Our Data Processing Addendum

This Data Processing Addendum forms part of the Vizzy Customer Terms and Conditions which apply to the Vizzy Customer Agreement between Vizzy and Customer.

This Data Processing Addendum sets out the terms on which Vizzy may process personal data comprised in (a) User Data as a Controller and (b) Customer Data as a Processor for or on behalf of the Customer who is the Controller of User Data and Customer Data.

1. Definitions

Capitalised terms used but not defined in this Data Processing Addendum have the meaning given to them in the Vizzy Customer Terms and Conditions and all rules of interpretation as set out in the Vizzy Customer Terms and Conditions shall apply in this Data Processing Addendum.
The following additional definitions shall apply in this Data Processing Addendum:
1. Appropriate Safeguards: means such legally enforceable mechanism(s) for transfers of Personal Data as may be permitted under the Data Protection Laws from time to time, including the UK International Data Transfer Agreement, or the UK International Data Transfer Addendum along with the EU Standard Contractual Clauses (as applicable), or any other mechanisms as set out in Article 46 of the GDPR.
2. Business Purposes: the services to be provided by Vizzy to the Customer as described in the Vizzy Customer Agreement and any other purpose specifically identified in ANNEX A.
3. Commissioner: the Information Commissioner (see Article 4(A3), UK GDPR and section 114, DPA 2018).
4. Controller, Processor, Data Subject, Personal Data, Personal Data Breach and Processing: have the meanings given to them in the Data Protection Laws.
  EEA: the European Economic Area.
  EU Standard Contractual Clauses: means the standard contractual clauses approved by the European Commission in Commission Decision 2021/914 dated 4 June 2021, for transfers of Personal Data to third countries not otherwise recognized as offering an adequate level of protection for Personal Data by the European Commission (as amended and updated from time to time).
5. Records: has the meaning given to it in clause 11 of Part B.
6. Third Country: means a country or territory that is not part of the United Kingdom or the EEA.
7. UK International Data Transfer Addendum: means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, Version B1.0, in force as of 21 March 2022.

Part A – User Data (Independent Controllers Relationship)

Role of the Parties
For the purposes of the Data Protections Laws, in respect of User Data, Vizzy and Customer each act as independent Controllers of Personal Data comprised in User Data and such Personal Data shall be processed by both parties in accordance with this Part A and the Data Protections Laws.
Obligations of the Parties
1. Each party acknowledges and agrees that:
  1. save as is required by this Part A, each party is responsible for its own compliance with Data Protection Laws;
  2. in regard to Vizzy’s use of Personal Data comprised in User Data, Vizzy’s Privacy Policy shall apply and in regard to Customer’s use of Personal Data comprised in User Data, Customer’s own privacy notice from time to time shall apply, which it shall be solely responsible for providing to Data Subjects;
  3. in the event that a Data Subject makes a request to either party to exercise one or more of the rights afforded to Data Subjects under Data Protection Laws, then to the extent that either party reasonably requires input or assistance from the other party in order to give effect to any of the rights afforded, that other party shall provide all such input or assistance within a reasonable timeframe with each party meeting their own costs in doing so;
  4. in the event that a party effected by any accidental or intentional damage, alteration, destruction, unauthorised disclosure, loss, misuse or theft of or to Personal Data (“Security Incident”) such affected party must promptly (and in any event within 48 hours of the affected party or its employees or contractors becoming aware of the matter) notify the other party of the Security Incident. The affected party shall provide full cooperation and prompt assistance to the other party in respect of its efforts to (i) investigate, remediate, and mitigate the effects of the Security Incident, and (ii) comply with notification obligations to Data Subjects and/or regulatory authorities;
  5. each party must not do, or omit to do, and must ensure that its personnel and other representatives do not do or omit to do, anything that would cause (or may be reasonably expected to cause) the other party to be in breach of any provision of any Data Protection Laws and take all reasonable steps to ensure the reliability of its employees, contractors and agents who may have access to the Personal Data and ensure that such staff and agents are informed of the confidential nature of the Personal Data and have undertaken training in the laws relating to handling Personal Data;
  6. each party agrees to implement and maintain appropriate technical and organisational measures in respect of its processing of the Personal Data sufficient to comply with the Data Protection Laws and to protect the Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, damages, theft, alteration or disclosure; and
  7. should either party, its affiliates or its suppliers need to transfer Personal Data to Third Countries, such party takes full responsibility (and accepts full liability) for ensuring that such Personal Data is processed fully in compliance with Data Protection Laws.
2. With regards to User Data, Customer shall, and shall procure that its Authorised Users shall, comply with the Data Protection Laws in connection with the Vizzy Services.
Cross-border transfers of Personal Data
1. Where the Customer is located in a Third Country that the United Kingdom has not recognised as providing adequate protection, any transfer of Personal Data from Vizzy to the Customer shall be subject to the terms set forth in Annex C of this Data Processing Addendum.

