Data Processing Agreement

This Data Processing Agreement (“DPA”) is entered into by and between the Client on behalf itself andits Affiliates (the “Client”) and Influ2 Inc., having business address at 1250 Borregas Avenue #44 Sunnyvale, CA 94089, USA (“The Vendor”) on behalf of itself and its Affiliates.

The Effective Date hereof shall be the first date when either the Client accepts the Influ2 Terms of Services (the “Agreement”) through the Website or the Client and Influ2 enter into the Order Form.

This DPA constitutes an integral part of the Agreement and Order Form and is hereby incorporated therein by reference. All the definitions have the same meaning as they are used in the Agreement and Order Form unless they are specially defined hereby.

In addition to capitalized terms defined elsewhere in this DPA, the following terms shall have the meanings set forth opposite each one of them:

1.1. “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control” for purposes of this definition means direct or indirect ownership or control of 75%;

1.2. The terms “Commission”, “Data Subject”, “Member State”, “Personal Data”, “Personal Data Breach”, “Special Categories of Data”, “Process/Processing”, “Controller”, “Processor”, and “Supervisory Authority” shall have the same meanings given to them in the GDPR (or where the same or similar terms are used under another applicable Data Protection Law, the meanings given to such terms under such Data Protection Law).

1.3. “Client’s Personal Data” means any Personal Data processed by the Vendor on behalf of the Client pursuant to or in connection with the Vendor’s Services;

1.4. “Sensitive Personal Data” is a subset of Personal Data, which due to its nature, has been classified by applicable law or by the Client as deserving additional privacy and security protection. Sensitive Personal Data consists of, in particular:

     1.4.1. all government-issued identification documents and numbers (including US Social Security numbers, driver’s license numbers, and passport numbers);

     1.4.2. all financial information, including any consumer or spending habits, and any account numbers (bank and non-bank financial services account numbers, credit/debit card numbers, and other information if that information would permit access to a financial account);

     1.4.3. any Personal Data pertaining to the categories specified in Articles 9-10 of the GDPR;

     1.4.4. all employee, employment candidate and payroll information and data; and

     1.4.5. any other Personal Data designated by the Client as Sensitive Personal

1.5. Data.“Data Protection Laws” means all applicable laws, regulations, and other legal or self-regulatory requirements in any jurisdiction relating to privacy, data protection, data security, breach notification, or the Processing of Personal Data, including without limitation, to the extent applicable, the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”) and its implementing regulations and applicable amendments, the General Data Protection Regulation, Regulation (EU) 2016/679 (“GDPR”), equivalent requirements in the United Kingdom including the UK General Data Protection Regulation and the Data Protection Act 2018 (“UK Data Protection Law”), and the Swiss Federal Act on Data Protection (“Swiss FADP”);

1.6. “EU SCCs” means the standard contractual clauses approved by the European Commission in the EU Commission Implementing Decision 2021/914 dated 4 June 2021, for transfers of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, available at http://data.europa.eu/eli/dec_impl/2021/914/oj and completed as described in the “Data Transfers” section below. Together with UK SCCs, EU SCCs are referred to as the respective Standard Contractual Clauses or SCCs (as appropriate);

1.7. “Instruction(s)” means the directions, either in writing, in textual form (e.g. by e-mail) or by using the Services, issued by the Client to Influ2 and directing Influ2 to Process Personal Data;

1.8. "Sub Processor" means any third party engaged directly by the Vendor to process any the Client’s Personal Data pursuant to or in connection with the Vendor’s Services. The term shall not include employees or contractors (external personnel) of the Vendor;.

1.9. “Client” means the Client (as specified in the relevant Order Form), and any of its Affiliates;

1.10. “Vendor’s Services” means any services provided by the Vendor to the Client, including any software or platform services, pursuant to the Agreement, Order Form, license, subscription, or other legal instruments;

1.11. “Instruction(s)” means the directions, either in writing, in textual form (e.g. by e-mail) or by using the Services, issued by the Client to Influ2 and directing Influ2 to Process Personal Data;

1.12. “UK SCCs” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (available as of the Effective Date at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf), and completed as described in the “Data Transfers” section below. Together with EU SCCs, UK SCCs are referred to as the respective Standard Contractual Clauses or SCCs (as appropriate).

