale is entrusted to process any standard type of personal data it deems necessary to provide the Services. Depending of the type of Services provided by SuperScale, types of personal data processed by SuperScale may include data such as online gaming or advertising identifiers, Game usage data (such as IAP, Game installs), operating system, device, location, session details (duration, frequency), ads or campaign served, user profile/segment and similar types of personal data which do not allow SuperScale to directly identify the data subject but in the context most likely qualifying as personal data under the GDPR. The above description relates to data processed via Campaign Accounts. It might be possible that SuperScale will not have access to any raw data.
- Categories of data subjects. The personal data processed by SuperScale will primarily relate to users, potential users of the Game, visitors or potential visitors of the Client’s websites, games and social media profiles.
- Sub-processors. As a data processor, SuperScale is not entitled to appoint another sub-processor or a third party to process the personal data without the Client’s prior consent or general authorization. The Client gives its consent to the use of SuperScale Group Companies, SuperScale Personnel and approved sub-contractors, provided SuperScale ensures that the data processing agreement is adequate with this DPA is concluded with such sub-processors.
- Campaign Accounts. In case SuperScale is granted access to the Client’s Campaign Accounts (which may or may not include processing of Personal Data) it remains responsibility of the Client to comply with Article 28 of the GDPR and to conclude a data processing agreement with such 3rd party provider of Campaign Account (e.g. Facebook), if required. In such case, SuperScale is entitled to share data with such 3rd party Campaign Account providers without a data processing agreement with such 3rd parties based on the Client’s instruction or general authorization pursuant to this DPA. However, where the Client instructs SuperScale as per the MSA to use SuperScale’s own Campaign Account, the Client hereby warrants, agrees and acknowledges that such an instruction is an instruction of the Client as a data controller pursuant to Art. 29 of the GDPR addressed to SuperScale as a processor and even if SuperScale concluded data processing agreement with such 3rd party Campaign Account provider as a controller, it acts as a processor of the Client and 3rd party Campaign Account provider therefore acts as the Client’s sub-processor. Therefore, this DPA applies equally to situations where Client’s or SuperScale’s Campaign Accounts are used, meaning that the Client remains liable for having a sufficient legal basis for processing of personal data as well as for any other controller’s obligations pursuant to the Applicable Privacy and Data Protection Laws. In case of conflict between 3rd party Campaign Accounts providers’ terms or agreements (even if concluded by SuperScale) and conditions and this DPA, parties will apply terms of this DPA.
- Cross-Border Transfers. As a data processor, SuperScale is not entitled to transfer the Personal Data outside the European Economic Area without the Client’s prior consent. If the Client’s consent is obtained, it remains the responsibility of SuperScale to ensure that Articles 44-50 of the GDPR in respect to any such potential cross-border transfers are complied with. Subject to these conditions, the Client hereby gives SuperScale a general written authorization / documented instruction to transfer the personal data from the European Economic Area to the United States of America or the United Kingdom or other 3rd countries where the approved sub-processors are located. Where the Client is established outside the European Economic Area, parties agree to conclude specific EU standard contractual clauses separately.
- Documented Instructions. SuperScale shall process the personal data only in accordance with documented instructions by the Client. Certain general authorizations and documented instructions are already contained in this DPA which are hereby given by the Client to SuperScale. Any other general authorizations or documented instructions of the Client can be given to SuperScale in writing, orally, by email, by post, by telephone or by similar means, provided such means can be documented. It remains the responsibility of the Client to record or document such instructions. SuperScale is obliged to inform the Client if it believes that the Client’s instruction would infringe the GDPR or other law. If SuperScale believe the Client’s instruction might breach the Applicable Privacy and Data Protection Laws or other laws, SuperScale may terminate the MSA immediately.
- Local Law. The Client shall inform SuperScale about any local deviances or country specific provisions of the Applicable Privacy and Data Protection Laws where such provisions do not explicitly stem, are contrary or are different to those in the GDPR and/or ePrivacy directive. Unless SuperScale receives such information from the Client sufficiently upfront, it shall not be obliged to comply with such a requirement.
- Data Subject Rights. According to Article 28(3)(e) of the GDPR, SuperScale acting as a data processor shall insofar as this is possible and taking into account the nature of the processing, assist the Client as a data controller, with the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights under the GDPR. SuperScale will comply with this obligation by providing supporting information available to it upon request of the Client. Such supporting information may include an updated list of sub-processors, recipients and respective third countries. However, SuperScale shall not be obliged or requested to handle or respond to the data subject request regarding the Client’s purposes of processing, such requests should be handled and responded to exclusively by the Client. Should SuperScale receive a data subject request that is related to this DPA, SuperScale will forward such request to the Client without undue delay.
- Legal Grounds. The legal grounds for processing of the personal data pursuant to this DPA are determined by the Client and are subject to change mainly due to a possibility of a different regulatory approach by different EU supervisory authorities. The Client relies on the legal ground of legitimate interest under the Article 6(1)(f) of the GDPR, performance of contract under the Article 6 Article 6(1)(b) of the GDPR and/or data subject’s consent under the Article 6(1)(a) of the GDPR where required. It remains the sole responsibility of the Client to comply with Article 6 GDPR and to obtain consent of the data subjects, where required. SuperScale relies on the Client to have sufficient legal grounds to undertake processing via SuperScale foreseen by this DPA.
- Confidentiality. SuperScale shall implement such organizational measures that ensure that ensure all SuperScale Personnel is committed to the confidentiality in respect to the personal data processed under this DPA either contractually, by law or by internal policies.
- Security. SuperScale will maintain, implement and enforce safety and security procedures in performing the Services that are: equal to or better than industry standards for such Services, but in any case, in accordance with a reasonable standard of care; and are compliant with the requirements of the Applicable Privacy and Data Protection Law, to protect the personal data (i) from accidental or unlawful destruction, and (ii) loss, alteration, unauthorised disclosure of, or access to the personal data (a “Security Incident”).
- Security incidents. If it becomes aware of a confirmed Security Incident, SuperScale shall inform the Client without undue delay and shall provide reasonable information and cooperation to the Client so that the Client can fulfil any data breach reporting obligations it may have under (and in accordance with the timescales required by) Applicable Privacy and Data Protection Laws. SuperScale shall further take such any reasonably necessary measures and actions to remedy or mitigate the effects of the Security Incident and shall keep the Client informed of all material developments in connection with the Security Incident.
- Audits. SuperScale shall make available to the Client all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and the Client may request, upon 20 days’ prior written notice to SuperScale auditing SuperScale’s compliance with its obligations under this DPA and the GDPR. Audits shall be subject to all applicable confidentiality obligations agreed to by the Client and SuperScale and shall be conducted in a manner that minimizes any disruption of SuperScale’s performance of Services and its normal business operations. Audits shall not uncover or lead to disclosing any Confidential Information. Any costs for undertaking audits or making available to the Client all information necessary to demonstrate compliance with Article 28 of the GDPR shall be borne by the Client including reasonable attorney fees expended by SuperScale.
- Data Protection Impact Assessment. Client remains solely responsible for conducting the data protection impact assessment pursuant to Article 35 of the GDPR and prior consultation pursuant to Article 36 of the GDPR with respect to its own purposes of processing. SuperScale agrees to reasonably assist the Client when conducting its own DPIA.