Data Processing Addendum - Users

In order to provide the Services to its users (“User” or “you”), Wobot Intelligence Private Limited and Wobot Intelligence Inc. (together with its affiliated companies and subsidiaries worldwide (“Wobot”) processes data of customers, prospective customers or visitors of the Users’ site or services (herein: “Users-of-Users”). The processing of such data by Wobot is hereinafter referred to as “Processing”. The following Data Processing Addendum (“DPA”) sets forth the terms of such Processing by Wobot.

This DPA forms part of the Wobot EULA  Privacy Policy (the “EULA Policy”) (the “Privacy Policy”) and any other applicable Wobot terms or agreement governing the use of the Services (collectively, the “Agreement”). The terms of the Agreement shall apply to this DPA as applicable. In any event of contradiction between this DPA and the Agreement, the provisions of this DPA shall govern solely with respect to the Processing of Users-of-Users Information. Any capitalized term not defined herein, shall have the meaning ascribed to it in the Privacy Policy.

To the extent Users-of-Users Information is Processed by Wobot on your behalf you acknowledge and agree that Wobot will process Users-of-Users Information as necessary to provide you with the Services and as further detailed herein, and by using the Services, you instruct Wobot to process such Users-of-Users Information on your behalf pursuant to this DPA.

• For the purpose of this DPA, the following terms have the following meaning:
1. Adequate Country means a country that ensures an adequate level of protection to personal data.
2. Data Protection Laws means all privacy and data protection laws and regulations applicable to Processing of Personal Data of natural persons under this DPA in connection with the Services and any laws or regulations ratifying, implementing, adopting, or supplementing such laws; in each case, to the extent in force, and as such are updated, amended or replaced from time to time.
3. Data Subject means the identified or identifiable person to whom the Personal Data relates.
4. Jurisdiction Specific Terms means terms and conditions that apply to Users who are subject to certain additional jurisdiction-specific data protection laws, as specified in Schedule 1 of this DPA.
5. Users-of-Users Information means Personal Data of Users-of-Users (as such terms is defined in the Privacy Policy) that you submit to Wobot or may otherwise be Processed by Wobot on your behalf.
6. Wobot Security Documentation means the technical and organisational measures Wobot deploys and maintains to protect Users-of-Users Information.
7. Wobot Service(s) means the services that you avail from Wobot, during the course of which Users-of-Users Information is collected and/or processed by Wobot.
8. The terms “Controller”, “Personal Data”, “Personal Data Breach”, “Processing”, and “Processor”, as used in these DPA, shall have the meanings given to them, or to any different but analogous term used in any other Data Protection Laws.

• Roles of the Parties: You acknowledge and agree that with regard to the Processing of Users-of-Users Information performed on your behalf, you are the Controller and Wobot is the Processor of such of such Users-of-Users Information.
• Details of the Processing by Wobot: Wobot will process Users-of-Users Information in order to provide the Services in accordance with the Agreement and this DPA. The nature and purposes of the Processing, its duration, the types of Personal Data Processed and categories of Data Subjects are further specified in Schedule 2 (Details of the Processing) to this DPA.
• Processing by Wobot: When Wobot Processes Users-of-Users Information on your behalf in the course of providing the Service, Wobot shall:
  1. Process Users-of-Users Information only for the following purposes: (i) provisioning the Services to you in accordance with the Agreement and this DPA (including any applicable Jurisdiction Specific Terms), (ii) in accordance with your reasonable documented instructions in this DPA and as may subsequently be instructed by you, to the extent your instructions are compatible with the Services and this DPA; and (iii) as required under the laws applicable to Wobot or subject to a competent authority's requirement, provided that if Wobot is required by law to Process your Users-of-Users Information for any other purpose, Wobot will provide you with prior notice of this requirement, unless Wobot is prohibited by law from providing such notice.
  2. Ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training regarding their responsibilities, and have committed themselves to confidentiality.
  3. Implement reasonable technical and organizational measures to enable you to comply with Data Subject Requests (as defined below) that you are obligated to fulfil.
• Processing by You: When using the Wobot Service, you shall:
  1. Ensure that your submission of Personal Data to Wobot, your instructions for the Processing of Users-of-Users Information by Wobot, and your processing of Users-of-Users Information in your use of the Services will comply with Data Protection Laws.
  2. Establish and have any and all required consents, legal bases and authorizations but not limited to, a prominent display of a notice stating that the Premises is under CCTV recording and any other information as may be required to be displayed as required by Applicable Law, including Data Protection Laws in order to collect, use and otherwise process and transfer to Wobot the Users-of-Users Information, and to authorize the Processing by Wobot, and for Wobot’s Processing activities on your behalf.
  3. In some instances (and when relevant) flag specific data as Personal Data in order for Wobot to treat it as such. You have sole responsibility for the accuracy, quality, and legality of Users-of-Users Information and the means by which it was obtained.
  4. Be solely responsible for any transfer of Users-of-Users Information by you (or any other person operating on your behalf) to any platform other than Wobot, or any other third party.