Part B – Customer Data (Controller to Processor Relationship)

Personal data types and processing purposes
The Customer and Vizzy agree and acknowledge that for the purpose of Data Protection Laws:
1. the Customer is the Controller and Vizzy is the Processor;
2. the Customer retains control of the Personal Data and remains responsible for its compliance obligations under the Data Protection Laws, including but not limited to, providing any required notices and obtaining any required consents, and for the written processing instructions it gives to Vizzy; and
3. ANNEX A describes the subject matter, duration, nature and purpose of the processing and the Personal Data categories and Data Subject types in respect of which Vizzy may process the Personal Data to fulfil the Business Purposes.
Vizzy’s obligations
1. Vizzy will only process the Personal Data to the extent, and in such a manner, as is necessary for the Business Purposes in accordance with the Customer's written instructions. Vizzy will not process the Personal Data for any other purpose or in a way that does not comply with this Data Processing Addendum or Data Protection Laws. Vizzy must promptly notify the Customer if, in its opinion, the Customer's instructions do not comply with Data Protection Laws.
2. Vizzy must comply promptly with any Customer written instructions requiring Vizzy to amend, transfer, delete or otherwise process the Personal Data, or to stop, mitigate or remedy any unauthorised processing.
3. Vizzy will maintain the confidentiality of the Personal Data and will not disclose the Personal Data to third parties unless the Customer or this Data Processing Addendum specifically authorises the disclosure, or as required by domestic or EU law, court or regulator (including the Commissioner). If a domestic or EU law, court or regulator (including the Commissioner) requires Vizzy to process or disclose the Personal Data to a third-party, Vizzy must first inform the Customer of such legal or regulatory requirement and give the Customer an opportunity to object or challenge the requirement, unless the domestic or EU law prohibits the giving of such notice.
4. Vizzy will reasonably assist the Customer, at no additional cost to the Customer, with meeting the Customer's compliance obligations under the Data Protection Laws, taking into account the nature of Vizzy’s processing and the information available to Vizzy, including in relation to Data Subject rights, data protection impact assessments and reporting to and consulting with the Commissioner or other relevant regulator under the Data Protection Laws.
5. Vizzy must notify the Customer promptly of any changes to the Data Protection Laws that may reasonably be interpreted as adversely affecting Vizzy’s performance of the Vizzy Customer Agreement or this Data Processing Addendum.
Vizzy’s employees
Vizzy will ensure that all of its employees:
1. are informed of the confidential nature of the Personal Data and are bound by written confidentiality obligations and use restrictions in respect of the Personal Data;
2. have undertaken training on the Data Protection Laws and how it relates to their handling of the Personal Data and how it applies to their particular duties; and
3. are aware both of Vizzy’s duties and their personal duties and obligations under the Data Protection Laws and this Data Processing Addendum.
Security
1. Vizzy must at all times implement appropriate technical and organisational measures against accidental, unauthorised or unlawful processing, access, copying, modification, reproduction, display or distribution of the Personal Data, and against accidental or unlawful loss, destruction, alteration, disclosure or damage of Personal Data by using secure methods as agreed and set out in ANNEX B.
2. Vizzy must implement such measures to ensure a level of security appropriate to the risk involved, including as appropriate:
  1. the pseudonymisation and encryption of Personal Data;
  2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
  3. the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and
  4. a process for regularly testing, assessing and evaluating the effectiveness of the security measures.
Personal data breach
1. Vizzy will without undue delay notify the Customer in writing if it becomes aware of:
  1. the loss, unintended destruction or damage, corruption, or unusability of part or all of the Personal Data. Vizzy will restore such Personal Data at its own expense as soon as possible.
  2. any accidental, unauthorised or unlawful processing of the Personal Data; or
  3. any Personal Data Breach.
2. Where Vizzy becomes aware of (a), (b) and/or (c) above, it will, without undue delay, also provide the Customer with the following written information:
  1. description of the nature of (a), (b) and/or (c), including the categories of in-scope Personal Data and approximate number of both Data Subjects and the Personal Data records concerned;
