This data processing agreement including the appendices (the “DPA”) is part of the Agreement between Customer and the contracting entity listed in the General Legal Notice, unless otherwise stated on your Order Form. In this DPA, the terms “you”, “your”, or “Customer” refer to you (subject to Section 1.2 below), and the terms “we”, “us,” “our” or “MoonBack” refer to us.

3. Processing of Customer Personal Data

3.1 Purposes. We will process Customer Personal Data only to the extent necessary (i) to provide the Services, including transmission of communication, ensuring the security of the services, providing technical and delivery reports, providing support and developing and implementing improvements and updates in accordance with your documented instructions to us as a data processor as specified in Section 3.2 of this DPA, and (ii) for our legitimate business purposes as specified in Section 3.4 of this DPA as a data controller. We do not sell any Personal Data, including Customer Personal Data, and do not share Personal Data with third parties for compensation or for those third parties’ own business interests.

3.2 Instructions. The Agreement and this DPA constitute your complete instructions to us as a data processor at the time of signature of this DPA. We will comply with other reasonably documented instructions provided that those instructions are consistent with the terms of the Agreement.

3.3 Details of processing. Annex I, Part B. (Description of transfer) of this DPA further specifies the nature and purpose of the processing, the processing activities, the duration of the processing, the types of Personal Data and categories of data subjects by us as a data processor or Subprocessor.

3.4 Legitimate business purposes. You acknowledge that we process Customer Personal Data as an independent data controller to the extent necessary for the following legitimate business purposes: billing, account management, financial and internal reporting, combatting and preventing security threats, cyber attacks, and cybercrime that may affect us or our services, business modeling (e.g. forecasting, capacity and revenue planning, product strategy), fraud, spam, and abuse prevention and detection, product improvement, and to comply with our legal obligations.

4. Customer Obligations

4.1 Lawfulness. Where you act as a data controller of Customer Personal Data, you guarantee that all processing activities are lawful, have a specific purpose, and any required notices and consents or other appropriate legal basis are in place to enable lawful transfer of the Customer Personal Data. If you are a data processor (in which case we will act as a Subprocessor), you will ensure that the relevant data controller guarantees that the conditions listed in this Section 4.1 are met.

4.2 Compliance. You are solely responsible for (a) ensuring that you comply with the Data Protection Legislation applicable to your use of the Services and to your own processing of Customer Personal Data, (b) making an independent assessment whether the technical and organizational measures of the Services meet your requirements, and (c) implementing and maintaining privacy and security measures for components that you provide or control (including but not limited to passwords, devices used with the Services and Customer Applications).

5. Security

5.1 Security measures. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we shall implement and maintain appropriate technical and organizational security measures to protect Customer Personal Data from Personal Data Breaches and to preserve the security, integrity, availability, resiliency and confidentiality of the Customer Data our systems use for processing Customer Data. The security measures applied by us are described in Appendix II.

5.2 Updates to security measures. You are responsible for reviewing the information made available by us relating to Customer Personal Data security and making an independent determination as to whether such information meets your requirements and legal obligations under Data Protection Legislation. You acknowledge that the security measures are subject to technical progress and development, and that we may update or modify our security measures from time to time, provided that such updates and modifications do not result in the degradation of the overall security of the Customer Personal Data.

5.3 Access controls. We apply the principles of “need to know “and least privilege.

5.4 Confidentiality of processing. We will ensure that any person or party who is authorized by us to process Customer Personal Data (including our staff, agents and Subprocessors) are informed of the confidential nature of such Customer Personal Data and will be under an appropriate obligation of confidentiality (whether a contractual or statutory duty) that survives termination of their engagement.

5.5 Personal Data Breach response and notification. Upon becoming aware of a Personal Data Breach, we will without undue delay (i) notify you, (ii) investigate the Personal Data Breach, (iii) provide timely information relating to the Personal Data Breach as it becomes known or as it is reasonably requested by you, and (iv) take commercially reasonable steps to mitigate the effects and prevent recurrence of the Personal Data Breach.

6. Assistance

6.1 Data protection assistance. We shall provide you with reasonably requested assistance in order to allow you to comply with your obligations under the Data Protection Legislation, including the notification of a Personal Data Breach, assessing the appropriate level security of processing, and assisting you with the performance of a relevant data protection impact assessment.

