Customer Cloud Hosted Software Agreement
IMPORTANT – YOU SHOULD READ THIS AGREEMENT CAREFULLY BEFORE USING THIS SOFTWARE. BY (i) PROCEEDING WITH AN ORDER FOR SOFTWARE, AND/OR INSTALLATION OR UPGRADE OF THE SOFTWARE, AFTER RECEIVING A COPY OF THIS DOCUMENT; OR (ii) CLICKING “I Accept the Terms of the Licence Agreement,” DURING INSTALLATION OF THE SOFTWARE, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTAND THIS AGREEMENT AND AGREE TO ABIDE BY ITS TERMS AND CONDITIONS.
This is a software licence agreement (‘Licence Agreement’) between you (‘you’ or ‘Licensee’) and Cytrack Intelligence Systems Pty Ltd (‘Cytrack’) for use of the software provided by Cytrack (‘Software’) that will be hosted by the Customer on your own cloud environment (‘Cloud Environment’). Please read the terms and conditions of this Licence Agreement before using the Software. By verifying and/or using the Software, you are agreeing to be legally bound by this Licence Agreement and the terms and conditions set out below.
By entering into this Licence Agreement, you also agree to be bound by Cytrack’s Terms and Conditions. You may also order additional support services, which will be subject to Cytrack’s Support Services Terms and Conditions.
Ordering, collection and delivery
- You may place an order for a subscription to the Software by completing and signing the order form provided by Cytrack. The order must specify:
- your name and contact details, as prompted;
- the Software to be selected for the subscription;
- the minimum term for your subscription (‘Minimum Term’) from the options available on the order form;
- the regular invoicing cycle (‘Subscription Period’) and subscription fee payable for each Subscription Period (‘Subscription Fees’) based on the options selected in your order;
- details of the Cloud Environment (which must comply with the Cloud Specifications (as defined in clause 9)) including the initial Cloud Environment Provider (as defined in clause 9(c)); and
- any other information required by mandatory fields on the order form.
- No order is binding upon Cytrack until its acceptance is confirmed in writing by Cytrack, or Cytrack provides the Software that is the subject of the order. Cytrack may reject an order, or part of an order, in its absolute discretion.
- Where there is any inconsistency between:
- the order form;
- the Customer Cloud Hosted Software Agreement;
- the Terms and Conditions; and
- the Support Services Terms and Conditions,
- in respect of the Software, the document listed higher in the list will prevail over a document listed lower to the extent of the inconsistency.
- Cytrack will make available a download, disc or other media containing files for installing the Software on the Cloud Environment (‘Software Media’). You may, at your option, collect the Software Media from Cytrack’s premises, or arrange freight on your own behalf. Alternatively, freight will be arranged on your behalf by Cytrack and charged to you at the applicable rate.
- In consideration of the Licensee’s payment of the relevant fees to Cytrack, Cytrack grants the Licensee a limited, non-exclusive, non-transferable licence to use the Software, program copies, documentation, and related materials, including any Software Updates defined in clause 7 below (collectively, the ‘Licenced Material’):
- during the Term;
- for the internal business purposes of the Licensee and for no other purpose; and
- in accordance with the terms and conditions set out in this Licence Agreement.
- You acknowledge and agree that as between the parties, Cytrack retains the title to its Licenced Material, and all intellectual or industrial property rights therein, whether or not made or authorised by Cytrack. All rights not expressly granted to the Licensee are reserved and retained by Cytrack.
- Cytrack may make available updates, modifications, enhancements or new releases to the Software from time to time (‘Software Updates’). Cytrack may, in its absolute discretion, provide specific Software Updates to the Licensee from time to time. Unless otherwise agreed in writing by Cytrack, any Software Updates that are provided to address any defects must be implemented by Licensee within a reasonable time of receiving the Software Update.
- The Licensee might also receive Software produced by other companies as part of a ‘bundle’ of utility Software (‘Bundled Software’). This Software might have been included in the Cytrack product to enhance productivity. Bundled Software is provided under licence from the original manufacturer. In the absence of a discrete licence from the manufacturer to the customer, the Licensee is permitted to use the Bundled Software under the same terms as this licence from Cytrack. The Licensee agrees to be legally bound by the provisions of this licence for use of any and all Bundled Software included with the Software that does not have its own licence included in its packaging. Under the provisions of this Licence Agreement, ‘Bundled Software’ is included in the terms ‘Licenced Material’ and ‘Software’.