2.1. The Vendor shall process the Client’s Personal Data as described in appendices to the Standard Contractual Clauses attached hereto as Annex. The Vendor shall process the Client’s Personal Data as a data Processor acting on behalf of the Client as the Controller of such Personal Data.

2.2. The Client hereby instructs the Vendor to process the Client’s Personal Data only for the limited purposes of providing the Vendor’s Services to the Client. Under no circumstances shall the Vendor process any the Client’s Personal Data for its own purposes, thereby becoming a data controller of such personal data itself.

2.3. The Vendor shall only process the Client’s Personal Data in accordance with, (i) the terms of this DPA, (ii) the terms of the existing agreement between the Parties, (iii) solely on the Client’s documented instructions, unless processing is required by applicable laws, and (iv) in compliance with the Data Protection Laws and the respective Standard Contractual Clauses incorporated herein.

2.4. The Vendor shall notify the Client if the Vendor determines that it can no longer meet its obligations under this DPA.

3.1. The Vendor shall not subcontract any processing of the Client’s Personal Data to any third party without a prior written consent of the Client of each such subcontracting activity. Notwithstanding the foregoing, the Client authorizes the Vendor to engage a Sub Processor for the limited purposes of processing the Client’s Personal Data, only in the event that the Vendor:

     3.1.1. Provides to the Client at least 30 days prior written notice of its intention to engage or replace a Sub Processor. Such notice shall include at least: (i) the name of the Sub Processor; (ii) type of personal data processed; (iii) description of data subjects and (iv) location of the data processing;

     3.1.2. Conducts the level of due diligence necessary to ensure that such Sub Processor is capable of meeting the requirements of this DPA and Data Protection Laws;

     3.1.3. Ensures that the arrangement between the Vendor and the Sub Processor is governed by a binding contract, which requires a Sub Processor to process the Client’s Personal Data in accordance with this DPA, or standards that are no less onerous of this DPA.

3.2. The Client may object to the engagement of any Sub Processor on any privacy or security grounds. In such case, the Vendor shall not engage a Sub Processor for the provision of the Vendor’s Services to the Client, or the Client may terminate or suspend its agreement with the Vendor without penalty.

4.1. Without limitation by other provisions hereof, the Client acknowledges and consents that: (1) Influ2 is a US-based company with datacenter located within the USA; (2) Personal Data will be stored and processed within the territory of the USA; and (3) Since all media providers listed in ANNEX IV hereto are US-based companies, for launching ad campaigns, the Personal Data will be transferred and further processed by those providers within the territory of the USA.

4.2. By way of this DPA, the Client consents to the transfer of the Client’s Personal Data to the Vendor and each of the entity listed in ANNEX III and ANNEX IV on the basis of the Standard Contractual Clauses. Any transfer made under this DPA, including to any Sub Processor, shall be governed by the respective Standard Contractual Clauses, which shall be deemed incorporated by reference as an integral part of this DPA;

4.3. EEA Transfers. To the extent legally required regarding the Personal Data transferred from the EEA, by signing this DPA, the Parties are deemed to have signed the EU SCCs, which are deemed entered into (and incorporated into this DPA by this reference, except as described in Sections 4.4) and completed as follows: (1) Module Two (Controller to Processor) of the EU SCCs apply when the Client is a controller and Vendor is a processor, and (2) Module Three (Processor to Sub-Processor) of the EU SCCs apply when the Client is a processor and Vendor is a sub-processor. For each module, where applicable, the following applies:

     4.3.1. The optional docking clause in Clause 7 does not apply;

     4.3.2. In Clause 9 (Use of sub-processors), Option 2 (General written authorization) applies. The initial list of sub-processors and third parties are set forth in ANNEX III and ANNEX IV, respectfully, and the minimum time period for prior notice of sub-processor changes shall be 10 days;

