This Data Sharing Addendum (“DSA“) is incorporated by reference into the Ocean Terms and Conditions Addendum executed between the parties, or if no such Addendum exists, then the online Ocean Terms and Conditions (the addendum or online terms, as applicable being known as “Terms and Conditions”) together with any other agreement governing the provision of the Ocean Services (all such agreements being known collectively as the “Ocean Agreement“) entered by and between the Client and Yotpo to reflect the Parties’ agreement with regard to the Processing of Personal Data by Yotpo and Client. Capitalized terms not defined herein shall have the meaning prescribed to them in the Ocean Agreement. The Parties hereby agree that the terms and conditions set out below shall be added as an addendum integral to the Ocean Agreement.
1. Definitions and Interpretation
In this DSA:
a. “Client Store(s)” means the online assets owned, operated and/or managed by Client, in connection with which the Ocean Services are provided.
b. The terms, “Controller”, “De-identified”, “Processor”, “Processing”, “Selling” (including “Sell” and “Sale”), “Sensitive Data”, ”Targeted Advertising” and “Third Party” shall have the same meanings as in applicable US state laws. The terms “Business”, “Consumer” “Cross-Context Behavioral Advertising” (“CCBA”), “Service Provider”, “Third Party”, “Selling” (including “Sell” and “Sale”), “Sensitive Personal Information”, “Sharing” (including “Share” and “Shared”), and “Business Purpose”, shall have the same meanings as in the California Consumer Privacy Act (“CCPA“).
c. “Data Protection Laws” means all applicable and binding privacy and data protection laws and regulations, including laws and regulations of state and federal laws of the United States of America, as applicable to the Processing of the Personal Data under the Agreement including, without limitation, the CCPA, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, as applicable to the Parties in relation to the Personal Data hereunder and in effect at the time of the Parties’ performance hereunder.
d. “Ocean Services” means Yotpo’s Ocean platform which in exchange for a fee, allows Shoppers to perform activities, such as access their purchase history, track their ongoing shopping orders and carry out additional activities related to past and present shopping activities within Client Stores.
e. “Shopper” means an identified or identifiable natural person to whom the Personal Information relates who interacts with the Services on Client Stores.
f. “Personal Data” or “Personal Information” means any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to or with an identified or identifiable natural person or Consumer, which is processed by a Party, under this DSA and the Agreement.
2. Roles of the Parties
Both Client and Yotpo are Controllers of the Personal Data collected, Processed and Shared under the terms of this DSA. For the avoidance of doubt, Client is a “Business” and Yotpo is a “Third Party”, as those terms are defined in the CCPA. Neither Party is a Processor (or a “Service Provider”) of the other.
3. Purposes of the Processing
Under this DSA, Yotpo may Process (including use, retention and disclosure) Shopper’s Personal Data for the following purposes (“Business Purposes’): (i) Processing of Shopper activity on Client Store for the purpose of providing the Ocean Services; (ii) otherwise Share Personal Data for purposes of Targeted Advertising (or CCBA); (iii) improving the performance of the Ocean Services and developing new features; (iv) rendering Personal Data De-identified in accordance with applicable Data Protection Laws; and (v) as otherwise permitted by applicable Data Protection Laws.
4. Sensitive Data (or “Sensitive Personal Information”)
The Parties agree that Yotpo’s Ocean Services are not intended for the Processing of Sensitive Data.
5. Obligations
a. Obligations of Client. Client shall (i) comply with the obligations applicable to it under Data Protection Laws (ii) at or before the point of collection of Personal Data, provide Shoppers with all required privacy notices, including a description of their privacy rights, under Data Protection Laws (iii) provide Shoppers the right to opt-out of Targeted Advertising, Sale or Sharing of their Personal Data as required by Data Protection Laws, including via industry-standard mechanisms (e.g. Global Privacy Control) (iv) to the extent Client receives requests to opt-out of Targeted Advertising, Sale or Sharing of Personal Information outside of automated mechanisms, inform Yotpo of requests to opt-out without undue delay, and (v) maintain a record of all opt-out requests received from Shoppers.
b. Obligations of Yotpo. For the purpose of providing the Ocean Services, Yotpo (i) acknowledges that Client is making available Shopper Personal Data to Yotpo only for limited and specified purposes set forth in this DSA and further acknowledges that Yotpo is permitted to use such Personal Data only for such limited and specified Business Purposes (ii) shall Process Shopper Personal Data in compliance with applicable Data Protection Law, in a manner that provides the same or materially similar level of privacy protection as required of Client considering the Personal Data Processed and industry standards (iii) as applicable to the Ocean Services provided, implement reasonable security measures as appropriate under Data Protection Laws (iv) as applicable to the Ocean Services provided, cooperate with Client or otherwise enable both Parties to comply with their obligations relating to requests to opt-out of Targeted Advertising, Sale or Sharing of Personal Data, (v) acknowledges that with respect to Shopper Personal Data, Client has the right to take reasonable and appropriate steps to ensure that Yotpo uses such Personal Data in a manner consistent with Client’s obligations under Data Protection Laws, specifically, upon Client’s reasonable prior written request, Yotpo shall provide sufficient information to Client that would allow Client to have a reasonable belief that Yotpo is complying with Data Protection Laws (vi) further acknowledges that Client has the right, upon notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Shopper Personal Data by Yotpo and (vii) shall notify Client if Yotpo makes a determination that it can no longer meet its obligations under Data Protection Laws.
6. General Provisions
a. Governing Law. This DSA is to be construed in accordance with and governed by the laws of the State of New York, United States, without giving effect to its provisions regarding conflict of laws.
b. Modifications. Each Party may by at least forty-five (45) calendar days’ prior written notice to the other Party, request in writing any variations to this DSA solely if they are required as a result of any change in, or decision of a competent authority under Data Protection Laws, to allow Processing of Personal Data to be made (or continue to be made) in accordance with the Agreement or this DSA without breach of those Data Protection Laws. The Parties shall make commercially reasonable efforts to accommodate such modification requested by a Party. The Parties shall promptly discuss the proposed variations and negotiate in good faith with a view to agreeing and implementing those or alternative variations designed to address the requirements identified in the notice as soon as is reasonably practicable. In the event that the Parties are unable to reach such an agreement within 30 days of such notice, then each Party may, by written notice to the other Party, with immediate effect, terminate this DSA and the Agreement.
c. Point of Contact. Each Party shall appoint a single point of contact or contact person who will be responsible for any issue arising under this DSA, including ensuring that such Party complies with this DSA. Yotpo can be contacted at privacy@shopocean.co.
d. Order of Precedence. In the event of any conflict between (i) provisions of this DSA and any other provision of the Ocean Agreement , this DSA shall prevail solely with respect to matters relating to the Processing of Personal Data, otherwise the Terms and Conditions, including its conflict provisions shall control (ii) this DSA and Data Protection Laws, the Data Protection Laws shall prevail.