6.2 Assistance with data subject requests. We will provide you with reasonable assistance in order to allow you to comply with your obligations to data subjects who exercise their rights under the Data Protection Legislation by making available technical and organizational measures via your account. For the avoidance of doubt, you as the data controller are responsible for processing any request or complaint from data subjects with respect to the Customer Personal Data of a data subject.

7. Disclosure and Disclosure Requests

7.1 Limitations on disclosure and access. We will not provide access to or disclose Customer Personal Data except (i) as directed by you, (ii) as set out in the Agreement and this DPA, or (iii) as required by law.

7.2 Disclosure requests. We will notify you as soon as reasonably possible if we receive a request from a governmental or regulatory body to disclose Customer Personal Data, unless such notice is prohibited by law. We will handle disclosure requests in accordance with the disclosure request policy available at https://moonback.me/privacy.

8. Subprocessors

8.1 Current Subprocessors. You agree to the engagement of the Subprocessors listed under the header “End User Personal Data”, which contains a procedure for you to subscribe to notifications of changes to our use of Subprocessors. If you subscribe to such notifications, and taking into account Section 8.3 of this DPA, we will share details of any change in Subprocessors as soon as reasonably possible.

8.2 Use of Subprocessors. By means of this DPA, you provide a general written authorization to us to engage Subprocessors for the processing of Customer Personal Data, subject to Section 8.3 of this DPA and the following requirements:

a. We will restrict access to Customer Personal Data by Subprocessors to what is strictly necessary to provide the services specified in the subprocessor agreement;

b. We will agree upon data protection obligations with the Subprocessor that are substantially the same as the obligations under this DPA; and

c. We remain liable to you under this DPA for the performance of the data protection obligations of the Subprocessor.

8.3 Notification of changes to Subprocessors and right to object. Before replacing or engaging new Subprocessors (“Subprocessor Change”), we will give you the option to object to the Subprocessor Change.

You may object to a Subprocessor Change provided that (i) the objection is made in writing within ten (10) business days of our notice of the Subprocessor Change and (ii) the objection is based on and clearly explains the reasonable grounds relating to the protection of Customer Personal Data. When you object to a proposed Subprocessor Change, we shall work with you in good faith to make a commercially reasonable change in the provision of the Services that avoids the use of the relevant Subprocessor. If such change cannot reasonably be made within thirty (30) business days from our receipt of your objection notice, or if the change is commercially unreasonable for us, either party may terminate the applicable features of the Services which cannot be provided without the use of the relevant Subprocessor. This termination right is your sole and exclusive remedy if you object to a Subprocessor Change.

9. Cross Border Transfers of Customer Personal Data

9.1 Transfers of Customer Personal Data. We may transfer Customer Personal Data on the condition that all appropriate safeguards required by Data Protection Legislation are in place. This may include a prior data transfer impact assessment, the adoption, monitoring and evaluation of supplementary technical, organizational and legal measures, enforceable data subject rights, and that effective legal remedies for data subjects are available.

9.2 Subprocessor Standard Contractual Clauses. Unless an adequacy decision or alternative transfer mechanism applies, we have entered into and shall maintain Standard Contractual Clauses with Subprocessors (including our Affiliates) located outside the EEA, subject to the terms set out in Section 9.1 of this DPA.

9.3 Transfer Mechanisms for Customer Personal Data Transfers. To the extent your use of the Services requires a cross border data transfer mechanism to lawfully export Customer Personal Data from a jurisdiction (e.g. the EEA, California, Singapore, Switzerland, the or the United Kingdom) to us located outside of that jurisdiction this section will apply. If, in the performance of the Services, Customer Personal Data that is subject to the GDPR or any other law relating to the protection or privacy of individuals that applies to this DPA is transferred to MoonBack located in countries which do not ensure an adequate level of data protection within the meaning of the Data Protection Legislation, the transfer mechanisms listed below shall apply to such transfers and can be directly enforced by the parties to the extent such transfers are subject to the Data Protection Legislation:

9.3.1 The parties agree that the Standard Contractual Clauses will apply to Customer Personal Data that is transferred via the Services from the EEA or Switzerland, either directly or via onward transfer, to a MoonBack entity located in a country outside the EEA or Switzerland that is not recognized by the European Commission (or, in the case of transfers from Switzerland, the competent authority for Switzerland) as providing an adequate level of protection for personal data.

9.3.1.1 When you are acting as a data controller and MoonBack is a data processor the EU Controller-to-Processor Standard Contractual Clauses will apply to any such transfer of Customer Personal Data from the EEA. When you are acting as a data processor and MoonBack is a subprocessor the Processor-to-Subprocessor Standard Contractual Clauses will apply to any such transfer of Customer Personal Data from the EEA.