     4.3.3. In Clause 11 (Redress), the optional language does not apply;

     4.3.4. In Clause 17 (Governing law), the Parties choose Option 1 (the law of an EU Member State that allows for third-party beneficiary rights). The Parties select the laws of the Republic of Ireland;

     4.3.5. In Clause 18 (Choice of forum and jurisdiction), the Parties select the courts of the Republic of Ireland;

     4.3.6. Appendix 1 to this DPA contains the information required in Annex I Parts (A) and (B) (List of Parties);

     4.3.7. Appendix 1 to this DPA contains the information required in Annex I Part (C) (Competent supervisory authority). The Parties shall follow the rules for identifying such authority under Clause 13 and, to the extent legally permissible, select the Irish Data Protection Commission;

     4.3.8. Annex II to this DPA contains Technical and organizational measures within the EU SCCs.

4.4. UK Transfers. With respect to Personal Data transferred from the UK for which UK law governs the international nature of the transfer, the UK SCCs form part of this DPA and takes precedence over the rest of this DPA as set forth in the UK SCCs. Undefined capitalized terms used in this provision shall mean the definitions in the UK SCCs. For purposes of the UK SCCs, they shall be deemed completed as follows:

      4.4.1. The Parties’ details shall be the Parties and their affiliates to the extent any of them is involved in such transfer;

      4.4.2. The Key Contacts shall be the contacts set forth in the Agreement, including this DPA and all Annexes;

      4.4.3. The approved EU SCCs referenced in Table 2 shall be the EU SCCs as executed by the Parties;

      4.4.4. Annex 1A, 1B, II, and III shall be set forth in Annex I Parts (A) and (B), Annex II, and Annex III below;

      4.4.5. By entering into this DPA, the Parties are deemed to be signing the UK SCCs and agree that the DPA will be governed by the laws of England and Wales and enforced by the courts and relevant supervisory authorities in England and Wales to the extent it covers UK Personal Data processing.

4.5. Swiss Transfers. With respect to Personal Data transferred from Switzerland, the Parties agree that the EU SCCs referenced in Section 4.3 above shall apply, adapted to reflect the Swiss FADP as follows: (1) references to 'Member State' shall be interpreted to include Switzerland for purposes of the protections afforded to Swiss data subjects; (2) the competent supervisory authority under Clause 13 shall be the Swiss Federal Data Protection and Information Commissioner (FDPIC), to the extent the transfer is subject exclusively to the Swiss FADP; and (3) the governing law and courts of Switzerland shall apply for purposes of Clauses 17 and 18, to the extent the transfer is subject exclusively to the Swiss FADP.

5.1. The Vendor shall conduct an appropriate background investigation of all employees or contractors (the “Vendor’s Personnel”) of the Vendor who may have access to the Client’s Personal Data, prior to allowing them such access. If the background investigation reveals that the Vendor’s Personnel are not suited to access the Client’s Personal Data, then the Vendor shall not provide the Vendor Personnel with access to the Client’s Personal Data.

5.2. The Vendor shall ensure that all the Vendor Personnel: (i) has such access only as necessary for the purposes of providing the Client Services and complying with applicable laws; (ii) is contractually bound to confidentiality requirements no less onerous than this DPA; and (iii) is provided with appropriate privacy and security training.

5.3. Upon request, the Vendor shall provide to the Client a list of all individual employees and contractors (including former individual employees and contractors) who have (or have had) access to the Personal Data.

6.1. The Vendor shall assess and implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk presented by the processing of the Client’s Personal Data including:

     6.1.1. The pseudonymization and/or encryption of Personal Data, which in the case of any Sensitive Personal Data, shall be transmitted only via secured encrypted channels and in encrypted form;

     6.1.2. The ability to ensure the on-going confidentiality, integrity, availability and resilience of processing systems and services;

     6.1.3. The ability to restore the availability and access to the Client’s Personal Data in a timely manner in the event of a physical or technical incident; and

     6.1.4. A process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the Processing.

6.2. In assessing the appropriate level of technical and organizational measures, the Vendor shall take into account the risks that are presented by the Processing including the risks of Personal Data Breach, accidental or unlawful loss, destruction, alteration, unauthorized disclosure of or access to the Client’s Personal Data.

