This EU Data Processing Addendum for Mistplay Services (“EU Addendum”) is applicable only to the extent Mistplay collects or otherwise processes Personal Data protected or otherwise regulated by European Data Protection Law (defined below). Capitalized terms used in this Addendum shall have the meaning given to them in the main body of the Agreement unless otherwise defined in this Addendum.
2.1 "controller", "processor", "data subject", "personal data", “personal data breach”, and "processing" (and "process") have the meanings given in applicable EU Data Protection Law.
2.2 ”EU Data Protection Law" means as applicable to a party in its Processing of Data: (i) Regulation 2016/679 (the European General Data Protection Regulation (“GDPR”); (ii) the EU e-Privacy Directive (Directive 2002/58/EC) (“e-Privacy Directive”); (iii) all national implementations of (i) and (ii); (iv) the Swiss Federal Data Protection Act of 19 June 1992 and its corresponding ordinances (“Swiss DPA“); and (v) in respect of the United Kingdom, GDPR as it forms part of United Kingdom law pursuant to Section 3 of the European Union (Withdrawal) Act 2018 and the Data Protection Act 2018 the (together, “UK Privacy Law“); in each case, as may be amended, superseded or replaced from time to time.
2.3 ”GDPR” means the EU General Data Protection Regulation 2016/679, as amended or updated.
2.4 ”Restricted Transfer” means: (i) where the GDPR applies, a transfer of Personal Data from the European Economic Area to a country outside of the European Economic Area which is not subject to an adequacy determination by the European Commission; (ii) where the UK Privacy Law applies, a transfer of Personal Data from the United Kingdom to any other country which is not based on adequacy regulations pursuant to section 17A of the United Kingdom Data Protection Act 2018; and (iii) where the Swiss DPA applies, a transfer of Personal Data to a country outside of Switzerland which is not included on the list of adequate jurisdictions published by the Swiss Federal Data Protection and Information Commissioner.
2.5 ”Standard Contractual Clauses” or “SCCs” means Module 1 (Controller to Controller) of the contractual clauses annexed to the European Commission’s Implementing Decision 2021/914 of 4 June 2021 located at https://commission.europa.eu/publications/standard-contractual-clauses-international-transfers_en.
2.6 ”UK Addendum” means the International Data Transfer Addendum (version B1.0) to the EU Commission Standard Contractual Clauses issued by UK Information Commissioners Office under S.119(A) of the UK Data Protection Act 2018, as amended, superseded or replaced from time to time.
3.1 Control/Application of the EU Addendum. In the event of any conflict or discrepancy among the SCCs, the Order, the Agreement, and the terms and conditions of this EU Addendum, the following order of precedence will apply: (a) the SCCs (where applicable), (b) this EU Addendum (where applicable), (c) the Order, and (d) the remainder of the Agreement.
3.2 Governing Law. This EU Addendum will be governed by the laws of the applicable jurisdiction. In all other cases, this EU Addendum will be governed by the laws of the jurisdiction set forth in the Agreement.
3.3 Relationship of the Parties. The parties acknowledge and agree in connection with the processing of personal data, each party (a) is an independent controller of the personal data under EU Data Protection Law; (b) will individually determine the purposes and means of its processing of personal data; and (c) will comply with the obligations applicable to it under EU Data Protection Law with respect to the personal data.
3.4 Scope of Processing. Unless otherwise and separately agreed between the parties, the parties agree and understand that: (i) in connection with the Services, Mistplay may collect or otherwise receive data (including Personal Data) about or related to end users as more particularly described in Annex A of this EU Addendum (collectively, “Data”); (ii) Mistplay and its partners may use Tracking Technologies in order to collect certain Data; and (iii) Mistplay and its partners may process the Data for the purposes contemplated by the Agreement and for any other purposes described in the Mistplay Privacy Policy.
3.5 Security. Each party shall implement appropriate technical and organizational measures to protect the personal data (i) from accidental or unlawful destruction, and (ii) loss, alteration, unauthorized disclosure of, or access to the personal data (a "Security Incident"). In the event that a party suffers a confirmed Security Incident, it shall notify the other party without undue delay and both parties shall cooperate in good faith to agree and action such measures as may be necessary to mitigate or remedy the effects of the Security Incident. Nothing herein prohibits either party from moving forward to notify regulatory authorities as may be required by law prior to notification of the other party so long as the notifying party provides notification to the other party without undue delay.
3.6 Prohibited Data Sharing. Client shall not include or launch any Application on to the Mistplay Platform or into the Services such Application is directed at any data subject that is deemed a child under applicable privacy or consumer protection laws of the country in which the child resides. Client shall not pass to Mistplay any Personal Data of any data subject that is deemed a child under such laws.
3.7 Co-operation; Data Subject Rights. The parties shall, on request, provide each other with all reasonable and timely assistance (at their own expense) and co-operation to enable the other party to comply with its obligations under EU Data Protection Law, including cooperation in order to enable the other party to respond to: (i) any request from a data subject to exercise any of its rights under European Data Protection Law (including its rights of access, correction, objection, erasure and data portability, as applicable) in relation to the Data; and (ii) any other correspondence, enquiry or complaint received from a data subject, regulator or other third party in connection with the processing of the Data (“Correspondence”). Each party shall promptly inform the other if it receives any Correspondence directly from a data subject in relation to the Data. Subject to obligations of confidentiality and policies on disclosure of information, where a party has a concern that the other party has not complied with this EU Addendum, the parties agree to exchange information to ascertain the cause of such non-compliance and take reasonable steps to remediate.
3.8 Noncompliance. If Client is unable to comply with its consent and notice obligations under the Agreement (including this EU Addendum) in respect of the Data, Client shall promptly notify Mistplay.
3.9 Transfers of Personal Data.
4.1 Mistplay may update the terms of this EU Addendum from time to time, as may be required to comply with EU Data Protection Law, applicable regulation, court order, or regulatory guidance. If Client objects to any such change, Client may terminate the Agreement by giving thirty (30) days prior written notice to Mistplay.
By executing an Order incorporating these the Agreement, Mistplay and Client has agreed to the terms of this EU Addendum.