  2. the likely consequences; and
  3. a description of the measures taken or proposed to be taken to address (a), (b) and/or (c), including measures to mitigate its possible adverse effects.
3. Immediately following any accidental, unauthorised or unlawful Personal Data processing or Personal Data Breach, the parties will co-ordinate with each other to investigate the matter. Further, Vizzy will reasonably co-operate with the Customer at no additional cost to the Customer, in the Customer's handling of the matter, including but not limited to:
  1. assisting with any investigation;
  2. providing the Customer with physical access to any facilities and operations affected;
  3. facilitating interviews with Vizzy’s employees, former employees and others involved in the matter including, but not limited to, its officers and directors;
  4. making available all relevant records, logs, files, data reporting and other materials required to comply with all Data Protection Laws or as otherwise reasonably required by the Customer; and
  5. taking reasonable and prompt steps to mitigate the effects and to minimise any damage resulting from the Personal Data Breach or accidental, unauthorised or unlawful Personal Data processing.
4. Vizzy will not inform any third-party of any accidental, unauthorised or unlawful processing of all or part of the Personal Data and/or a Personal Data Breach without first obtaining the Customer's written consent, except when required to do so by domestic or EU law.
5. Vizzy agrees that the Customer has the sole right to determine:
  1. whether to provide notice of the accidental, unauthorised or unlawful processing and/or the Personal Data Breach to any Data Subjects, the Commissioner, other in-scope regulators, law enforcement agencies or others, as required by law or regulation or in the Customer's discretion, including the contents and delivery method of the notice; and
  2. whether to offer any type of remedy to affected Data Subjects, including the nature and extent of such remedy.
6. Vizzy will cover all reasonable expenses associated with the performance of the obligations under 55.1 to 65.3 of Part B unless the matter arose from the Customer's specific written instructions, negligence, wilful default or breach of this Data Processing Addendum, in which case the Customer will cover all reasonable expenses.
7. Vizzy will also reimburse the Customer for actual reasonable expenses that the Customer incurs when responding to an incident of accidental, unauthorised or unlawful processing and/or a Personal Data Breach to the extent that Vizzy caused such, including all costs of notice and any remedy as set out in clause 5.5 of Part B.
Cross-border transfers of personal data
1. Subject to clause 7 of Part B below, the Customer gives Vizzy its general written consent to transfer Personal Data to a Third Country where the relevant Sub-processor:
  1. is in a Third Country that the United Kingdom has recognised as providing adequate protection. The United Kingdom has recognised New Zealand, Japan and Canada as providing adequate protection; or
  2. is a Sub-processor at the date of this Agreement; or
  3. has Appropriate Safeguards in place with Vizzy.
  In each case, the Customer explicitly grants Vizzy a mandate to execute and enforce the Appropriate Safeguards on its behalf against Vizzy's relevant Sub-processors.
2. Where the Customer is located in a Third Country that the United Kingdom has not recognised as providing adequate protection, any transfer of Personal Data from Vizzy to the Customer shall be subject to the terms set forth in Annex C of this Data Processing Addendum.
Sub-processors
1. Other than those Sub-processors as set out in ANNEX A, Vizzy may not authorise any other third-party or Sub-processor to process the Personal Data unless:
  1. the Customer is provided with an opportunity to object to the appointment of each new Sub-processor within (10) working days after Vizzy supplies the Customer with full details in writing regarding such Sub-processor;
  2. Vizzy enters into a written contract with the Sub-processor that contains terms substantially the same as those set out in this Data Processing Addendum, in particular, in relation to requiring appropriate technical and organisational data security measures, and, upon the Customer's written request, provides the Customer with copies of the relevant excerpts from such contracts;
  3. Vizzy maintains control over all of the Personal Data it entrusts to the Sub-processor; and
  4. the Sub-processor's contract terminates automatically on termination of the Vizzy Customer Agreement for any reason.