6.3. The Vendor shall keep records of its processing activities performed on behalf of the Client, which shall include at least:

     6.3.1. The details of the Vendor as Personal Data Processor, any representatives, Sub Processors, data protection officers and the Vendor Personnel having access to the Client’s Personal Data;

     6.3.2. The categories of Processing activities performed;

     6.3.3. Information regarding cross-border data transfers, if any; and

     6.3.4. Description of the technical and organizational security measures implemented in respect of the processed Personal Data.

7.1. The Vendor shall reasonably assist the Client in responding to requests to exercise Data Subject rights under Data Protection Laws.

7.2. The Vendor shall:

     7.2.1. Promptly notify the Client if it receives a request from a Data Subject under Data Protection Laws in respect of the Client’s Personal Data; and

     7.2.2. Ensure that it does not respond to that request except on the documented instructions of the Client or as strictly required by applicable laws to which the Vendor is subject.

7.3. However, in case of lack of response from the Client, to comply with the terms under the Data Protection Laws, the Vendor is entitled to provide a direct response to the respective data subject requests according to the information that the Vendor operates.

8.1. The Vendor shall notify the Client without undue delay and within 48 hours of the Vendor becoming aware of:

     8.1.1 any legally binding request for disclosure of the Client’s Personal Data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; and

     8.1.2. any actual or suspected Personal Data Breach affecting the Client’s Personal Data. The Vendor shall provide the Client with sufficient information to allow the Client to meet any obligations to report or inform Data Subjects or Supervisory Authorities of the Personal Data Breach under the applicable laws, including any information set out in Article 33(3) of the GDPR. Other than as required by law, the Vendor shall not make any public statements or other disclosures (including any communication to Data Subjects or Supervisory Authorities) about a Personal Data Breach affecting the Client’s Personal Data without the Client’s prior written consent, which is not provided through this DPA.

8.2. The Vendor shall take any actions necessary to investigate any suspected or actual Personal Data Breach and prevent any further Personal Data Breach upon discovery of the same.

8.3. The Vendor shall cooperate with the Client and take such steps as are directed by the Client to assist in the investigation, mitigation and remediation of each such Personal Data Breach.

8.4. The Vendor shall ensure that all the Vendor Personnel are informed of the confidential nature of the Client’s Personal Data and are required to keep it confidential; have undertaken training related to handling Personal Data; and are aware of the Vendor's and their duties and obligations under this DPA.

9.1. Upon expiration or termination of the provision of the Vendor’s Services, the Vendor shall promptly delete or return all copies of the Client’s Personal Data, at the Client’s choice, except as required to be retained in accordance with applicable law.

9.2. Upon the Client’s prior written request, the Vendor Chief Privacy Officer or equivalent shall provide written certification to the Client that it has fully complied with this section.

10.1. The Vendor shall provide assistance to the Client with any data protection impact assessments, prior consultations with Supervisory Authorities or other competent data privacy authorities, which the Client reasonably considers to be required under applicable laws. The scope of such assistance shall be limited to the Processing of the Client’s Personal Data by the Vendor.

11.1. The Vendor shall make available to the Client all information necessary to demonstrate compliance with this DPA and shall allow for and contribute to documental audits in relation to the Processing of the Personal Data. Upon the Client’s request, the vendor shall accurately complete a reasonable information security and data protection questionnaire regarding the Vendor’s data protection and information security practices and policies.

