Data Protection Addendum

This Data Protection Addendum (the “Addendum”) applies to the processing of Personal Data by Watercooler AI Technologies Inc. (“Watercooler AI”) including, without limitation, Personal Data relating to data subjects located in the European Economic Area (“EEA”) or Switzerland (“EU Personal Data”), the United Kingdom (“UK”) (“UK Personal Data”) and individuals located in California (“CA Personal Data”). For this Addendum’s purposes, EU Personal Data and UK Personal Data are collectively referred to as “European Personal Data.”

This Addendum supplements the online Terms of Use or other signed agreement entered into between you (“Customer”) and Watercooler AI for the provision of Watercooler AI’s products and services (the “Services”) to Customer (the “Agreement”) and is incorporated into the Agreement. In the event of a conflict between this Addendum and any other terms in the Agreement, the terms of this Addendum will govern.

“Controller”, “Processor”, “data subject” and “process” have the meanings given in the relevant Data Protection Requirements (as defined below). The term “Supervisory Authority” means (a) in the context of the UK and the UK GDPR (as defined below), the UK Information Commissioner’s Office; and/or (b) in the context of the EEA and EU GDPR (as defined below), the definition of that term in Article 4(21) of the EU GDPR. “Consumer”, “business”, “sale”, and “service provider” shall have the meaning given in the CCPA (as defined below). “Personal Data” means (a) the “personal data” (as defined in GDPR) that Customer provides to Watercooler AI for the provision of the Services and (b) any other information that Customer provides to Watercooler AI for the provision of the Services that constitutes “personal information” under and governed by the CCPA (as defined below). The term “Data Subject Request” means the exercise of rights by a data subject of Personal Data made under and in accordance with applicable Data Protection Requirements. The term “EU Restricted Transfer” means a transfer of EU Personal Data to any person in a Restricted Country, which would be prohibited without a legal basis therefor under Chapter V of the EU GDPR. The term “EU Standard Contractual Clauses” means the standard contractual clauses adopted by the European Commission under Article 46 of the EU GDPR for the transfer of Personal Data from data exporters in the EEA to data importers in third countries. The term “Relevant Body” means (a) in the context of the UK and the UK GDPR, the UK Government; and/or (b) in the context of the EEA and EU GDPR, the European Commission. The term “Restricted Country” means (a) in the context of the UK, a country or territory outside the UK; and/or (b) in the context of the EEA, means a country or territory outside the EEA, that the Relevant Body has not deemed to provide an ‘adequate’ level of protection for Personal Data pursuant to a decision made in accordance with Article 45 of the GDPR. The term “Restricted Transfer” means (a) an EU Restricted Transfer; and or (b) a UK Restricted Transfer, as the context requires. The term “Standard Contractual Clauses” means (a) the EU Standard Contractual Clauses; and/or (b) the UK Standard Contractual Clauses, as the context requires. The term “UK Restricted Transfer” means a transfer of UK Personal Data to any person in a Restricted Country, which would be prohibited without a legal basis therefor under Chapter V of the UK GDPR. The term “UK Standard Contractual Clauses” means the standard contractual clauses adopted by the UK Information Commissioner’s Office and/or the UK Government under Article 46 of the UK GDPR from time to time for the transfer of Personal Data from data exporters in the UK to data importers outside the UK.

As between the parties, with regard to European Personal Data, Customer is a Controller or Processor and Watercooler AI may be either a Processor or a subprocessor for a Customer.

As between the parties, with regard to CA Personal Data, Customer is a business and Watercooler AI is a service provider. A copy of the EU Standard Contractual Clauses as applicable to both the EU and the UK can be found here.

Watercooler AI reserves the right to modify this Addendum in order to comply with applicable law and regulation. To the extent that Watercooler AI modifies this Addendum in order to ensure such compliance, Watercooler AI will provide notice to Customer of the modifications, and Customer’s continued use of the Services will constitute Customer’s agreement to those modifications. Watercooler AI may provide that notice in a variety of ways, including, among other things, sending Customer an email, posting a notice on the Service itself, or by posting the revised Addendum on Watercooler AI’s website and revising the date at the top of this Addendum.