2. Those Sub-processors approved as at the commencement of the Vizzy Customer Agreement are as set out in ANNEX A. Vizzy must list all approved Sub-processors in Annex A and include any Sub-processor's name and location and the contact information for the person responsible for privacy and data protection compliance.
3. Where the Sub-processor fails to fulfil its obligations under the written agreement with Vizzy which contains terms substantially the same as those set out in this Data Processing Addendum, Vizzy remains fully liable to the Customer for the Sub-processor's performance of its obligations.
4. The Parties agree that Vizzy will be deemed by them to control legally any Personal Data controlled practically by or in the possession of its Sub-processors.
Complaints, data subject requests and third-party rights
1. Vizzy must, at no additional cost to the Customer, take such technical and organisational measures as may be appropriate, and promptly provide such information to the Customer as the Customer may reasonably require, to enable the Customer to comply with:
  1. the rights of Data Subjects under the Data Protection Laws, including, but not limited to, subject access rights, the rights to rectify, port and erase personal data, object to the processing and automated processing of personal data, and restrict the processing of personal data; and
  2. information or assessment notices served on the Customer by the Commissioner or other relevant regulator under the Data Protection Laws.
2. Vizzy must notify the Customer immediately in writing if it receives any complaint, notice or communication that relates directly or indirectly to the processing of the Personal Data or to either party's compliance with the Data Protection Laws.
3. Vizzy must notify the Customer within seven (7) days if it receives a request from a Data Subject for access to their Personal Data or to exercise any of their other rights under the Data Protection Laws.
4. Vizzy will give the Customer, at no additional cost to the Customer, its full co-operation and assistance in responding to any complaint, notice, communication or Data Subject request.
5. Vizzy must not disclose the Personal Data to any Data Subject or to a third-party other than in accordance with the Customer's written instructions, or as required by domestic or EU law.
Term and termination
1. This Data Processing Addendum will remain in full force and effect so long as:
  1. the Vizzy Customer Agreement remains in effect; or
  2. Vizzy retains any of the Personal Data related to the Vizzy Customer Agreement in its possession or control.
2. Any provision of this Data Processing Addendum that expressly or by implication should come into or continue in force on or after termination of the Vizzy Customer Agreement in order to protect the Personal Data will remain in full force and effect.
3. Vizzy’s failure to comply with the terms of this Data Processing Addendum is a material breach of the Vizzy Customer Agreement. In such event, the Customer may terminate any part of the Vizzy Customer Agreement involving the processing of the Personal Data effective immediately on written notice to Vizzy without further liability or obligation of the Customer.
4. If a change in any Data Protection Laws prevents either party from fulfilling all or part of its obligations under the Vizzy Customer Agreement, the parties may agree to suspend the processing of the Personal Data until that processing complies with the new requirements. If the parties are unable to bring the Personal Data processing into compliance with the Data Protection Laws within sixty (60) days, either party may terminate the Vizzy Customer Agreement on not less than thirty (30) working days on written notice to the other party.
Data return and destruction
1. At the Customer's request, Vizzy will give the Customer, or a third-party nominated in writing by the Customer, a copy of or access to all or part of the Personal Data in its possession or control in the format and on the media reasonably specified by the Customer.
2. On termination of the Vizzy Customer Agreement for any reason or expiry of its term, Vizzy will securely delete or destroy or, if directed in writing by the Customer, return and not retain, all or any of the Personal Data related to this Data Processing Addendum in its possession or control, except for one copy that it may retain and use for one year for analytical purposes only.
3. If any law, regulation, or government or regulatory body requires Vizzy to retain any documents, materials or Personal Data that Vizzy would otherwise be required to return or destroy, it will notify the Customer in writing of that retention requirement, giving details of the documents, materials or Personal Data that it must retain, the legal basis for such retention, and establishing a specific timeline for deletion or destruction once the retention requirement ends.
4. Vizzy will certify in writing to the Customer that it has deleted or destroyed the Personal Data within thirty (30) days after it completes the deletion or destruction.