11.2. To conduct any audits, including, inspections (jointly, the “audit”), other than ones listed in Section 11.1, the Client will appoint an independent third-party auditor, who has a professional license to conduct the respective type of audit, bounded by a nondisclosure agreement with Influ2 to carry out the audit of Influ2’s operations and facilities during normal business hours and subject to reasonable prior notice (no less than 30 calendar days) where the Client considers it necessary or appropriate (for example, following instruction from a data protection authority or based on Influ2’s responses to a security questionnaire that reveal a material issue in Influ2’s Security Measures). For the sake of clarity, the audit may cover the processing of the Client’s data only and may not address any other data, such as Influ2’s clients’, vendors’, and employees’ data. The Client will not conduct such an audit more than once in any 12-month period unless an inspection reveals noncompliance herewith. The Client bears all costs corresponding to the audit.

12.1. Severance. Should any provision of this DPA be determined invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall either be (i) amended as necessary to ensure its validity and enforceability, while preserving the Parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.

12.2. Notice. All notices required under this DPA shall be sent to the Client by post to address specified in the relevant Purchase Order and by email to the email address used by the Client to contact the Vendor. Notices to the Vendor shall be sent to: Influ2, 1250 Borregas Avenue #44 Sunnyvale, CA 94089, USA and by email to: privacy@influ2.com. 

12.3. Order of precedence. In the event of any conflict between the terms of this DPA and other documents binding on Parties, the terms of these documents will be interpreted according to the following order of precedence: (i) this DPA; (ii) terms of the Agreement, Order Form, license, or subscription, pursuant to which the Vendor’s Services are provided.

12.4. Affiliate’s Enforcement. Any enforcement action in relation to a unique matter shall be brought by only one entity. No enforcement shall be pursued in a manner that artificially multiplies claims or damages.

12.5. Duration and termination. The duration of this DPA shall correspond to the duration of the Agreement.

Data exporter(s): The Client, in accordance with the relevant PO and Agreement
Activities relevant to the data transferred under these Clauses: submitting personal data to Data importer/Processor by electronic means, without limitation, web-interface, API or other communication channels.
Role (controller/processor): Controller

Data importer(s):
Name: Influ2 Inc
Address: 1250 Borregas Avenue #44 Sunnyvale, CA 94089, USA
Contact person’s name, position and contact details: Anton Yaremenko, DPO, privacy@influ2.com
Activities relevant to the data transferred under these Clauses: running advertising campaigns targeted to specific people according to data provided by Data exporter/Controller.
Role (controller/processor): Processor

Categories of data subjects whose personal data is transferred: Audience selected and specified by Data exporter/Controller, who are subjects to targeted advertising campaigns running by Data importer/Processor to the benefit and on behalf of Data exporter/Controller.

Categories of personal data transferred: Data selected, submitted, uploaded, transmitted, collected, or otherwise made available by or on behalf of the Controller to the Processor for Processing in connection with the provision of the Services, including first and last name, company name, title, business email address and phone number.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: No special categories of data will be processed.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): Continuously.

Nature of the processing: Collection, recording, organisation, structuring, sharing, storage, retrieval, and erasure.

Purpose(s) of the data transfer and further processing: Running advertising campaigns targeted to specific people according to data provided by Data exporter/Controller.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: For the duration of the services agreement between Data exporter/Controller and Data importer/Processor and Data exporter/Controller’s Account or until deletion is properly requested by the Data exporter/Controller, whichever comes earlier. In any case, data that is not further necessary for the purposes of the services agreement will be deleted within technically reasonable time that will not exceed thirty (30) days.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: Running advertising campaigns targeted to specific people on a particular social media platform; retrieval and erasure; the data is transferred in hashed (irreversibly pseudonymized) format and will deleted promptly after the match process is complete.

In accordance with Clause 13 hereof

Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

Measures to prevent unauthorized persons from gaining access to the data processing systems available in premises and facilities (including databases, application servers and related hardware), where Personal Data are processed, including establishing security areas, restriction of access paths; establishing access authorizations for employees and third parties; door locking (electric door openers etc.).

Measures to prevent data processing systems from being used by unauthorized persons including user identification and authentication procedures, ID/password security procedures, encryption of archived data media.