- This Software is designed to be used only on cloud environments and infrastructure that comply with Cytrack’s technical requirements (‘Cloud Specifications’). The Cloud Specifications will be provided within the proposal and/or in consultation with our deployment planning team. You may:
- only use the Software in the format specified in the order form documentation;
- install the Software on:
- one (1) primary production Cloud Environment, and use and access such Software in accordance with and subject to the terms of this Licence Agreement;
- (such other additional Cloud Environments (if any) specified in the order for the Software,
- sub-licence your rights to install the Software to the third party provider of the Cloud Environment (“Cloud Environment Provider”) specified in the order (or to any replacement provider approved by Cytrack in accordance with sub-clause 9(d)), but only to the extent required for Licensee to use the Software in accordance with the terms of this Licence Agreement; and
- not change the Cloud Environment Provider for any of the above environments without Cytrack’s prior written consent (such consent not be unreasonably withheld or delayed where the alternative provider offers environments that comply with the Cloud Specifications),
but for no other purpose.
- You must not:
- copy, resell, distribute or transfer all or any part of the Software or Licenced Material except as permitted under the Copyright Act 1968 (Cth) (‘Copyright Act’);
- provide access to the Software or Licenced Material to any person other than:
- your personnel who reasonably require access to the Software and Licenced Material in order for Licensee to utilise the Software for its internal business purposes; and
- the current Cloud Environment Provider and its personnel, to the extent required for that provider to provide Licensee with the Cloud Environments;
- sub-license (other than pursuant to sub-clause 9(c)) or sub-contract any of its rights under this Licence Agreement without the written consent of Cytrack, which may by withheld in its absolute discretion;
- attempt to circumvent usage limits or quotas or avoid incurring fees;
- merge all or any part of any software contained in or provided in connection with the Software with any other software without Cytrack’s prior written permission;
- commercially exploit the Software;
- make any part of the Software available to any third party other than to the then current Cloud Environment Provider;
- distribute or transmit any part of the Software by any means;
- link to, frame or mirror any part of the Software without Cytrack’s written consent;
- attempt to disassemble, decompile or otherwise reverse engineer or reverse compile the Software, except as permitted under the Copyright Act;
- alter, customise, modify, tamper with or create derivative works of the Software or Licenced Material;
- use the Software on hardware other than a Cloud Environment that complies with the Cloud Specifications;
- remove, obliterate or alter any proprietary notice on the Software or Licenced Material; or
- use or encourage, promote, facilitate or instruct others to use Software or any other software provided in connection with Software for any illegal, harmful or offensive use, or to transmit, store, display, distribute or otherwise make available content that is illegal, harmful or offensive.
- During the Term you may make and keep one (1) uninstalled copy of the Software solely for system back-up, emergency start-up, disaster recovery and security purposes. Such copy must be externally labelled as Licenced Material, and must contain all proprietary notices.
- On at least 14 days written notice and no more than once in any 12 month period, the Licensee must permit Cytrack to audit the Licensee’s use of the Software and will provide Cytrack with access to any books, computer systems, personnel, records and other information relating to the Licensee’s use of the Software as Cytrack may request. If Cytrack requires the installation of additional software tools on the Cloud Environment or specific reports to be generated by the Software in order to conduct such audit, Licensee must cooperate with Cytrack in installing such tools and otherwise generating and providing such reports. Cytrack may engage a third party to conduct the audit on its behalf, provided that any such auditor agrees to be bound by obligations of confidentiality, and any audit must be conducted during business hours and in a manner which minimises any disruption to the Licensee’s business. If the audit reveals use of the Software in violation of the Licence Agreement or in excess of the permitted usage limits, in addition to paying any true up of licences or additional Subscription Fees to reflect the actual use of the Software, the Licensee must also reimburse Cytrack for the reasonable costs of the audit.
- The Licensee shall notify Cytrack immediately if the Licensee becomes aware of any unauthorised use of the whole or part of the Software by any person. Multiple copies of the Software in excess of the licenced number of users is a violation of this licence, whether on a single or multiple networks.