9.3.1.2 MoonBack will be deemed the data importer and you will be deemed the data exporter under the Standard Contractual Clauses. Each party’s signing of this DPA, will be treated as signing of the applicable Standard Contractual Clauses, which will be deemed incorporated into this DPA. Details required under Annex 1 and Annex 2 to the Standard Contractual Clauses are available in Appendix I and Appendix II to this DPA. In the event of any conflict or inconsistency between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail solely with respect to a transfer of Customer Personal Data from the EEA.

9.3.1.3 Where the Standard Contractual Clauses require the parties to choose between optional clauses and to input information, the parties have done so as set out below:

• The Optional Clause 7 “Docking clause” shall not be adopted.
• For Clause 9 “Use of sub-processors”, the parties elect the following option: “Option 2 General written authorisation: the data importer has the controller’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the controller in writing of any intended changes to that list through the addition or replacement of subprocessors at least 10 business days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object. The data importer shall inform the data exporter of the engagement of the sub-processor(s).”
• For Clause 11 (a) “Redress”, the parties do not adopt the Option.
• For Clause 17 “Governing law”, the parties elect the following option: “Option 1. These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of the Netherlands.”
• For Clause 18 (b) “Choice of Forum and Jurisdiction”: “The Parties agree that those shall be the courts of the Netherlands.”

9.3.2 The parties agree that the UK Controller-to-Processor Standard Contractual Clauses will apply to Customer Personal Data that is transferred via the Services from the United Kingdom, either directly or via onward transfer, to a MoonBack entity located in a country outside the United Kingdom that is not recognized by the competent United Kingdom regulatory authority or governmental body for the United Kingdom as providing an adequate level of protection for personal data.

9.3.2.1 MoonBack will be deemed the data importer and you will be deemed the data exporter under the UK Controller-to-Processor Standard Contractual Clauses. Each party’s signing of this DPA, will be treated as signing of the UK Controller-to-Processor Standard Contractual Clauses, which will be deemed incorporated into this DPA. Details required under Annex 1 and Annex 2 to the UK Controller-to-Processor Standard Contractual Clauses are available in Appendix I and Appendix II to this DPA. In the event of any conflict or inconsistency between this DPA and the UK Controller-to-Processor Standard Contractual Clauses, the UK Controller-to-Processor Standard Contractual Clauses shall prevail solely with respect to transfer of Customer Personal Data from the United Kingdom.

10. Audit

10.1 Audit Report. Our communication platform shall be regularly audited against the ISO 27001:2013 standard (or equivalent). The audit may, in our sole discretion, be an internal audit, or an audit performed by a third party. Upon written request, we will provide you with a summary of the audit report(s) (“Audit Report”), so that you can verify our compliance with the audit standards and this DPA. Such Audit Reports, as well as any conclusions or findings specified therein, are our Confidential Information.

10.2 Customer information requests. We will make available to you all information reasonably necessary to demonstrate compliance with the obligations laid down in this DPA. We will provide written responses to reasonable requests for information made by you, including responses to information security and audit questionnaires that are reasonable in scope and necessary to confirm compliance with this DPA, provided that you (i) have first made a reasonable effort to obtain the requested information from the Documentation, Audit Reports and other information provided or made public by us, and (ii) will not exercise this right more than once per year, unless a Personal Data Breach or significant change in our processing activities in relation to the Services require that an additional questionnaire is executed. All responses provided are our Confidential Information.

10.3 Customer Audit. If an Audit Report provided by us to you gives you substantiated reasons to believe that we are in breach of our obligations under this DPA, related to the Customer Personal Data provided by you, we will allow an independent and qualified third party auditor appointed by you and approved by us, to audit the relevant applicable Personal Data processing activities, provided that the following requirements are met:

a. You shall give us at least sixty (60) days reasonable advance notice before exercising the right to audit;

b. The auditor agrees to market standard confidentiality obligations with us;

c. You and the auditor take measures to minimize disruption to our business operations;

d. The audit will be carried out during regular business hours;

e. We shall not be obliged to provide access to customer data of other customers or systems not involved in the provision of the Services; and

f. You shall pay for all costs of the audit.

11. Deletion and Return of Customer Personal Data

Upon termination or expiration of the Agreement, we will (at your election) delete or return to you all Customer Personal Data (including copies) in our possession or control, save that this requirement will not apply to the extent we are required by law to retain some or all of the Customer Personal Data. If you instruct us to delete Customer Personal Data, Customer Personal Data archived on our back up systems will be protected from further processing, and deleted when the required retention period has passed.