Measures to ensure that persons entitled to use a data processing system gain access only to such Personal Data in accordance with their access rights, and that Personal Data cannot be read, copied, modified or deleted without authorization, including internal policies and procedures, control authorization schemes, differentiated access rights (profiles, roles, transactions and objects); monitoring and logging of accesses, disciplinary action against employees who access personal data without authorization.

Measures to ensure that Personal Data cannot be read, copied, modified or deleted without authorization during electronic transmission, transport or storage on storage media (manual or electronic), and that it can be verified to which companies or other legal entities Personal Data are disclosed, including encryption, logging, transport security. Personal Data is encrypted with AES-256 algorithm at rest and is subject to transfer via HTTPS with TLS 1.3 encryption.

Measures to monitor whether data have been entered, changed or removed (deleted), and by whom, from data processing systems, including logging and reporting systems, audit trails and documentation.

Measures to ensure that Personal Data are protected against accidental destruction or loss (physical/logical) including backup procedures, uninterruptible power supply (UPS), remote storage, anti-virus/firewall systems, disaster recovery plan.

Measures to ensure that Personal Data collected for different purposes can be processed separately including separation of databases, limitation of use, segregation of functions (production/testing).

Measures of annual audit for SOC 2 Type II including security, availability, and confidentiality controls as well as annual penetration testing and constant vulnerability monitoring.

The controller has authorized Influ2 to use the following sub-processors:
1. Cloud-Storage Provider
Name: Google LLC (GCP)
Address: 1600 Amphitheatre Parkway Mountain View, CA 94043
Description: a suite of cloud computing services including management tools and modular cloud services for computing, data storage, and data analytics.

2. Cloud Office and Collaboration Services Provider
Name: Google LLC (Google Workspace)
Address: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Description: Provision of cloud-based business communication, document management, file storage, collaboration and administrative services, including email, calendar, document creation and sharing, cloud storage and video conferencing.

3. Business Communications and Customer Collaboration Provider
Name: Slack Technologies, LLC
Address: 415 Mission Street, San Francisco, CA 94105, USA
Description: Provision of a cloud-based business communication and collaboration platform, including internal messaging, communication channels, file sharing, workflow integrations and related collaboration functionality.

4. Customer Support Services Provider
Name: Zendesk, Inc.
Address: 181 Fremont Street, 17th Floor, San Francisco, CA 94105, USA
Description: Provision of a cloud-based customer support and service management platform used to receive, organize, track, manage and resolve customer support requests and related communications.

5. Customer Support and Communication Provider
Name: Pylon Labs, Inc.
Address: 690 5th Street, San Francisco, CA 94107, USA
Description: Provision of a cloud-based customer support and communication platform used to receive, centralize, manage and respond to customer communications across supported channels, manage support requests and related customer accounts, and support workflow automation.

To perform the Services, Vendor may launch advertising campaigns targeted to Client’s Prospects through the Third-Party Platforms. Consequently, to set up advertising campaigns, Vendor will share Personal Data about such Prospects with the respective Third-Party Platforms. The data will be transmitted to the Third-Party Platforms as hashes, encrypted in transit. According to Section 4.1 of the Principal Agreement (Influ2 Terms of Service), Client hereby authorizes Vendor to use the following Third-Party Platforms to launch ad campaigns and perform the Services:

1. Name: Meta Platforms, Inc.
Address: 1 Hacker Way, Menlo Park, CA 94025, USA
Description of processing: matching of hashed (pseudonymized) personal data with own data collected as a data controller to run advertising campaigns targeted to users of facebook.com or instagram.com websites.

2. Name: LinkedIn Corp
Address: 1000 West Maude Avenue Sunnyvale, CA 94085 USA
Description of processing: matching hashed (pseudonymized) personal data with own data that collected as a data controller to run advertising campaigns targeted to users of linkedin.com website.

3. Name: Google LLC
Address: 1600 Amphitheatre Parkway Mountain View, CA 94043
Description of processing: matching hashed (pseudonymized) personal data with own data that collected as a data controller to run advertising campaigns targeted to users of google.com website and related services.