• General Authorization for use of Sub-processers: You hereby grant Wobot a general authorization to engage sub-processors to Process your Users-of-Users Information in order to provide the Services without obtaining any further written, specific authorization from you, subject to the following conditions:
  1. Wobot will restrict the sub-processor’s access to Users-of-Users Information only to what is necessary to provide the Services, and will prohibit sub-processors from processing Users-of-Users Information for any other purpose.
  2. Wobot’s use of any specific sub-processor to process Users-of-Users Information shall comply with applicable Data Protection Laws and Jurisdiction Specific Terms (if any) and will be governed by a contract between Wobot and such sub-processor that sets forth a level of protection and security to Users-of-Users Information comparable to this DPA.
• Current Sub-processors and Notification of Sub-processor Changes : A current list of sub-processors engaged by Wobot and Wobot subsidiaries that may Process Users-of-Users Information is available (“Wobot Sub-processor List”). Upon your first use of the Services, you acknowledge and deem authorized the Wobot Sub-Processor List effective as of the date of such first use. If you subscribe to such notifications, Wobot will provide you, via your subscribed email, with details of the current Wobot Sub-processor List or any change of its sub-processors as soon as reasonably practicable, and, in any event will notify you no less than seven (7) days prior to such change.

• Objection Right for new Sub-processors: You may reasonably object to the appointment or replacement of a sub-processor by Wobot on documented reasonable grounds relating to data protection, by submitting a written and reasoned objection to Wobot at info@wobot.ai within seven (7) days from the receipt of a change notification in accordance with the mechanism detailed in the previous clause.

  In such an event, Wobot may, in its sole discretion, choose to use commercial reasonable efforts (but is not required to) make available to you an alternative solution to avoid the Processing of your Users-of-Users Information by the new sub-processor you objected to. Until Wobot makes a decision concerning your objection, Wobot may be required to temporarily suspend the Processing of the related Users-of-Users Information, including, if required for this matter, suspend or limit access to your User account or suspend or limit certain features of the Services offered to you.

  If Wobot finds that it is unable to resolve your objection or to provide you with such alternative solution, within thirty (30) days from receipt of your valid reasoned objection, as determined in Wobot’s full and sole discretion (with no obligation to provide any reasoning), you may, as a sole remedy, discontinue the use of the affected Wobot Service(s) by providing written notice to Wobot. Such discontinuation will be without prejudice to any fees incurred by you prior to the discontinuation of the affected Services and you will have no further claims against Wobot in connection with the discontinuation of the affected Service(s). If no objection has been raised to the replacement or appointing a new sub-processor within the above mentioned time frame, Wobot will deem you to have authorized the new sub-processor.

• Security Measures: Wobot has implemented and will maintain industry-standard technical and organizational security measures as required to appropriately ensure the protection of Users-of-Users Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Users-of-Users Information, and the confidentiality and integrity of Users-of-Users Information, including those measures in accordance with the Wobot Security Documentation.

  These measures shall be appropriate to the harm which might result from any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Users-of-Users Information, and the nature and scope of the Users-of-Users Information which is to be protected.

• Your Responsibility: You are responsible for reviewing the information Wobot makes available regarding its data security, and making an independent determination as to whether the Services meet your needs, requirements and legal obligations, including your obligations under applicable Data Protection Laws to ensure the appropriate level of security when using the Services, taking into consideration any risks with respect to Users-of-Users Information.