12. Customer Affiliate Communication and Rights

The entering into this DPA in the name and on behalf of a Customer Affiliate as set out in Section 1.2 constitutes a separate DPA between us and that Customer Affiliate, subject to the following:

12.1. Communication. The Customer that is the contracting party to the Agreement shall remain responsible for coordinating all communication with us under this DPA and be entitled to make and receive any communication in relation to this DPA on behalf of its Customer Affiliates.

12.2 Rights of Customer Affiliates. Where a Customer Affiliate becomes a party to the DPA with us, it shall to the extent required under Data Protection Legislation be entitled to exercise the rights and seek remedies under this DPA, subject to the following:

(i) Unless Data Protection Legislation require the Customer Affiliate to exercise a right or seek a remedy under this DPA against MoonBack directly by itself, the parties agree that (i) solely the Customer that is the contracting party to the Agreement shall exercise any such right or seek any such remedy on behalf of the Customer Affiliate, and (ii) the Customer that is the contracting party to the Agreement shall exercise any such rights under this DPA not separately for each Customer Affiliate individually but in a combined manner for itself and all of its Customer Affiliates together.

(ii) The parties agree that the Customer that is the contracting party to the Agreement shall, when an on-site audit of the procedures relevant to the protection of Customer Personal Data is being carried out on its behalf as set forth in Section 10.3 of this DPA, take all reasonable measures to limit any impact on us by combining, to the extent reasonably possible, several audit requests carried out on behalf of itself and all of its Customer Affiliates in one single audit.

For clarity, a Customer Affiliate does not become a contracting party to the Agreement.

13. California Consumer Privacy Act

We make the following additional commitments to you with respect to processing of Customer Personal Data within the scope of the CCPA.

13.1 Our Obligations. We shall comply with the CCPA and treat all Customer Personal Data subject to the CCPA (“CCPA Personal Data”) in accordance with the provisions of the CCPA. With respect to CCPA Personal Data, we are a service provider under the CCPA. We will not (a) sell CCPA Personal Data; (b) retain, use or disclose any CCPA Personal Data for any purpose other than for the specific purpose of providing the Services, including retaining, using or disclosing CCPA Personal Data for a commercial purpose other than providing the Services; or (c) retain, use or disclose CCPA Personal Data outside of our direct business relationship with you. The Processing of CCPA Personal Data authorized by your instructions in the Terms and this DPA is integral to our provision of the Services. You acknowledge and agree that our access to Customer Data does not constitute part of the consideration exchanged under the Agreement. To the extent that any usage data is considered CCPA Personal Data, we are the business with respect to such data and will Process that data in accordance with our Privacy Statement. The terms “business”, “commercial purpose”, “service provider”, and “sell” as used in this Section 13.1 have the meanings given to them in the CCPA. Both parties certify that they understand and will comply with the obligations and restrictions set forth in this DPA and the Agreement as required under the CCPA.

13.2 Customer Obligations. You represent and warrant that you have provided notice to the End-User that the Personal Data is being used or shared in accordance with the terms and conditions envisaged in Section 1798.140(t)(2)(C)(i) of the CCPA. You are responsible for compliance with the requirements of the CCPA applicable to you as a data controller.

14. Governing Law and Dispute Resolution

Section 13 of the Terms shall apply to any Disputes arising out of or related to this DPA, unless required otherwise by Data Protection Legislation.

Annex I, Part A. List of Parties

Data exporter: Customer
‍Data exporter contact details: The address listed in Customer’s account, or Customer’s account owner email address, or to the email address(es) for which Customer elects to receive notices under the Agreement.
‍Data exporter role: The data exporter’s role is outlined in Section 4 of the DPA.
‍Signature and date: If and when applicable, data exporter is deemed to have signed the Standard Contractual Clauses incorporated herein as of the Effective Date of the DPA.

Data importer: MoonBack B.V.
‍Data importer contact details: Trompenburgstraat 2-C, 1079TX, Amsterdam, The Netherlands, Data Protection Officer - privacy@MoonBack.com
‍Data importer role: The data importer acts as data processor.
‍Signature and date: If and when applicable, data importer is deemed to have signed the Standard Contractual Clauses incorporated herein as of the Effective Date of the DPA.