- As you have selected the “customer cloud hosted” option for the Software, you acknowledge and agree that:
- you are solely responsible for implementing appropriate security controls and measures to protect the Software and your data from any unauthorised access, modification, use or disclosure and from misuse, interference and loss; and
- you will implement IT security measures required to comply with applicable laws and which are otherwise consistent with industry best practices in connection with your use of the Software and any data that may be accessed or processed by the Software, including appropriate access controls, encryption, anti-virus and anti-ransomware tools.
- Cytrack strongly recommends you regularly backup your data to an independent storage facility (separate to the Cloud Environment) to guard against catastrophic loss of data.
- Provision and use of Software Updates is subject to Cytrack’s Support Services Terms and Conditions.
- You may order support services subject to Cytrack’s Support Services Terms and Conditions.
- This Licence Agreement applies to any other services provided by Cytrack in connection with the Software, including deployment, installation, configuration or other services.
- The Licensee must pay the relevant Subscription Fees to Cytrack in advance of each Subscription Period in accordance with this document and Cytrack’s Terms and Conditions and Support Services Terms and Conditions.
- Cytrack reserves the right to review and adjust the Subscription Fees, provided that:
- Cytrack may not increase the Subscription Fees during the Minimum Term;
- Cytrack may not increase the Subscription Fees by more than 10% per year; and
- Cytrack must provide the Licensee with thirty (30) days written notice of the new Subscription Fees prior to the new Subscription Fees coming into effect.
- The licence is effective on the date the Licensee acquires the Licenced Material, and will remain in force until this Licence Agreement is terminated in accordance with its terms (“Term”).
- The Licensee may terminate this Licence Agreement:
- at or after the end of the Minimum Term, by giving at least ninety (90) days prior written notice to Cytrack;
- as at the day before a proposed increase in the Subscription Fees, by giving written notice to Cytrack within fourteen (14) days of receiving a notice under clause 20(c);
- in accordance with clause 38 if Licensee does not agree to a change notification; or
- immediately on written notice on the happening of one of the following events:
- Cytrack’s unremediable breach of any of its obligations under this Licence Agreement or Cytrack’s Terms and Conditions;
- Cytrack’s unremedied breach of any of its obligations under this Licence Agreement or Cytrack’s Terms and Conditions after having been given 60 days written notice to remedy such breach;
- the occurrence of any of the following events with regard to Cytrack’s affairs:
- any step is taken to enter into any scheme of arrangement with creditors,
- any step is taken to appoint a receiver or manager, a liquidator, an administrator or other like person,
- the suspension of debts generally, or
- Cytrack is deemed insolvent for the purposes of any provision of the Corporations Act 2001 (Cth) (‘Corporations Act’) or corresponding applicable laws.
- Cytrack may terminate this Licence Agreement immediately if payment of the applicable Subscription Fee is not received by the start of any Subscription Period.
- Cytrack may terminate this Licence Agreement immediately on written notice on the happening of one of the following events:
- your unremediable breach of any of your obligations under this Licence Agreement or Cytrack’s Terms and Conditions;
- your unremedied breach of any of your obligations under this Licence Agreement or Cytrack’s Terms and Conditions after having been given 30 days written notice to remedy such breach;
- the occurrence of any of the following events with regard to your affairs:
- any step is taken to enter into any scheme of arrangement with creditors,
- any step is taken to appoint a receiver or manager, a liquidator, an administrator or other like person,
- the suspension of debts generally, or
- you are deemed insolvent for the purposes of any provision of the Corporations Act 2001 (Cth) or corresponding applicable laws;
- your merger or takeover by another party.
- Upon termination of this Licence Agreement for any reason, you must immediately cease using the Software and Licenced Materials and destroy or return to Cytrack all copies of the Software and Licenced Materials in your possession or control.
- In this Licence Agreement:
- “Australian Consumer Law” means schedule 2 of the Competition and Consumer Act 2010 and any equivalent state or territory legislation; and
- “Consumer” has the meaning given in the Australian Consumer Law; and
- “Consumer Guarantee” means a right or guarantee under Part 3-2 (Division 1) of the Australian Consumer Law that cannot lawfully be excluded.