Records
1. Vizzy will keep detailed, accurate and up-to-date written records regarding any processing of the Personal Data, including but not limited to, the access, control and security of the Personal Data, approved Sub-processors, the processing purposes, categories of processing, and a general description of the technical and organisational security measures referred to in clause 4.1 (“Records”) of Part B.
2. Vizzy will ensure that the Records are sufficient to enable the Customer to verify Vizzy’s compliance with its obligations under this Data Processing Addendum and the Data Protection Laws and Vizzy will provide the Customer with copies of the Records upon request.
3. The Customer and Vizzy must review the information listed in the Annexes to this Data Processing Addendum at least once a year to confirm its current accuracy and update it when required to reflect current practices.
Audit
1. Vizzy will permit the Customer and its third-party representatives to audit Vizzy’s compliance with its obligations under this Data Processing Addendum, on at least thirty (30) days' notice, during the term of the Vizzy Customer Agreement. Vizzy will give the Customer and its third-party representatives all necessary assistance to conduct such audits at no additional cost to the Customer. The assistance may include, but is not limited to:
  1. physical access to, remote electronic access to, and copies of the Records and any other information held at Vizzy’s premises or on systems storing the Personal Data;
  2. access to and meetings with any of Vizzy’s personnel reasonably necessary to provide all explanations and perform the audit effectively; and
  3. inspection of all Records and the infrastructure, electronic data or systems, facilities, equipment or application software used to process the Personal Data.
2. The notice requirements in clause 12 of Part B will not apply if the Customer reasonably believes that a Personal Data Breach has occurred or is occurring, or Vizzy is in material breach of any of its obligations under this Data Processing Addendum or any of the Data Protection Laws.
3. If a Personal Data Breach occurs or is occurring, or Vizzy becomes aware of a breach of any of its obligations under this Data Processing Addendum or any of the Data Protection Laws Vizzy will:
  1. promptly conduct its own audit to determine the cause;
  2. produce a written report that includes detailed plans to remedy any deficiencies identified by the audit;
  3. provide the Customer with a copy of the written audit report; and
  4. remedy any deficiencies identified by the audit within thirty (30) days.
Warranties
1. Vizzy warrants and represents that:
  1. its employees, Sub-processors, agents and any other person or persons accessing the Personal Data on its behalf are reliable and trustworthy and have received the required training on the Data Protection Laws;
  2. it and anyone operating on its behalf will process the Personal Data in compliance with the Data Protection Laws and other laws, enactments, regulations, orders, standards and other similar instruments;
  3. it has no reason to believe that the Data Protection Laws prevents it from providing any of the Vizzy Services; and
  4. considering the current technology environment and implementation costs, it will take appropriate technical and organisational measures to prevent the accidental, unauthorised or unlawful processing of Personal Data and the loss or damage to, the Personal Data, and ensure a level of security appropriate to:
    1. the harm that might result from such accidental, unauthorised or unlawful processing and loss or damage;
    2. the nature of the Personal Data protected; and
    3. comply with all applicable Data Protection Laws and its information and security policies, including the security measures required in clause 4.1 of Part B.
2. The Customer warrants and represents that:
  1. Vizzy’s expected use of the Personal Data for the Business Purposes and as specifically instructed by the Customer will comply with the Data Protection Laws;
  2. Where the Customer’s instructions to Vizzy relating to processing of Customer Data or User Data (where the Customer is the Data Controller in relation to that User Data) include instructions to process in a manner involving profiling or automated decision-making, no decision with legal or similarly significant effects on a Data Subject will be made solely on such a basis.
Liability
Liability for breach of this Data Processing Addendum shall be subject to the relevant clauses of the Vizzy Customer Terms and Conditions.
Notice
Any notice or other communication given to a party under or in connection with this Data Processing Addendum shall comply with the relevant terms of the Vizzy Customer Terms and Conditions and Order Form.

