Truly Data Processing Addendum

This Truly Data Processing Addendum (“Addendum”) is entered into on by and between Truly Detection Ltd. (“Truly”) who developed and provides the Service (as defined below), the entity from which you may have purchased the rights to use the Service (“Reseller”) (collectively, the “Company”) and the Customer who is a party to the Truly Service Agreement (“Customer”). Capitalized terms used in this Addendum but not defined herein shall have the meaning ascribed to them in the Agreement (as defined below).

WHEREAS, Truly is involved in processing certain personal data or personal information on behalf of Customer (“Customer Data”) as part of its AI technology-powered solution for analyzing recorded audio, chats and videos to mitigate deepfakes (the “Service”) and Professional Services, and the Reseller is involved in processing certain Customer Data as part of its access facilitation and first-line support for the Service, pursuant to the Truly Service Agreement between Customer and the Company (“Agreement”), the Subscription Form or the Reseller Subscription Form and the parties wish to regulate the Company’s processing of such personal data, through this Addendum.

THEREFORE, the parties have agreed to this Addendum, consisting of these parts:

Part 1 (General Provisions)

1. Scope. This Addendum and any of its Parts apply only where the Company is processing Customer Data on behalf of the Customer and under the Customer’s instruction. It does not apply to the processing required by the Company to administer the business or contractual relationship between the Company and the Customer.
2. Order of Precedence. In the event of any conflicting provisions between this Addendum and the Agreement or any other agreement in place between the parties, the provisions of this Addendum prevail.
3. Data security. Considering the state of the art, the costs of implementation and the nature, scope, context and purposes of the Company’s processing of Customer Data, the Company will implement and maintain reasonable security procedures and practices appropriate to the nature of Customer Data, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure (including data breaches).
4. Data Subject Requests. the Company will follow Customer’s instructions to accommodate data subjects’ requests to exercise their rights in relation to their information within the Customer Data, including accessing their data, correcting it, restricting its processing or deleting it. The Company will pass on to Customer requests that it receives (if any) from data subjects regarding their information processors by the Company. the Company shall notify Customer of the receipt of such request without undue delay, together with the relevant details.
5. Return or deletion of information. Upon Customer’s written request where no subsequent further processing is required, the Company shall, at the instruction of Customer, either delete, destroy or return to Customer, some or all (however instructed) of the of the personal information that it and its third party suppliers process for Customer. Upon Customer’s request, the Company will furnish written confirmation that the Personal Data has been deleted or returned pursuant to this section.
6. Disclosure. Unless legally prohibited, the Company will provide Customer prompt notice of any request it receives from authorities to produce or disclose Customer Data it has Processed on Customer’s behalf, so that Customer may contest or attempt to limit the scope of production or disclosure request.
7. Data Breaches. The Company shall without undue delay notify Customer of any actual or reasonably suspected accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data, that it becomes aware of. the Company will investigate the breach, and take all available measures to mitigate the breach and prevent its reoccurrence. The Company will cooperate in good-faith with Customer on issuing any statements or notices regarding such breaches, to authorities and data subjects.
8. Subcontracting to suppliers. Customer authorizes the Company to subcontract any of its Service and Professional Service-related activities consisting of the processing of the Customer Data or requiring Customer Data to be processed by any third party supplier without the prior written authorization of Customer provided that: (a) the Company shall ensure that the third party is bound by similar obligations under this Part 1; and (b) the Company is liable to Customer for the performance of any such third party that fails to fulfil its obligations.
9. The Company will ensure that its staff authorized to process the Customer Data are contractually bound by confidentiality obligations or are under an appropriate statutory obligation of confidentiality.
10. Any dispute that the parties are unable to amicably resolve under this Addendum, shall be subject to the sole and exclusive jurisdiction and venue specified in the Agreement.
11. Each party’s total and aggregate liability to the other party under this Addendum for any direct or indirect damages asserted in connection with this Addendum, whether in tort (including negligence), contract, indemnity, strict liability, or otherwise, is capped as specified in the Agreement, the Subscription Form and the Reseller Subscription Form.

Part 2 (GDPR DPA)