- The Australian Consumer Law provides Consumers with a number of Consumer Guarantees that cannot be excluded or limited. The limitations of liability set out in this Licence Agreement are therefore subject to, and will not apply to the extent that they limit or exclude any Consumer Guarantees that may apply to you if you are a Consumer. However where the Australian Consumer Law permits us to limit the remedies for a breach of such Consumer Guarantees we do so in accordance with clause 28.
- Subject to clause 27, Cytrack’s liability to you in connection with this Licence Agreement and the supply of goods and provision of services by Cytrack (including in respect of any breach of or failure to comply with any applicable Consumer Guarantee) is limited to any one or more of the following as Cytrack determines in its absolute discretion:
- in relation to goods:
- replacing or repairing the goods;
- supplying an equivalent item of the goods;
- paying the cost of replacing or repairing the goods; or
- paying the cost of acquiring equivalent goods; and
- in relation to services:
- supplying the services again; or
- the payment of the cost of having the services supplied again.
- in relation to goods:
- To the maximum extent permitted by law and without limiting your rights and our obligations under the Australian Consumer Law (which are subject to clauses 27 and 28):
- the Licensee expressly acknowledges and agrees that the use of the Licenced Material is at its own risk. The Licenced Material is furnished ‘as is’ and without warranty of any kind;
- Cytrack does not warrant that the Licenced Material or its functions will meet the Licensee’s requirements or that the operation of the Software will be uninterrupted. The entire risk as to the use of the Software shall be borne by the Licensee;
- Cytrack is not responsible for the security of the Cloud Environment or any data you may process via the Software or store in the Cloud Environment, and Cytrack is not liable for any loss or damage you or any third party may suffer or incur in connection with any loss, interference or misuse of such data, or unauthorised access, modification, use or disclosure of any such data;
- Cytrack shall not be responsible for any costs, loss or damage associated with loss of data, recreating data, substitute equipment or programs, claims by third parties or similar costs;
- Cytrack will not be liable, in any respect, for any claim, liability, cost, loss or damage resulting from or arising directly or indirectly from:
- any changes or works of the kind described in clause 23 of the Cytrack Terms and Conditions carried out without Cytrack’s prior agreement;
- any changes to the Software or Cloud Environment made by or on behalf of the Licensee, whether or not carried out with Cytrack’s prior agreement;
- any breach by the Licensee of this Agreement, the Cytrack Terms and Conditions or any other agreement with Cytrack; or
- any negligence on the part of the Licensee;
- Cytrack excludes:
- any term, condition or warranty that may otherwise be implied by custom, law or statute;
- any liability for loss caused by the negligence of Cytrack;
- any liability for any indirect or consequential loss or damage suffered or incurred by you or any other person; and
- any liability for any loss of revenue, loss of income, loss of business, loss of profits, loss of goodwill or credit, loss of business reputation, loss of use, loss of time, loss of interest, damage to credit rating or loss or denial of opportunity suffered or incurred by you or any other person; and
- in respect of any liability which is not otherwise excluded under this Licence Agreement, Cytrack’s maximum aggregate liability to you for all claims under or in connection with this Licence Agreement, whether arising under contract, tort (including negligence), statute or otherwise, is equal to and shall not exceed an amount which is equal to the Subscription Fees paid by the Licensee for the Software in the 3-month period preceding the date of a claim.
- Some countries and states do not allow the exclusion of implied warranties, terms or conditions, so the above exclusions may not apply to you if and to the extent not permitted under those laws.
- Please refer to Appendix A Privacy and Personal Information
- Please refer to Appendix B Data Transfer Agreement for STANDARD CONTRACTUAL CLAUSES Cytrack, within the context of the execution of its End-User License Agreement (hereafter referred to as “EULA”) commits to respect the following Standard Contractual Clauses pursuant to European Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries
- This Licence Agreement shall be governed and construed in accordance with the laws of Australia and the State of Queensland. Furthermore it is understood that this Licence Agreement shall be treated as though it were executed in Queensland and the parties agree that any action relating to this Licence Agreement shall be instituted and prosecuted in the courts of the competent jurisdiction of the State of Queensland.