ANNEX A. Personal Data processing purposes and details

Subject matter of processing: Personal Data of Authorised Users, being employees, contractors or prospective employees or contractors of the Customer.

Duration of Processing: the period of time in which the Customer receives the Vizzy Services and/or includes the specific prompt to Authorised Users for the collection of that Personal Data.

Nature of Processing: collecting, displaying, using, analysing, publishing and/or presenting the Personal Data in the Platform.

Business Purposes: Vizzy Services and the provision of the Vizzy Platform to the Customer.

Personal Data Categories: name, email address, contact information, image, information relating to work history, experiences, personal opinions, personality details, psychometric information, race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data and/or sexual orientation.

Data Subject Types: employees, contractors, consultants and/or prospective employees, contractors and consultants.

Approved Sub-processors:

Sub-processor	Location	Purpose/service
Nuform Digital Ltd	United Kingdom	Platform Development
SendGrid, Inc. (Twilio)	United States	System e-mails
AWS Cloudwatch	Ireland	Service and RDS APM
AWS Elastic Compute Cloud (AWS – EC2)	Ireland	Node.Js Server
AWS Relational Database Service (RDS)	Ireland	PostgresSQL
Be A Bear Ltd	United Kingdom	Data Visualisation
This Is Squeeze Ltd	United Kingdom	Data Analytics & Visualisation
Google Cloud EMEA Ltd	Ireland	Data Storage and Analytics (BigQuery)
OpenAI LLC	United States	Data Analytics

ANNEX B. Security measures

Vizzy has developed the Vizzy Services with IT security and the Data Protection Laws in mind.
Vizzy has, and will maintain, appropriate technical and organisational measures to ensure the security, integrity, availability and confidentiality of the Personal Data and protect against unauthorised or unlawful processing of the Personal Data and the accidental loss or destruction of, or damage to, the Personal Data, such measures to be appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction of, or damage to, the Personal Data and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures.
Vizzy has the following measures in place:
1. Access Controls - access to the Personal Data by Vizzy personnel is on an “as needed” basis using user and logical based segmentation and controls (including conditional access). Access is granted on a “role/activity based” approach and implements least privilege access mechanisms and segregation of duties. Physical access to Vizzy offices is managed through a strict personnel access process, only approved personnel are provided with access card / apps. All doors and meeting rooms are protected by appropriate access controls;
2. Encryption – encryption of Personal Data in transit;
3. Monitoring and Testing – izzy continuously monitors and tests (a) its security measures to assess their effectiveness for ensuring the security of the processing of Personal Data, and (b) the Vizzy Platform for attacks as well as to ensure that the Vizzy Services and code libraries are up to date, and Vizzy shall maintain records of such testing. Vizzy acts to reasonably remediate any vulnerabilities identified as a result of such monitoring and testing;
4. Input and Transmission Controls – Personal Data is captured in Vizzy’s frontend interface during the profile creation which is secured by SSL. Transmissions of Personal Data are also secured by SSL and authenticated APIs, and stored in a secured and monitored SQL database protected by Amazon Web Services;
5. Data Leakage Prevention Measures – systems are in place to block and prevent any transfer of data that might result in a Personal Data Breach; and
6. Data Backup – Data is backed up according to an agreed backup schedule with Amazon Web Services.
Vizzy has and will maintain adequate data processing, disaster recovery, business continuity and IT security policies and procedures in relation to the processing of Personal Data that meet the requirements under the Data Protection Laws including in the event of any cyber security incidents.
Vizzy shall ensure that all Vizzy personnel involved in the processing of Personal Data are appropriately trained to handle and process the Personal Data in accordance with the technical and organisational security measures set out in this Annex B together with any applicable Data Protection Laws and guidance.
Vizzy personnel are subject to written confidentiality obligations which cover their processing of any Personal Data.