  You are further responsible for properly configuring the Services and using features and functionalities made available by Wobot to maintain appropriate security in light of the nature of the data processed by your use of the Services. By using any of Wobot’s Services, you agree to the adequacy of the organizational, technical and security measures implemented by Wobot to protect the Users-of-Users Information.

• Security Notifications: Wobot will, to the extent permitted by applicable law, notify you without undue delay, after becoming aware of any Personal Data Breach that affects your Users-of-Users Information, as required under applicable Data Protection Laws. Wobot shall use reasonable efforts to include in such notifications relevant information concerning: the nature of the related breach, the scope and type of affected records and affected Data Subjects, anticipated consequences and details about any remediation and other measures that Wobot has taken and/or intends to take to mitigate any potential negative effects of such breach.

  You acknowledge that Wobot’s notification concerning a Personal Data Breach shall not be deemed or construed as an acknowledgement by Wobot of any fault or liability with respect to such incident. 

  You also acknowledge that in the event of a Personal Data Breach, you may also be obligated to take measures required under applicable Data Protection Laws in connection with your Users-of-Users Information.

• Data Subject Requests: Wobot shall promptly notify you if Wobot receives a request from a Data Subject to exercise the Data Subject's right of access, right to rectification, restriction of Processing, erasure (“right to be forgotten”), data portability, object to the Processing, or its right not to be subject to an automated individual decision making (“Data Subject Request”), unless Wobot is legally prohibited from doing so. Wobot shall assist you, in a timely manner, to the extent you, in your use of the Wobot Service, do not have the ability to address a Data Subject Request, by the appropriate measures and, as reasonably possible (considering the nature of the relevant Processing), in the fulfilment of your obligation to respond to a Data Subject Request under applicable Data Protection Laws, unless Wobot is legally prohibited from doing so.
• Records: Wobot will keep records of its Processing in compliance with applicable Data Protection Laws and provide you with necessary records to demonstrate compliance upon reasonable request.
• Costs: Subject to applicable Data Protection Laws, to the extent any assistance described in this Section E entails material costs or expenses to Wobot, the parties shall first come to agreement on your reimbursement to Wobot of such costs and expenses.

• Deletion of Users-of-Users Information: Upon termination of your use of the Services or your written request submitted through one of the methods detailed in the Privacy Policy, Wobot shall delete your Personal Data and related Users-of-Users Information as soon as reasonably practicable and according to the Agreement and applicable laws.

  Notwithstanding the forgoing, Wobot may retain Users-of-Users Information (or a portion of it), if required under the Agreement or by applicable law or regulation (including applicable Data Protection Laws); provided such Users-of-Users Information remains protected in accordance with the terms of this DPA and applicable Data Protection Laws.

• General: You acknowledge that Wobot may Process Users-of-Users Information anywhere in the world so long as it complies with applicable Data Protection Laws, applicable Jurisdiction Specific Terms and this DPA.
• Appropriate Safeguards for Cross Border Data Transfers:Wobot shall only transfer Users-of-Users Information using the applicable mechanisms required to ensure that the relevant cross-border transfer is in compliance with applicable Data Protection Laws, as follows:
  1. Transfers to Adequate Countries: Transfers of Users-of-Users Information by Wobot to a recipient operating on Wobot’s behalf that is located in an Adequate Country may be undertaken freely (with no need for any other safeguard) subject to applicable Data Protection Laws.
  2. Transfers to Wobot Sub-contractors in Other Countries: Any transfer of Users-of-Users Information by Wobot to a recipient operating on Wobot’s behalf that is located in a country other than an Adequate Country shall be undertaken only in accordance with applicable Data Protection Laws.
  3. Transfers at Your Instructions:  In case of a transfer to a third party that is not a sub-processor of Wobot, which is conducted by Wobot at your instructions, or by you in accordance with an agreement between you and such third-party (which Wobot is not a party to), you shall be solely responsible for the transfer of Users-of-Users Information and its compliance with applicable laws.
  4. If the applicable transfer mechanism is amended, replaced, or otherwise invalidated, Wobot shall enter into any updated version of such mechanism or any alternative mechanism endorsed by the applicable competent authority.