- If for any reason, a court of competent jurisdiction finds any provision or portion of this Licence Agreement unlawful, void, or for any reason unenforceable, it shall be deleted and shall in no way affect the enforceability of any other provisions of this Licence Agreement.
- Should you have any questions regarding this Licence Agreement, you may call your local office available at www.cytrack.io or write to Cytrack.
- proceeding with an order for Software and/or installation or upgrade of the software, after receiving a copy of this document or a link to this document available on Cytrack’s website; or
- clicking “I Accept the Terms of the Licence Agreement,” during installation of the Software, you acknowledge that you have read and understand this Licence Agreement and agree to abide by its terms and conditions.
- Except as expressly stated, this Licence Agreement is the complete and exclusive agreement between us concerning the Software and supersedes all prior agreements, proposals or communications, verbal or written between us relating to the subject matter in this Licence Agreement.
- Cytrack reserves the right to amend, revise or replace this Licence Agreement from time to time by posting a notification via the Software (each a “change notification”). By:
continuing to use the Software on or following the change effective date (defined below) after receiving such a change notification; or
Bundled software licence information
Security and data back-up
Effective date and termination
Australian consumer law
Disclaimer on warranties and limitation of liability
Privacy opt in/opt out and spamming
Governing law and severability
clicking “I accept the terms of the amended Licence Agreement,” you acknowledge that you have read and understand the amended Licence Agreement and agree to abide by its terms and conditions. Amendments, revisions and replacements will be effective sixty (60) days after posting the change notification, or on a later effective date specified in the change notification (“change effective date:), unless this Licence Agreement is terminated earlier. If you believe any amendments in a change notification adversely impact you (for example, they increase your risk or liability, or diminish your rights or our obligations), you may notify Cytrack that you object to the proposed change in writing within 30 days after receipt of the change notification. Unless Cytrack agrees in writing to your objection (and, for example, confirms in writing that the change notification in its entirety or one or more specific changes in the change notification will not apply to you), then you have the right, within 30 days after receipt of the change notification, to elect to terminate the Licence Agreement on 14 days’ written notice to Cytrack. If you elect to terminate the Licence Agreement pursuant to this clause, then Cytrack will provide you with a pro-rata refund of pre-paid fees that relate to the period following the effective date of termination.
Appendix A Privacy and Personal Data
Description of the processing
Details of the provided services and processing operations carried out accordingly: Please review our policy statement for further details
Purposes of the processing: Please review our policy statement for further details
Term of the processing: termination of the Agreement relationship
Types of personal data processed: Please review our policy statement for further details
Categories of data subjects: Licensee’s employees and prospects; licensee’s clients.
The present article applies in the case of the execution of the present Agreement subscribed by the Licensee with Cytrack.
As part of the performance of the services covered by the Agreement, Cytrack may be required to process Licensee’s Data (“Data” meaning any information filled by the Licensee into the Software).
If Licensee Data contains Personal Data (“Personal Data” meaning any information relating to an identified or identifiable natural person), each Party undertakes to comply with its obligations under the Applicable Regulations (“Applicable Regulations” meaning Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, the laws and regulations ratifying, transposing, supplementing or replacing Regulation (EU) 2016/679 and the guidelines, recommendations or codes of good practice issued by the competent national supervisory authorities, as well as any other relevant data protection national law).
The Parties undertake not to commit any act likely to put the other Party in a position of violation of the said Applicable Regulations. Amendment to this Agreement shall be made when needed for ensuring compliance with law.
It is specified between the Parties that if specific requirements resulting from the processing of Data increase the workload of Cytrack, the Parties shall agree on an amendment to consider the conditions, particularly financial, of this extension.
Each Party undertakes to comply with all the legal obligations applicable with regard to the protection of personal data and privacy, in particular European Regulation 2016/679, the laws and regulations supplementing, ratifying or transposing them and the recommendations of any independent public authority established by a Member State of the European Union and responsible for monitoring the compliance of the Parties with the Applicable Regulation (“Supervisory Authority”).
It is further specified that the Parties shall detail the technical and organisational security measures that each Party undertakes to implement in accordance with Article 32 of European Regulation 2016/679.
II. Licensee’s Obligations
The Licensee is solely liable and guarantees the quality, lawfulness and relevance of the Licensee’s Data.