Nature of Data Processing.

The subject matter of the data processing, including the processing operations carried out by Watercooler AI on behalf of Customer and Customer’s data processing instructions for Watercooler AI, will be described in the Agreement, this Addendum, and each statement of work, order form, or equivalent document where Customer orders Services from Watercooler AI, which form integral parts of the Agreement.

Categories of data subjects: Individuals who may use Watercooler AI’s Services as provided to Customer under the Agreement.

Types of Personal Data processed: Personal Data provided by Customer to Watercooler AI in connection with the Agreement, including name, surname, email address, other profile information, and content of messages sent by data subjects in connection with the Services under the Agreement.

Compliance with Laws.

The parties shall each comply with their respective obligations under all applicable laws, regulations, and other legal requirements relating to (i) privacy and data security; and (ii) the use, collection, retention, storage, security, disclosure, transfer, disposal, and other processing of any Personal Data (“Privacy Laws”), including, without limitation, the California Consumer Privacy Act of 2018 (as amended) (“CCPA”). With regard to European Personal Data, the parties will comply with each of their respective obligations under (i) the European Union Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “General Data Protection Regulation” or “EU GDPR”) and any subordinate legislation and regulation implementing the EU GDPR which may apply; and (ii) the EU GDPR as it forms part of United Kingdom law by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended (“UK GDPR”) (collectively, with Privacy Laws, the “Data Protection Requirements”). Together, the EU GDPR and UK GDPR shall be referred to as the “GDPR.” References to “Articles” and “Chapters” of the GDPR shall be construed accordingly.

Customer Obligations.

Customer shall:

3.1

provide instruction to Watercooler AI and determine the purposes and general means of Watercooler AI’s processing of Personal Data on behalf of Customer under the Agreement; and

3.2

comply with its personal data protection, data security and other obligations prescribed by Data Protection Requirements for Controllers by, without limitation, meeting its obligations under Data Protection Requirements to:

establish and maintain a procedure for the exercise of the rights of the individuals whose Personal Data Watercooler AI processes on behalf of Customer;
as required by Data Protection Requirements, provide notice and obtain consent from the individuals whose Personal Data Watercooler AI processes on behalf of Customer;
establish or ensure that another party has established a legal basis for Watercooler AI’s processing of Personal Data contemplated by this Addendum;
process only data that have been lawfully and validly collected and ensure that such data will be relevant and proportionate to the respective uses; and
ensure compliance with the provisions of this Addendum by its personnel and by any person accessing or using Personal Data on its behalf.

3.3

By entering into this Addendum, Customer instructs Watercooler AI to process Customer Personal Data only in accordance with applicable law: (a) to provide the Services; (b) as authorised by the Agreement, including this Addendum; and (c) as further documented in any other written instructions given by Customer and acknowledged in writing by Watercooler AI as constituting instructions for purposes of this Addendum.

Watercooler AI Obligations.

4.1

Watercooler AI, in its capacity as a Processor or subprocessor of Personal Data, shall:

process Personal Data solely for the purposes of providing the Services as described in the Agreement (which shall encompass the processing authorized by Customer’s instructions), and in compliance with the instructions received from Customer and the Agreement;
not sell any CA Personal Data or retain, use or disclose CA Personal Data outside of the direct business relationship between Watercooler AI and Customer;
inform Customer immediately if, in Watercooler AI’s opinion, an instruction from Customer violates applicable Data Protection Requirements;
adopt and maintain appropriate security measures including organizational and technical measures (the “Security Measures“), designed to maintain a level of security appropriate to the risks presented by processing the Personal Data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons;
grant access to Personal Data only to personnel who need such access for the scope of their job duties, and are subject to appropriate confidentiality arrangements;
if it intends to engage one or more third parties acting on its behalf (“subprocessor”) to help it to satisfy its obligations in accordance with this Addendum or to delegate all or part of the processing activities to such subprocessors, (i) remain responsible, and liable, to Customer for the subprocessors’ acts and omissions with regard to data protection; and (ii) enter into contractual arrangements with such subprocessors requiring them to provide a substantially similar level of data protection compliance and information security to that provided for herein. Subject to the requirements of this Section 4.1(6), Customer hereby generally authorizes the engagement of subprocessors. Information about subprocessors is available at https://help.Watercooler AI.ai/en/articles/4120017-do-you-use-any-subprocessors (as may be updated by Watercooler AI from time to time). When any new subprocessor is engaged during the term of the Agreement, Watercooler AI will notify Customer of the engagement by updating this website and providing notice of its update(s) to the website via the Services’ dashboard for Customer’s administrative users, each at least 15 days before the new subprocessor processes Personal Data. If Customer objects to such engagement in a written notice to Watercooler AI within 15 days of being informed thereof on reasonable grounds relating to the protection of Personal Data, Watercooler AI and Customer will work together in good faith to find a mutually acceptable resolution to address such objection. If the parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, Customer may, as its sole and exclusive remedy, terminate the Agreement and cancel the Services by providing written notice to Watercooler AI. If Customer does not object to Watercooler AI’s appointment of a subprocessor during the 15-day period referred to in Section 4.1(6), Customer shall be deemed to have approved Watercooler AI’s engagement and ongoing use of that subprocessor.

4.2

Watercooler AI shall inform Customer without delay if Watercooler AI becomes aware of:

any legally binding request for disclosure of Personal Data by a law enforcement authority; or
any notice, inquiry or investigation by a Supervisory Authority with respect to Personal Data.

4.3

Watercooler AI further agrees to notify Customer of any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data in Watercooler AI’s possession, custody or control (“Personal Data Breach”) without undue delay and in any event within 72 hours of becoming aware of a Personal Data Breach. Personal Data Breaches do not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.

4.4

Watercooler AI shall reasonably assist Customer regarding:

any requests from data subjects in respect of access to or the rectification, erasure, restriction, portability, blocking or deletion of Personal Data. In the event that a data subject sends such a request directly to Watercooler AI, Watercooler AI will direct the data subject to submit such request to Customer directly, and Customer shall be responsible for responding to such requests. Where relevant, Customer acknowledges and agrees, both generally and specifically for the purpose of Clause 10(a) of Module Three of the EU Standard Contractual Clauses, that there are no circumstances in which it would be appropriate for Watercooler AI to notify any third-party controller of any data subject request and that any such notification shall be the Customer’s responsibility;
the investigation of Personal Data Breaches and the notification to the Supervisory Authority and data subjects in respect of such breaches by providing available details of the Personal Data breaches, including steps Watercooler AI has taken to mitigate the potential risks and steps Watercooler AIs recommends Customer take to address the Information Security Incident; and
the preparation of data protection impact assessments and, where applicable, carrying out consultations with any Supervisory Authority.

4.5

If Watercooler AI is required by Data Protection Requirements to process any Personal Data other than as set forth in this Addendum, Watercooler AI shall inform Customer of this requirement in advance of any processing, unless Watercooler AI is legally prohibited from informing Customer of such processing.

Audit; Certification.

Customer may audit Watercooler AI’s compliance with this Addendum up to once per year and on such other occasions as may be required by Data Protection Requirements. Watercooler AI will cooperate with the audit by providing Customer or Customer’s Supervisory Authority with the information and assistance reasonably necessary to conduct the audit. Customer will reimburse Watercooler AI for its reasonable expenses incurred to cooperate with such an audit. The audit must be conducted during regular business hours, subject to an agreed upon audit plan and Watercooler AI’s safety, security or other relevant policies, and may not unreasonably interfere with Watercooler AI’s business activities. Watercooler AI shall not be required to breach any duties of confidentiality in connection with such audit, and Customer may use the audit reports only for the purposes of meeting Customer’s regulatory audit requirements and/or confirming compliance with the requirements of this Addendum.