4. Name: Amazon.com Services LLC
Address: 410 Terry Ave N Seattle, WA, 98109-5210
Description of processing: matching hashed (pseudonymized) personal data with own data that collected as a data controller to run advertising campaigns targeted to users of Amazon Network and related services.

5. Name: Amazon.com, Inc.
Address: 410 Terry Ave N Seattle, WA, 98109-5210
Description of processing: matching hashed (pseudonymized) personal data with own data that collected as a data controller to run advertising campaigns targeted to users of Amazon Network and related services.

6. Name: Microsoft Online, Inc.
Address: 6880 Sierra Center Parkway, Reno, NV 89511 USA
Description of processing: matching hashed (pseudonymized) personal data with data collected by the data controller to run advertising campaigns targeted to users of Bing Search System website and related services.

7. Name: Taboola, Inc
Address: 1115 Broadway, 7th Floor, New York, NY 10010, USA
Description of processing: matching hashed (pseudonymized) personal data with data collected by the data controller to run advertising campaigns targeted to users of the advertising network and related services.

8. Name: Reddit, Inc.
Address: 303 2nd Street, Suite 500S, San Francisco, CA 94107, USA
Description of processing: matching hashed (pseudonymized) personal data with data collected by Reddit as a data controller to create custom audiences and run advertising campaigns targeted to users of the reddit.com website and related services.

9. Name: Yahoo Ad Tech LLC
Address: 770 Broadway, New York, NY 10003, USA
Description of processing: matching hashed (pseudonymized) personal data with data available to Yahoo as a data controller to create and activate audience segments and run advertising campaigns targeted to users across Yahoo properties, the Yahoo advertising network, and third-party inventory available through Yahoo DSP.

Influ2 may enable the Client to connect and authorize third-party customer relationship management, marketing automation, sales engagement and similar platforms (each, an “Integrated CRM Platform”) for use in connection with the Services. When the Client enables an integration, Influ2 may exchange the Personal Data with the Integrated CRM Platform to perform Services under the Agreement. The specific data flows, objects, fields, permissions and direction of transfer depend on the functionality of the relevant integration and the configuration and instructions selected by the Client.

The Client selects and authorizes the Integrated CRM Platform(s) that it wishes to connect and controls the corresponding account, permissions, lists, objects, fields, mappings and other integration settings. For purposes of the processing described in this Annex, and as between the Client and Influ2, the Client acts as the controller and Influ2 acts as the processor. Each Integrated CRM Platform provider is a third party in relation to Influ2 and, to the extent it processes Personal Data through Client’s account on Client’s behalf, acts as a separate processor (or service provider/third party, as applicable) for Client under Client’s separate agreement with that provider. By enabling a respective integration, Client instructs and authorizes Influ2 to access, retrieve, disclose, transmit and otherwise exchange Personal Data with the selected provider as necessary to operate the integration and provide the Services.

Subject to availability at the time of integration, Client may select one or more of the following Integrated CRM Platforms. The legal entity providing a platform may vary based on Client’s jurisdiction or its separate agreement with the provider. Where Client contracts with another affiliate of the listed provider, that affiliate is the relevant Integrated CRM Platform provider for purposes of this Annex.

The Client may also select other compatible platforms made available in Influ2’s then-current list of supported integrations. When the Client enables such an integration, the applicable provider will be deemed an Integrated CRM Platform provider for purposes of this Annex, and Client instructs and authorizes Influ2 to exchange Personal Data with that provider in accordance with Client’s configuration and the DPA.

Depending on the Integrated CRM Platform, the functionality enabled by the Client and the Client’s configuration, the Personal Data processed in connection with an integration may include the following categories:

The categories above are intended to cover the common data elements used across supported integrations and are not necessarily processed through every Integrated CRM Platform. Because the Client selects the provider and configures the available permissions, objects, lists, fields, mappings and data flows, additional Personal Data may be processed where the Client selects, maps or otherwise makes such data available, subject to the DPA and the Client’s instructions.