Contact Get Started
Get Started Contact

Data Processing Addendum

Last updated:

This Data Processing Addendum (the "Addendum") forms part of, and is incorporated by reference into, the Bringits Terms of Service (the "Terms") between Bringits Data Ltd., and/or other companies acting on its behalf (collectively, the "Company"), and the entity that is a party to the applicable order form and the Terms with the Company for the provision of the Company's service (the "Customer").

The Company may be involved in processing certain personal data or personal information from publicly available online sources only on behalf of Customer, as part of its software-as-a-service platform for the identification, retrieval, collection, organization, structuring and delivery of such data (the "Service"), pursuant to an order form between Customer and the Company (the "Order Form") and the Terms incorporated within. The parties wish to regulate the Company's processing of such personal data through this Addendum.

This Addendum consists of the following parts:

Part Is it applicable and in force?
Part One – General provisions Always applies and is in force for the Services, to the extent that the Service provided by the Company will involve the processing of individuals’ personal data.
Part Two – EU/EEA or UK GDPR DPA Only if Customer is subject to the UK or EU/EEA GDPR regarding the personal data that the Company processes for it when providing the Services.
Part Three – State Privacy Laws in the U.S. Only if Customer is subject to state privacy laws in the United States of America regarding the personal data that the Company processes for it when providing the Services.
Part Four – Israeli Privacy Protection Regulations (Information Security) Only if Customer is subject to Israeli law regarding the personal data that the Company processes for it when providing the Services.

Part 1 — General Provisions

  1. Scope. This Addendum and any of its Parts apply only to the extent that the Service provided by the Company will involve the processing of individuals’ personal data, on behalf of Customer and based on Customer’s instruction. It does not apply to any data used for the Company’s processing of data to administer the business or contractual relationship between the Company and Customer.
  2. Order of precedence. In the event of any conflicting provisions between this Addendum and the Terms or any other terms in place between the parties, the provisions of this Addendum shall prevail.
  3. Data security. Considering the methods, the costs of implementation and the nature, scope, context and purposes, the Company will implement and maintain reasonable security procedures and practices appropriate to the nature of the personal data, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure (including data breaches).
  4. Data subject requests. The Company will follow reasonable written instructions from Customer to accommodate data subjects’ requests to exercise their rights in relation to their information within the personal data, including accessing their data, correcting it, restricting its processing, or deleting it. The Company will pass on to Customer any requests it receives from data subjects regarding their information processed by the Company, and shall notify Customer of the receipt of such a request without undue delay, together with the relevant details.
  5. Return or deletion of information. Upon Customer’s written request, where no subsequent further processing is required, the Company shall, at the instruction of Customer, either delete, destroy, or return to Customer some or all (however instructed) of the personal information that it and its third-party suppliers process for Customer. Upon Customer’s request, the Company will furnish written confirmation that the personal data has been deleted or returned pursuant to this section.
  6. Disclosure. Unless legally prohibited, the Company will provide Customer prompt notice of any request it receives from authorities to produce or disclose personal data it has processed on Customer’s behalf, so that Customer (or its customer) may contest or attempt to limit the scope of the production or disclosure request.
  7. Data breaches. The Company shall, without undue delay, notify Customer of any actual or reasonably suspected accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data that it becomes aware of. The Company will investigate the breach and take all available measures to mitigate it and prevent its reoccurrence, and will cooperate in good faith with Customer on issuing any statements or notices regarding such breaches to authorities and data subjects.
  8. Subcontracting to suppliers. Customer authorizes the Company to subcontract any of its Service-related activities consisting of the processing of personal data, or requiring personal data to be processed by a third-party supplier, without the prior written authorization of Customer, provided that: (a) the Company shall ensure that the third party is bound by obligations similar to those under this Part 1; and (b) the Company remains liable to Customer for the performance of any such third party that fails to fulfil its obligations.
  9. Details of processing. The nature and purposes of the processing activities, categories of data subjects whose personal data may be processed, categories of personal data processed, the frequency of the processing, the period for which the personal data will be retained, and the list of (sub-)processors, are all specified in Appendix A of this Addendum, per each type of Service.
  10. Confidentiality. The Company will ensure that its staff authorized to process the personal data are contractually bound by confidentiality obligations or are under an appropriate statutory obligation of confidentiality.
  11. Disputes. Any dispute that the parties are unable to amicably resolve under this Addendum shall be subject to the sole and exclusive jurisdiction and venue specified in the Terms.
  12. Liability. Each party’s total and aggregate liability to the other party under this Addendum for any direct or indirect damages asserted in connection with this Addendum, whether in tort (including negligence), contract, indemnity, strict liability, or otherwise, is capped as specified in the Terms, and in the absence of such specification, to the sum of fees paid by Customer to the Company in the twelve (12) months preceding any claim.