Annex I, Part B. Description of Transfer

​​1. Categories of data subjects whose Personal Data is transferred:

• Users. Customer’s contact persons (natural persons) or employees, contractors or temporary workers (current, prospective, former) using the Services through the Customer’s account (“Users”);
• End-Users. Any individual (i) whose contact details are included in the Customer's contacts list(s); (ii) whose information is stored on or collected via the Services, or (ii) to whom Customer sends communications or otherwise engage or communicate with via the Services (collectively, “End-Users”). You as the Customer solely determine the categories of data subjects included in the communication sent over our communication platform.

2. Categories of Personal Data transferred:

Customer Personal Data contained in, communication content, traffic data, End-User data, and customer usage data.

• Communication content, which may include Personal Data or other personalized characteristics, depending on the communication content as determined by you as the Customer.
• Traffic data, which may include Customer Personal Data about the routing, duration or timing of a communication such as voice call, SMS or email, whether it relates to an individual or a company.
• End-User data, such as phone number, email address, first name, last name, profile name, country, channel identifier.
• Customer usage data, may contain data that can be linked to you as an individual included in statistical data and information related to your account and service activities, service related insights and analytic reports regarding communication sent and customer support.

3. Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

• Customer content. Sensitive data may, from time to time, be processed via the Services where you or your End-Users choose to include sensitive data within the communications that are transmitted using the Services. You are responsible for ensuring that suitable safeguards are in place prior to transmitting or processing, or prior to permitting your End-Users to transmit or process any sensitive data via the Services, in accordance with Section 3.2 of the Agreement.
• Traffic data, End-User data, and customer usage data. No sensitive data is contained in traffic data, End-User data, or customer usage data.

4. The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): Customer Personal Data is transferred on a continuous basis for the duration of the Agreement.

5. Nature of the processing: We will process Customer Personal Data to the extent necessary to provide the Services under the Agreement. We do not sell any Personal Data, including Customer Personal Data, and do not share Personal Data with third parties for compensation or for those third parties’ own business interests.

6. Purpose(s) of the data transfer and further processing: We will process Customer Personal Data as a data processor in accordance with instructions of Customer as set forth in this DPA, unless processing is necessary for compliance with a legal obligation to which we are subject, in which case we will classify as a data controller.

Communication content, traffic data, End-User data, and customer usage data. Personal Data contained in communication content, traffic data, End-User data, and customer usage data will be subject to the following basic processing activities:

• Communication content. The provision of programmable communication products and services, offered in the form of application programming interfaces (APIs) or via the Dashboard, to Customer, including transmittal to or from Customer’s software application from or to our communication platform, and other communications networks.
• Traffic data. Traffic data is processed for the purpose of transmitting communication on an electronic communications network or for the billing in respect of that communication. This may include Customer Personal Data about the routing, duration or timing of a communication such as voice call, SMS or email, whether it relates to an individual or a company.
• End-User data. Personal Data of End-Users is required in order to perform the Services and will only be processed for the purposes of communication transmission, customer support, and ensuring compliance with legal obligations of MoonBack.
• Customer usage data. Personal Data contained in customer usage data will be subject to the processing activities of providing the Services under the Agreement, with the aim of providing Customer with Services related insights and analytic reports regarding the communication sent, customer support, and continuous improvement of the Services.

7. The period for which the Personal Data will be retained, or, if that is not possible, the criteria used to determine that period:

• Customer content and traffic data.For customer content and traffic data contained in the SMS and Voice Services a retention period of six months applies;
  
  For the Services of 24sessions customer content and traffic data are retained for a minimum of 30 days up to the duration as agreed upon with you;
  
  For all other services, customer content and traffic data are retained for the duration of the Services, except if you delete customer content or traffic data via the technical and organizational measures provided to you via the Services.
• End-User data. End-User data will be processed for the duration determined by the Customer, when End-User data is included in your contact profiles the default retention period is for the duration of the Services, subject to Section 6(c) of this Annex I, Part B.
• Customer usage data. Upon termination of the Agreement, we may retain, use, and disclose Customer Usage Data for the purposes set forth in Section 6(d) of this Annex I, Part B, subject to the confidentiality obligations set forth in the Agreement. We will anonymize or delete customer usage data when we no longer require it for the purposes set forth in Section 6(d) of this Annex I, Part B.

8. For transfers to (sub)processors, also specify subject matter, nature and duration of the processing: For transfers to Subprocessors, the subject matter and nature of the processing is outlined and the duration is for the duration of the Agreement.