ANNEX C. Cross Border Data Transfer Mechanisms

Where the Customer is located in a Third Country that the United Kingdom has not recognised as providing adequate protection, any transfer of Personal Data from Vizzy to the Customer shall be subject to the (i) EU Standard Contractual Clauses, and (ii) UK International Data Transfer Addendum, which the parties will be deemed to have entered into, and which will be incorporated into the Vizzy Customer Agreement by this reference, and completed as follows:
1. EU Standard Contractual Clauses
  1. Module One (Controller to Controller) of the EU Standard Contractual Clauses will apply where Vizzy and the Customer are both independent Controllers pursuant to Part A of this Data Processing Addendum;
  2. Module Four (Processor to Controller) of the EU Standard Contractual Clauses will apply where Customer is the Controller and Vizzy is the Processor pursuant to Part B of this Data Processing Addendum; and
  3. For each Module, where applicable:
    1. in Clause 7 of the EU Standard Contractual Clauses, the optional docking clause will not apply;
    2. in Clause 9 of the EU Standard Contractual Clauses, Option 2 will apply and the time period for prior written notice of Sub-processor changes will be as set forth in Clause 7.1 of Part B of the Data Processing Addendum;
    3. in Clause 11 of the EU Standard Contractual Clauses, the optional language will not apply;
    4. in Clause 17 (Option 1), the EU Standard Contractual Clauses will be governed by Irish law;
    5. in Clause 18(b) of the EU Standard Contractual Clauses, disputes will be resolved before the courts of Ireland;
    6. in Annex I, Part A of the EU Standard Contractual Clauses:
      Data Exporter: Vizzy
      Contact details: [email protected]
      Data Exporter Role: The Data Exporter’s role is set forth in clause 1 of Part A of this Data Processing Addendum with regards to User Data and clause 1 of Part B of this Data Processing Addendum with regards to Customer Data.
      Signature and Date: By entering into the Vizzy Customer Terms and Conditions, Data Exporter is deemed to have signed these EU Standard Contractual Clauses incorporated herein, including their Annexes, as of the effective date of the Vizzy Customer Terms and Conditions.
      Data Importer: Customer
      Contact details: The email address(es) designated by Customer in the Order Form;
      Data Importer Role: Controller.
      Signature and Date: By entering into the Vizzy Customer Terms and Conditions, Data Importer is deemed to have signed these EU Standard Contractual Clauses, incorporated herein, including their Annexes, as of the effective date of the Vizzy Customer Terms and Conditions;
    7. in Annex I, Part B of the EU Standard Contractual Clauses:
      The categories of Data Subjects and any sensitive data transferred are set forth in Vizzy’s Privacy Policy and Annex A of the Data Processing Addendum (as applicable).
      The frequency of the transfer is on continuous basis for the duration of the Vizzy Customer Agreement.
      The nature and purpose of the processing and the period for which the Personal Data will be retained are set forth in Vizzy’s Privacy Policy and Annex A of the Data Processing Addendum (as applicable).
      For transfers to Sub-processors, the subject matter, nature, and duration of the processing is set forth in Vizzy’s Privacy Policy and Annex A of the Data Processing Addendum (as applicable).
    8. in Annex I, Part C of the EU Standard Contractual Clauses: The Irish Data Protection Commission will be the competent supervisory authority; and
    9. Annex B of the Data Processing Addendum serves as Annex II of the EU Standard Contractual Clauses.
2. UK International Data Transfer Addendum
  1. In Table 1 of the UK International Data Transfer Addendum, Customer's and Vizzy's details and key contact information are set forth in ANNEX C clause 1.1(c) (c)(vi) above;
  2. In Table 2 of the UK International Data Transfer Addendum, information about the version of the Approved EU SCCs, modules, and selected clauses, which the UK International Data Transfer Addendum is appended to, are set forth in ANNEX C clause 1.1 above;
  3. in Table 3 of the UK International Data Transfer Addendum:
    1. the list of Parties is set forth in ANNEX C clause 1.1(c) (vi) above.
    2. the description of the transfer is set forth in clause 5.2. of the Vizzy Customer Terms and Conditions.
    3. Annex II is located in Annex B of the Data Processing Addendum.
    4. he list of Sub-processors is in Vizzy’s Privacy Policy and Annex A of the Data Processing Addendum (as applicable); and
  4. in Table 4 of the UK International Data Transfer Addendum, both the importer and the exporter may end the UK International Data Transfer Addendum in accordance with the terms of the UK International Data Transfer Addendum.
3. To the extent there is any conflict or inconsistency between the EU Standard Contractual Clauses or UK International Data Transfer Addendum and any other terms in the Vizzy Customer Terms and Conditions or the Data Processing Addendum, the provisions of the EU Standard Contractual Clauses or UK International Data Transfer Addendum, as applicable, will prevail.