Part 2 — EU/EEA or UK GDPR DPA

  1. Capitalized terms used in this Part 2 but not defined herein or in the Terms shall have the meaning given to them in the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), any national law supplementing the GDPR, and the UK Data Protection Act 2018 as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419) — collectively, "Data Protection Law".
  2. Customer commissions, authorizes, and requests that the Company Process the personal data based on the instructions of Customer. Unless agreed otherwise in the Terms, the Company will Process the Personal Data only on Customer’s behalf (it being understood that Customer may itself be acting as a processor for and on behalf of its own customer, the controller). The Company and Customer are each responsible for complying with Data Protection Law as applicable to their respective roles.
  3. The Company will Process the Personal Data only based on instructions from Customer documented in this Addendum or otherwise provided in writing, consistent with the nature and characteristics of the Services — unless the Company is otherwise required by law to which it is subject, in which case the Company shall inform Customer of that legal requirement before processing, unless prohibited from doing so on important grounds of public interest. The Company shall promptly inform Customer if, in the Company’s opinion, an instruction violates Data Protection Law.
  4. The Company will make available to Customer all information at its disposal necessary to demonstrate compliance with its obligations under Data Protection Law.
  5. Upon Customer’s written request and within a reasonable time, the Company will make available all such information, shall maintain the records required by Article 30(2) of the GDPR, and shall make them available to Customer upon request.
  6. The Company will follow Customer’s instructions to accommodate data subjects’ requests to exercise their rights in relation to their Personal Data — including accessing, correcting, restricting, or deleting it — within the boundaries of the Service’s capabilities and features. The Company will pass on to Customer any request it receives directly from a data subject regarding Personal Data Processed by the Company, including requests for rectification, erasure, blocking, portability, or objection. Customer is solely liable for responding to data subjects on such requests and for notifying the Company of such requests where applicable.
  7. Customer authorizes the Company to engage another sub-processor for specific processing activities, provided the Company informs Customer at least ten (10) business days in advance of any new or substitute sub-processor. Customer may object, on reasoned grounds, to that new or replaced sub-processor; if it does, the Company may not engage that sub-processor, and may either propose another sub-processor (repeating this procedure) or terminate the license, the Terms, and the Order Form with no liability to Customer for such premature termination.
  8. Whenever the Company engages another sub-processor, the Company will ensure that data protection obligations equivalent to those in this Addendum are imposed on that sub-processor by contract, including sufficient guarantees of appropriate technical and organizational measures meeting the requirements of the GDPR. Where the sub-processor fails to fulfil its data protection obligations, the Company remains fully liable to Customer for that sub-processor’s performance.
  9. The Company and its sub-processors will only Process Personal Data in member states of the European Economic Area, in territories recognized by an adequacy decision of the European Commission (or, as applicable, under the UK GDPR) as providing an adequate level of protection pursuant to Article 45 of the GDPR, or using adequate safeguards required under Data Protection Law governing cross-border transfers (e.g., Standard Contractual Clauses).
  10. Subject to prior coordination on timing and agenda, following Customer’s written request the Company shall allow, within a reasonable timeframe, audits and inspections conducted by Customer, the controller, or another mandated auditor, to establish the Company’s compliance with this Addendum and applicable Data Protection Law. Such audits shall be carried out during the Company’s ordinary business hours, no more than once per calendar year (unless Data Protection Law or a supervisory authority mandates more frequent audits), with minimal disruption to the Company’s business, and subject to confidentiality undertakings satisfactory to the Company.
  11. The Company will assist, within a reasonable scope, with the preparation of data protection impact assessments and prior consultations with supervisory authorities, as appropriate.

Part 3 — State Privacy Laws in the U.S.