The Licensee also guarantees to be the holder of the rights allowing it to process and have the Data processed by Cytrack. The Licensee guarantees Cytrack at first request against any prejudice that would result from Cytrack being held liable by a third party for a breach of this guarantee.
Cytrack guarantees to provide functionality to anonymise the Data in accordance with the Applicable Regulations.
The Licensee, as data controller according to the Applicable Regulation, warrants Cytrack that the processing meets the requirements of the Applicable Regulation, in particular that the Personal Data are processed in a lawful, fair and transparent manner, that they have been collected for specific, explicit and legitimate purposes and that the information required by the data subjects by the processing has indeed been provided to them at the time of Data collection.
As such, the Licensee guarantees Cytrack against any legal action, complaint or claim from a natural person whose Personal Data would be processed by Cytrack on behalf of the Licensee and, consequently, to indemnify Cytrack.
The Licensee undertakes to document, in writing, any instructions concerning the processing of Personal Data by Cytrack. In this respect, the Licensee undertakes to provide, when executing the Agreement, details of the concerned processing in the Appendix “Description of the processing” and to make available to Cytrack all information necessary for the proper performance of this Agreement.
The Licensee shall ensure, beforehand and throughout the processing period, that Cytrack complies with the obligations set out in the Applicable Regulations, in particular by carrying out Audits in accordance with the “Audit” Article set out below.
III. Cytrack’s Obligations
Within the limits of the provisions of the Article “Disclaimer on warranties” of the Agreement, Cytrack shall make its best efforts to preserve the security, integrity and confidentiality of the Data with regard to the legal obligations.
Cytrack, as a data processor within the meaning of the Applicable Regulations, will implement, for those which concern it, the appropriate technical and organisational measures so that the processing operations, carried out on behalf of the Licensee, meet the requirements of the Applicable Regulations. It is expressly agreed that Cytrack:
- processes the Data only for the purpose(s) which are stated in the Appendix “Description of the processing operation”;
- will only process the Data on the Licensee’s written and documented instructions, including with regard to transfers to third countries. Furthermore, if Cytrack is required to transfer Data to a third country or international organisation under the law of the Union or the law of the Member State to which Cytrack is subject, it shall inform the Licensee of this legal obligation before processing, unless the legislation concerned prohibits such information on important grounds of public interest;
- immediately inform the Licensee if Cytrack considers that an instruction given by the Licensee constitutes a violation of the Applicable Regulations. The Parties specify that in the context of the subject matter of the Agreement, Cytrack shall not be required to ensure effective compliance or to advise the Licensee with regard to the Applicable Regulations concerning the processing carried out by the Licensee;
- ensure that the persons authorised to process the Data undertake to respect confidentiality or are subject to an appropriate legal obligation;
- may sub process all or part of the processing activities carried out on behalf of the Licensee. In the event of a planned change concerning the addition or replacement of one or more sub- processors, Cytrack shall also inform the Licensee, thus giving him the possibility to object to these changes;
- imposes the same obligations as those set out herein on its sub-processors;
- shall notify the Licensee of any breach of Personal Data, as soon as possible from the time it became aware of it, ] being specified that it is the Licensee’s duty to notify such breach to the competent supervisory authority and to the data subjects, as the case may be. Nevertheless, assistance may be provided by Cytrack in the context of these notifications, at the Licensee’s request and in accordance with the procedures discussed between the Parties;
- at the Licensee’s option, deletes any Personal Data collected or returns them to the Licensee at the end of the Agreement, and destroys existing copies, unless otherwise provided by law;
- provides the Licensee with all the information necessary to demonstrate compliance with its obligations and to enable audits to be carried out.
- Subject to what is permitted under Applicable Regulation, if Cytrack receives a request or complaint from a Supervisory Authority regarding any Personal Data, it shall without delay notify Licensee identifying the Authority, the scope of the request and grounds presented for the request or complaint.