1. Capitalized terms used in this Part 2 but not defined herein or in the Agreement shall have the meaning ascribed to them in the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) applicable as of 25 May 2018 and any national law supplementing the GDPR, and the UK Data Protection Act 2018 under the European Union (Withdrawal) Act 2018 as amended by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419); these shall collectively be referred to in this Part 2 as “Data Protection Law”.
2. Customer commissions, authorizes and requests that the Company Process the Customer Data under the instructions of Customer. The Company will Process the Personal Data only on Customer’s behalf (it being understood that the Company is acting as a Processor for and on behalf the Customer - the Controller). The Company and Customer are each responsible for complying with the Data Protection Law as applicable to their roles.
3. The Company will Process the Personal Data only on instructions from Customer documented in this Addendum, the Agreement or otherwise provided in writing, which instructions must be consistent with the nature and characteristics of the Service and the Data Protection Law.
4. The nature and purposes of the Processing activities are the provision of the Service to the Customer. The Personal Data Processed may include: audio, video and chat recordings. Such data may include biometric information processed and provided to the Company and the Service on behalf of the Customer.
5. The Data Subjects, as defined in the Data Protection Law, about whom Personal Data is Processed are determined by the Customer and include authorized users of Customer, such as employees, agents, clients and anyone on Customer’s behalf who is authorized to use the Service.
6. The Company will make available to Customer all information in its disposal necessary to demonstrate compliance with the obligations under Data Protection Law.
7. The Company will make available to Customer all information in its disposal necessary to demonstrate compliance with the obligations under Data Protection Law, shall maintain all records required by Article 30(2) of the GDPR, and shall make them available to the Customer upon request.
8. The Company will follow Customer’s instructions to accommodate Data Subjects’ requests to exercise their rights in relation to their Personal Data, including accessing their data, correcting it, restricting its processing or deleting it, within the boundaries of the Service’s capabilities and features. The Company will pass on to Customer requests that it receives from Data Subjects regarding their Personal Data Processed by the Company. Any request from Data Subjects arising out of the processing of Personal Data by the Company, including but not limited to rectification, erasure, and blocking of Personal Data, portability requests and objection, has to be asserted to Customer. Customer is solely liable for responding to Data Subjects on such requests.
9. Customer authorizes the Company to engage another sub-processor for carrying out specific processing activities, provided that the Company informs Customer at least 10 business days in advance of any new or substitute sub-processor, in which case Customer shall have the right to object, on reasoned grounds, to that new or replaced sub-processor. If Customer so objects, the Company may not engage that new or substitute sub-processor for the purpose of Processing Personal Data, and the Company may either select another sub-processor in which case the above procedure shall repeat, or if it so chooses, terminate the Agreement with no liability to Customer for such premature termination. At the outset, Customer authorizes the Company to engage with Google Cloud Platform.
10. Without limiting the foregoing, in any event where the Company engages another sub-processor, the Company will ensure that the same data protection obligations as set out in this Addendum are likewise imposed on that other sub-processor by way of a contract, in particular providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of the GDPR. Where the other sub-processor fails to fulfil its data protection obligations, the Company shall remain fully liable to Customer for the performance of that other sub-processor’s obligations.
11. The Company and its other sub-processors will only Process the Personal Data in member states of the European Economic Area, in territories or territorial sectors or with agreements recognized by an adequacy decision of the European Commission (or as applicable, the UK GDPR regulations), as providing an adequate level of protection for Personal Data pursuant to Article 45 of the GDPR or using adequate safeguards as required under Data Protection Law governing cross-border data transfers (e.g., Standard Contract Clauses, Data Privacy Framework).
12. Subject to prior coordination between the Customer and the Company as to the timing and agenda of the audit, following Customer’s written request, the Company shall allow for and contribute to audits, including carrying out inspections conducted by Customer or another auditor mandated by Customer in order to establish the Company's compliance with this Addendum and the provisions of the applicable Data Protection Law as regards the Personal Data that the Company processes on behalf of Customer. Such audits or inspections shall be carried out during the Company’s ordinary business hours, not more than one business day per year (unless Data Protection Law or a supervisory authority mandate more frequent audits or inspections), shall be conducted with minimal disruption to the Company’s business activities, and be subject to confidentiality undertakings satisfactory to the Company.
13. The Company will assist, within a reasonable scope of assistance, Customer with the preparation of data privacy impact assessments and prior consultation as appropriate (and if needed).
    

Part 3 (State Privacy Laws in the U.S.)

1. Definitions
   1. “Applicable State Privacy Laws” means the CPRA and in other applicable state privacy laws in the United States, such as (but not limited to): Virginia Consumer Data Protection Act, Connecticut Act Concerning Personal Data Privacy and Online Monitoring, Utah Consumer Privacy Act, and the Colorado Privacy Act.
   2. “Breach” means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Covered Information, during its Processing by the Company.
   3. “Consumer” means a natural person, including a natural person in their professional or work capacity.
   4. “CPRA” means Cal. Civ. Code 1798.100 et seq. and the regulations at 11 C.C.R. §7000 et seq.
   5. “Covered Information” means information that the Company's Service or Professional Service stores, handles, or otherwise maintains for and on behalf of Customer.
   6. “Process” (and its cognate terms) means any operation or set of operations that are performed on Covered Information or on sets of Covered Information, whether or not by automated means.
   7. “Sell” (and its cognate terms) means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, Covered Informationfor monetary or other valuable consideration.
   8. "Share” (and its cognate terms) means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, Covered Information for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions for cross-context behavioral advertising  in which no money is exchanged.
2. The Company may only Process the Covered Information to perform the Agreement. The parties agree that the Customer is only disclosing the Covered Information to the Company so that the Company can provide the Service or Professional Service to the Customer. The Company is prohibited from retaining, using, or disclosing the Covered Information for any commercial purpose other than the foregoing business purposes. Additionally, the Company is prohibited from retaining, using, or disclosing the Covered Information pursuant to this Agreement outside the direct business relationship between the Company and Customer.
3. The Company must not Sell or Share any Covered Information it Processes.
4. The Company shall comply with all applicable sections of the Applicable State Privacy Laws and shall provide, with respect to Covered Information, the same level of privacy protection as required by Applicable State Privacy Laws.
5. Commensurate with the nature of the Company’s Service or Professional Service to Customer and in accordance with Customer’s specified instructions to the Company, the Company shall help Customer to comply with Consumer requests made pursuant to Applicable State Privacy Laws of which the Company is informed of by Customer.
6. the Company grants Customer the right to take reasonable and appropriate steps to ensure that the Company uses the Covered Information in a manner consistent with Customer’s obligations under this Addendum and Applicable State Privacy Laws. The Company grants Customer the right, upon notice, to take reasonable and appropriate steps to stop and remediate the Company’s unauthorized use of Covered Information.
7. the Company must promptly notify Customer when it makes a determination that it can no longer meet its obligations under this Addendum or Applicable State Privacy Laws.