  1. Definitions.
    • “Applicable State Privacy Laws” means the CPRA and other applicable state privacy laws in the United States, such as (without limitation) the Virginia Consumer Data Protection Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Utah Consumer Privacy Act, and the Colorado Privacy Act.
    • “Breach” means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Covered Information during its Processing by the Company.
    • “Consumer” means a natural person, including a natural person acting in their professional or work capacity.
    • “CPRA” means Cal. Civ. Code §1798.100 et seq. and the regulations at 11 C.C.R. §7000 et seq.
    • “Covered Information” means information that the Company’s Service stores, handles, or otherwise maintains for and on behalf of Customer.
    • “Process” (and its cognate terms) means any operation or set of operations performed on Covered Information, whether or not by automated means.
    • “Sell” (and its cognate terms) means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating Covered Information for monetary or other valuable consideration.
    • “Share” (and its cognate terms) means disclosing Covered Information for cross-context behavioral advertising, whether or not for monetary or other valuable consideration.
  2. The Company may only Process the Covered Information to perform the Order Form and the Terms. Customer discloses Covered Information to the Company solely so the Company can provide the Services to Customer and for the other purposes agreed in the Order Form and the Terms. The Company is prohibited from retaining, using, or disclosing the Covered Information for any commercial purpose other than those business purposes, and from retaining, using, or disclosing it outside the direct business relationship between the Company and Customer.
  3. Subject to the Terms, the Company must not Sell or Share any Covered Information it Processes.
  4. The Company shall comply with all applicable sections of the Applicable State Privacy Laws and shall provide, with respect to Covered Information, the same level of privacy protection as required by those laws.
  5. Commensurate with the nature of the Company’s Services and in accordance with Customer’s specified instructions, the Company shall help Customer, within a reasonable timeframe, comply with Consumer requests made pursuant to Applicable State Privacy Laws of which the Company is informed by Customer.
  6. The Company grants Customer the right to take reasonable and appropriate steps to ensure the Company uses Covered Information consistently with Customer’s obligations under this Addendum and Applicable State Privacy Laws, and the right, upon notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Covered Information by the Company.
  7. The Company must promptly notify Customer when it determines it can no longer meet its obligations under this Addendum or Applicable State Privacy Laws.

Part 4 — Israeli Privacy Protection Regulations (Information Security)

1. Definitions

2. Processor’s obligations regarding the Processing of Personal Data

  1. The Processor shall process Personal Data for Customer solely to provide the Services under the Terms and this Part 4, and for no other purpose, unless expressly instructed by Customer to do so.
  2. The Processor undertakes to manage access rights to Personal Data, including by granting its users ‘least privilege’ access based on their ‘need to know’, and shall take measures to prevent access by unauthorized individuals. The Processor will maintain an up-to-date listing of individuals authorized to access or use the Database and use measures designed to prevent access by anyone without a need to be exposed to the Personal Data.
  3. The Processor shall not grant access to Personal Data to its employees, consultants, or anyone else acting on its behalf before confirming, within the boundaries of applicable law, that their background, integrity, and reliability are suitable for a position with such access.
  4. The Processor shall grant its employees access to the Database subject to their completing training on privacy protection and information security obligations applicable under the Applicable Laws and this Part 4.
  5. The Processor will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as set forth in this Part 4.
  6. The Processor shall develop, implement, and enforce an information security policy (the “Information Security Policy”) covering at least:
    • Physical protection of the Database systems and the sites where they are located;
    • Management and monitoring of access authorizations and actions taken in the Database;
    • Mapping of all security measures taken by the Processor regarding the Database;
    • Guidelines for individuals authorized to access Personal Data and the Database;
    • A review of the risks to which the Personal Data is exposed, including how threats to the Database systems are recorded, monitored, and identified;
    • Instructions and procedures for mitigating and managing a Personal Data Breach; and
    • Instructions and procedures regarding the use of removable devices.
  7. The Processor shall map the operational environment of the Database, including an inventory of all systems, software, interfaces, and hardware and communications components it operates in the Database environment (the “Database Systems”). The Processor shall keep this inventory current, disclose it only to individuals who require access for their job functions, and update it whenever a substantial change is made to the operating environment or to how Personal Data is Processed.

3. Disclosure and transfer of Personal Data

The Processor shall not disclose Personal Data processed on behalf of Customer to any entity unless Customer has provided prior written consent, except as follows:

  1. As strictly necessary for the provision of the Services;
  2. Where disclosure is required by Applicable Law or during legal proceedings, in which case the Processor shall notify Customer in writing promptly upon receipt of the request and before fulfilling it, and shall disclose only the minimum Personal Data necessary to comply;
  3. To the extent Customer approves the Processor’s use of a subcontractor or service provider to Process Personal Data (each, a “Sub-contractor”), the Processor shall enter into a written, valid, and enforceable agreement with the Sub-contractor containing data-security terms consistent with this Part 4, shall provide Customer with information reasonably requested about its Sub-contractors upon written request, and shall take reasonable measures to monitor their compliance with data-security obligations; and
  4. The Processor shall use conventional encryption mechanisms for any transfer of Personal Data to a third party and for any remote connection to the Database Systems.