Data Transfers.

6.1

Watercooler AI is located in the United States and may store and process Personal Data in the United States or anywhere Watercooler AI or its subprocessors maintains facilities. Accordingly, Customer acknowledges that certain Restricted Transfers may be effected under this Addendum. The provisions of this Section 6 shall apply to any such Restricted Transfers (if and as applicable, having regard to the nature of those transfers and the application or otherwise of Chapter V of the EU GDPR and/or UK GDPR).
The Standard Contractual Clauses referred to in this Section 6 shall only have effect if and to the extent permitted and required under the EU GDPR and/or UK GDPR to establish a valid basis under Chapter V of the EU GDPR and/or UK GDPR (if and as applicable) in respect of the transfer to Watercooler AI of Personal Data.

6.2

EU Restricted Transfers.

To the extent that any processing of European Personal Data under this Addendum involves an EU Restricted Transfer, the parties shall comply with their respective obligations set out in the EU Standard Contractual Clauses.
The following modules of the EU Standard Contractual Clauses apply in the manner set out below (having regard to the Customer’s role):
1. Module 2 of the EU Standard Contractual Clauses applies to any EU Restricted Transfer involving processing of European Personal Data in respect of which Customer is a Controller in its own right; and/or
2. Module 3 of the EU Standard Contractual Clauses applies to any EU Restricted Transfer involving processing of European Personal Data in respect of which Customer is itself acting as a processor on behalf of any other person.

6.3

UK Restricted Transfers

To the extent that any processing of UK Personal Data under this Addendum involves an UK Restricted Transfer, the parties shall comply with their respective obligations set out in the UK Standard Contractual Clauses, which are hereby deemed to be entered into and populated in accordance with Section 6.3.
In respect of any UK Standard Contractual Clauses entered into pursuant to Section 6.3,
1. Customer acts as “data exporter” and Watercooler AI acts as “data importer.”
2. The details on pages 1 to 3 of such UK Standard Contractual Clauses shall be populated with the information of the parties as set out in, or determined by, the Agreement.
3. Clause 9 of such UK Standard Contractual Clauses shall be populated as follows: “The Clauses shall be governed by the law of the country of the United Kingdom in which the data exporter is established.”
4. Clause 11(3) of such UK Standard Contractual Clauses shall be populated as follows: “The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the laws of the country of the UK where the data exporter is established.”
5. Appendix 1 to such UK Standard Contractual Clauses shall be populated with the corresponding information set out in Section 1 of this Addendum.
6. Appendix 2 to such UK Standard Contractual Clauses shall be populated by selecting Option 2 and including the following: “The technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) are those established and maintained under Section 4.1 of the Addendum.
In respect of any UK Restricted Transfer involving processing in respect of which Customer is itself acting as a Processor on behalf of any other person, Customer represents and warrants on an ongoing basis, and further undertakes, that it has full and sufficient authority to enter into the UK Standard Contractual Clauses for and on behalf of each such other person.
To the extent that Watercooler AI effects a UK Restricted Transfer to a subprocessor, Watercooler AI shall (and Customer hereby authorized Watercooler AI to) enter into the UK Standard Contractual Clauses as agent for Customer (as “data exporter”) with that subprocessor (as “data importer”). In respect of any such UK Restricted Transfer between Watercooler AI and a subprocessor, Customer acknowledges and agrees that Watercooler AI’s obligation to enter into the UK Standard Contractual Clauses shall be satisfied by the inclusion of the details of the Personal Data in the general description of the “personal data” referred to in any existing or future UK Standard Contractual Clauses entered into by and between Watercooler AI and that subprocessor.

6.4

Notwithstanding the foregoing, the Standard Contractual Clauses (or obligations the same as those under the Standard Contractual Clauses) will not apply to the extent an alternative recognized compliance standard for the lawful transfer of European Personal Data outside the EEA or UK Personal Data outside the UK (e.g., binding corporate rules) applies to the transfer.