• This DPA shall be in effect for as long as you use any of the Services; provided, however, that in the event Wobot is obligated, according to the terms of this DPA or the Agreement, to keep Users-of-Users Information following the termination of the Services, this DPA shall remain in effect for as long as Wobot holds Users-of-Users Information.
• For avoidance of doubt and to the extent allowed by applicable law, all liability under this DPA, including limitations thereof, will be governed by the relevant provisions of the Wobot EULA.
• You acknowledge and agree that Wobot may amend this DPA as may be required from time-to-time, by posting the relevant amended and DPA on Wobot’s website. Any amendments to the DPA are effective as of the date of posting. Your continued use of the Services after the amended DPA is posted constitutes your agreement to, and acceptance of, the amended DPA.
• If any provision of this DPA deemed by a court of competent jurisdiction to be invalid, unlawful, void, or for any reason unenforceable, then such provision shall be deemed severable and will not affect the validity and enforceability of the remaining provisions.
• Any questions regarding this DPA should be addressed to the Wobot Data Protection Officer at legal@wobot.ai. Wobot will attempt to resolve any complaints regarding the use of your Users-of-Users Information in accordance with this DPA and the Agreement.

• California: Applicable Data Protection Laws and Jurisdiction Specific Terms for California Residents:
  1. The definition of “Data Protection Law” includes the CCPA.
  2. The definitions of “Personal Data”, “Data Subject”, “Controller” and “Processor” includes the definitions “Personal Information”, “Consumer”, “Business”, and “Service Provider”, respectively, all as defined under CCPA.
  3. Wobot will process, retain, use, and disclose personal information only as necessary to provide its Services, which constitutes a business purpose.
  4. Wobot agrees not to: (i) sell (as such terms is defined under the CCPA) Personal Data (including Users-of-Users Information); (ii) retain, use, or disclose Personal Data (including Users-of-Users Information) for any commercial purpose (as defined by the CCPA) other than providing the Services; or (iii) retain, use, or disclose Users-of-Users Information outside of the scope of the Agreement.
  5. Wobot certifies that its sub-processors, as described in Article C of the DPA, are Service Providers under CCPA, with whom Wobot has entered into a written contract that includes terms ensuring at least the same level of protection and security as those set out in this DPA. 
  6. Wobot will implement and maintain reasonable security procedures and practices appropriate to the nature of the Personal Data it processes as set forth in Article D of this DPA.

• Nature and Purpose of Processing: We may use your User-of-User Information for the following purposes (and tasks related to such purposes), all in accordance with the Agreement and in a way that is proportionate and that respects yours and your Users-of-Users privacy rights:
  1. Providing you with the Services.
  2. Acting upon your instructions, including providing you with professional assistance, only upon your request. provided your instructions are consistent with the terms of this DPA and the Agreement.
  3. Performing and enforcing the Agreement and this DPA and other contracts executed by and between us (if any), and defending Wobot’s rights.
  4. Preventing, investigating and mitigating data security risks and incidents, fraud, errors and/or illegal or prohibited activities.
  5. Complying with applicable laws and regulations.
• Duration of Processing: Prior to the termination of your use of the Services, Wobot will process your User-of-User Information in accordance with this DPA and the Agreement until you elect to delete such User-of-User Information (or part thereof) on your own, as you are solely responsible for deleting your User-of-User Information. Upon such termination, deletion of your Users-of-Users Information will be handled by Wobot in accordance with Section 14 (Deletion of Users-of-Users Information) of this DPA.
• Type of Personal Data: Subject to your content restriction obligations under this DPA and the Agreement, you may submit Users-of-Users Information to the Service, in scope and nature that is controlled and determined solely by you.
• Categories of Data Subjects: Subject to your content restriction obligations under this DPA and the Agreement, you may submit Users-of-Users Information to the Service, which may include (but is not limited to), Personal Data relating to the following categories of Data Subjects, all as controlled and determined solely by you: Your existing and prospective employees, candidates, agents, consultants, freelancers, business partners and/or sub-contractors (and their respective employees, contact persons, agents, etc.), who are natural persons;(ii) your existing and prospective customers and end users (and their respective employees, contact persons and agents), who are natural persons; and (iii) any other third party individual with whom you decide to engage through the Wobot Service.