4. Storing, deletion, and return of Personal Data

  1. The Processor undertakes to implement appropriate security measures to ensure the integrity, availability, confidentiality, and reliability of the Personal Data.
  2. To the extent reasonable given the nature of the system, the Processor shall maintain logical separation between the Database Systems and its other computer systems not directly related to Processing Personal Data for Customer. Where the Database Systems are connected to the Internet or another public network, the Processor shall install appropriate protections such as firewalls and anti-virus tools.
  3. The Processor shall retain the Personal Data only as strictly necessary to provide the Services to Customer, or as mandatory under Applicable Laws.
  4. The Processor shall regularly update the Database Systems, including installed software, with information security updates, and will not use software or hardware components that the manufacturer no longer supports from a security standpoint.
  5. To the extent reasonable given business needs, the Processor will implement measures to prevent removable devices from connecting to the Database Systems or devices Processing Personal Data on its premises or those of its personnel. Portable devices such as laptops and smartphones Processing Personal Data may nonetheless be used so long as they are encrypted with industry-customary encryption.
  6. In accordance with the Terms, the Processor shall return, delete, or destroy all Personal Data to which this Part 4 applies — including all originals and copies, in any medium — within forty-five (45) days of Customer’s written request for return, deletion, or destruction for any reason.

5. Cross-border data transfers

  1. The Processor shall comply with the law applicable to the transfer of Personal Data to foreign jurisdictions, including the Protection of Privacy Regulations (Transfer of Information to Databases Outside of Israel), 5761-2001.
  2. Other than as described in this Addendum, the Processor shall not transfer Personal Data to a foreign jurisdiction outside the EEA, the UK, or countries offering an adequate level of data protection, without prior advance notice to Customer. Customer may object to such a transfer, on reasonable grounds, within thirty (30) days of receiving notice.
  3. If Customer does not object, the Processor shall keep Customer updated on material compliance developments regarding its transfers of Personal Data to foreign jurisdictions.

6. Breach of information security

  1. The Processor will notify Customer without undue delay, and no later than twenty-four (24) hours (during business days) after becoming aware of a Personal Data Breach, and provide sufficient information to allow Customer to meet its own obligations to report or inform affected individuals or a supervisory authority. Such notice shall include — at the time of initial notification or without undue delay afterward — details of the nature of the breach, the number of records and affected individuals, anticipated consequences, and any actual or proposed remedies.
  2. In any case of a Personal Data Breach affecting Customer Personal Data, the Processor will also:
    1. Cooperate with Customer to investigate the breach and not release any public statement about it, except as required by law; and
    2. Take all necessary and appropriate corrective measures to repair the breach.
  3. In the event of a Personal Data Breach, the parties will discuss the matter and agree on the measures required to repair it and the schedule for their implementation.

7. Audit & documentation

  1. The Processor shall provide Customer, upon request, written confirmation of how it performs and fulfils its obligations under this Part 4 and the Applicable Law.
  2. The Processor shall fully cooperate with Customer, within a reasonable timeframe, in providing information and assistance reasonably requested in connection with data security issues, practices, and supplementary documentation, so Customer can properly address information security, privacy, and regulatory matters relating to the Database.
  3. The Processor undertakes to allow Customer’s representatives (or anyone acting on Customer’s behalf) to carry out, on advance written notice and within a reasonable timeframe, surveys and audits regarding the Processor’s performance under this Part 4 — provided that the surveyor or auditor first signs an undertaking to maintain the confidentiality of any Processor data they are exposed to in the course of the survey or audit.

8. Term & termination

The clauses in this Part 4 that are required under Applicable Law will continue to apply even after expiration or termination of the Terms, for as long as the Processor continues to retain Customer Personal Data.

9. Governing law and interpretation

To the extent there is no contradiction with the foregoing, the relevant clauses of the Terms apply to this Part 4. In the event of a conflict between this Part 4 and the Terms, this Part 4 shall prevail.

Appendix A — Data Processing Details

Categories of data subjects Individuals whose personal data appears in publicly available online sources.
Categories of personal data processed Personal data or personal information included in publicly available online sources.
Frequency of processing Continuous during the Term, to the extent the Service involves the processing of individuals’ personal data.
Nature of the processing Identification, retrieval, collection, organization, structuring, and delivery of data on behalf of Customer as specified in the Order Form and the Terms — mainly the electronic collection, processing, and provision of the Services.
Purpose(s) of the processing Personal data is contained in the data the Company provides through the Service. The Company accesses such data solely for purposes pursuant to the Order Form, the Terms, and this Addendum.
Retention period For the duration of the Term, for as long as the Service is used by Customer.

Sub-processors engaged for the Service, and the location of their processing:

Contact

Questions about this Addendum? Email privacy@bringits.com or legal@bringits.com.