Reserved

Term

This Addendum shall remain in effect as long as Watercooler AI carries out Personal Data processing operations on behalf of Customer or until the termination of the Agreement and all associated order forms (and all Personal Data has been returned or deleted in accordance with section 9 below).

Data Return and Deletion.

The parties agree that upon the expiration or termination of the Agreement, Watercooler AI shall securely destroy all Personal Data and, at the request of Customer, certify that it has taken such measures, unless applicable laws prevent Watercooler AI from returning or destroying all or part of the Personal Data disclosed. In such case, Watercooler AI agrees to preserve the confidentiality of the Personal Data retained by it and that it will only actively process such Personal Data after such date in order to comply with the laws it is subject to.

Liability

The total combined liability of either party towards the other party, whether in contract, tort or any other theory of liability, under or in connection with this Addendum and the Standard Contractual Clauses (if entered into as described in Section 6 of this Addendum) combined will be limited to the liability limitations or other liability caps agreed to by the parties in the Agreement.

Notwithstanding the foregoing, nothing in this Section 10 will affect any party’s liability to data subjects under the third-party beneficiary provisions of the Standard Contractual Clauses to the extent the limitation of such rights is prohibited by Privacy Laws or Local Data Protection Laws, where applicable.

Precedence and Application of Standard Contractual Clauses.

In the event of any conflict or inconsistency between:

this Addendum and the Agreement, this Addendum shall prevail to the extent of such conflict or inconsistency; or
any Standard Contractual Clauses that apply pursuant to Section 6 and this Addendum and/or the Agreement, those Standard Contractual Clauses shall prevail in the context of the Restricted Transfer(s) to which they apply to the extent of such conflict or inconsistency; provided that, in order to establish the operational clarity in relation to certain provisions of the Standard Contractual Clauses, it is agreed that the following shall apply:
1. upon Customer’s request under Clause 5(j) of the UK Standard Contractual Clauses that Watercooler AI provide copies of the subprocessor agreements to Customer, Watercooler AI may remove or redact all commercial information and/or any clauses, recitals, schedules, annexes, appendices, etc., unrelated to the UK Standard Contractual Clauses beforehand;
2. when complying with its transparency obligations under Clause 8.3 of the EU Standard Contractual Clauses, Customer agrees that it shall not provide or otherwise make available, and shall take all appropriate steps to protect, Watercooler AI’s and its licensors trade secrets, business secrets, confidential information and/or other commercially sensitive information;

the audits described in Clauses 5(f) and 12(2) of the UK Standard Contractual Clauses and in Clauses 8.9(c) and 8.9(d) of the EU Standard Contractual Clauses shall be performed in accordance with Section 5 of this Addendum and shall be subject to any relevant conditions, limitations or restrictions therein;

in respect of subprocessors
1. any approval by Customer of Watercooler AI’s appointment of a subprocessor that is given expressly or deemed given pursuant to Section 4.1 constitutes Customer’s: (A) prior written consent to Watercooler AI’s appointment of that Ssubprocessor if and as required under Clause 5(h) of the UK Standard Contractual Clauses; and (B) documented instructions to effect onwards transfers to any relevant subprocessors if and as required under Clause 8.8 of the EU Standard Contractual Clauses;
2. for the purposes of Clause 9(a) of the EU Standard Contractual Clauses, the Parties are deemed to have selected Option 2, and the timeframe for advance notice of intended changes is as set out in Section 4.1; and
3. the terms and conditions of Section 4.1 apply generally to Watercooler AI’s appointment and use of subprocessors for the purposes of both sets of Standard Contractual Clauses.
certification of deletion of Personal Data as described in Clause 12(1) of the UK Standard Contractual Clauses and Clauses 8.5 and 16(d) of the EU Standard Contractual Clauses shall be provided upon Customer’s written request; and
the parties agree that the provisions of Section 4.3 satisfy the requirements of the UK Standard Contractual Clauses.