Data processing assistance
As part of its obligation to assist the Licensee, Cytrack undertakes, where applicable under financial conditions to be defined between the Parties, to:
- assist the Licensee, through appropriate technical and organizational measures, to the maximum extent possible, in fulfilling its obligation to respond to requests from the data subjects relating to their rights;
- help the Licensee to guarantee compliance with security obligations. It is understood between the Parties that Cytrack’s commitments relate only to the means it is able to implement to ensure the confidentiality and security of the Personal Data;
- assist the Licensee in the context of notifications of Personal Data violations and when the Licensee decides to carry out a privacy impact assessment relating to Personal Data protection as well as, if necessary, for the prior consultation to the supervisory authority, by providing any useful documentation at its disposal that the Licensee does not hold.
The Parties agree on the principle that the assistance provided to the Licensee by Cytrack under this clause is carried out taking into account the nature of the processing and the level of information Cytrack receives from the Licensee and within the limits of the obligations that it shall comply with. Additional requests for assistance not covered by this Agreement shall give rise to a specific agreement between the Parties.
Cytrack is located in Australia. The Licensee acknowledges that Australia is not deemed a country granting adequate level of protection to Personal Data according to the European Union Commission. Therefore, the ground for international transfer of Licensee’s Personal Data is the commitment from Cytrack to comply with the standard contractual clauses referenced in Appendix B.
Cytrack may need to transfer Licensee’s Personal Data to its sub-processors. Licensee will be informed by Cytrack of the identity, location and legal ground associated with each international transfer of its Personal Data beforehand.
In the event of an instruction given by the Licensee involving a transfer of Data to a third country, Cytrack guarantees the Licensee that any such transfers will be carried out in compliance with the Applicable Regulations.
The Licensee, during the performance of the Agreement, within the limit of one (1) time every 12 months, has the possibility to carry out, at its own expense and under its responsibility, an audit whose purpose is to verify the conformity of the services performed by Cytrack on behalf of the Licensee from a Personal Data processing perspective.
This audit is notified by the Licensee to Cytrack by registered letter with acknowledgement of receipt detailing the documents requested and, where applicable, the protocol that will be carried out, the methods used and the data audited, thirty (30) working days before the planned date of its implementation.
It is expressly agreed between the parties that, as far as possible, a desk audit is preferred and that an on-site audit will be scheduled if the elements made available by Cytrack are not sufficient to demonstrate compliance with its obligations under this clause.
In this second case, the Licensee assumes the additional costs resulting in particular from the need for an increase in staff to enable the audit to be carried out and Cytrack’s activity to continue.
The audit is carried out by the Licensee or by a third party designated by the Licensee, provided that this third party is not a direct or indirect competitor of Cytrack, that it is subject to professional confidentiality and that it has entered into a confidentiality agreement, a copy of which will be submitted to Cytrack for approval.
It is also understood that this audit approach excludes any communication of documents of a financial or accounting nature or relating to Cytrack’s relations with other Licensees.
The audit will be conducted during Cytrack’s working hours.
The audit results will be the subject of an adversarial debate and validation by the Parties.
Cytrack may not communicate all or part of this audit without the Licensee’s written authorisation.
Audit costs will remain the responsibility of the Licensee, as well as any costs incurred and time spent by Cytrack.
Appendix B Data Transfer Agreement
STANDARD CONTRACTUAL CLAUSES
Cytrack, within the context of the execution of its End-User License Agreement (hereafter referred to as “EULA”) commits to respect the following Standard Contractual Clauses pursuant to European Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries
For the purposes of the Clauses:
- ‘personal data’, ‘special categories of data’, ‘process/processing’, ‘controller’, ‘processor’, ‘data subject’ and ‘supervisory authority’ shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ;
- ‘the data exporter’ means the controller who transfers the personal data, meaning the Licensee under the EULA’s terms;
- ‘the data importer’ means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country’s system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC, meaning Cytrack;
- ‘the subprocessor’ means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;
- ‘the applicable data protection law’ means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established;
- ‘technical and organisational security measures’ means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.
Details of the transfer
The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 which forms an integral part of the Clauses.
Third-party beneficiary clause
- The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.
- The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.
- The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
- The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.
Obligations of the data exporter
The data exporter agrees and warrants:
- that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;
- that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter’s behalf and in accordance with the applicable data protection law and the Clauses;
- that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this contract;
- that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;
- that it will ensure compliance with the security measures;
- that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;
- to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;
- to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;
- that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and
- that it will ensure compliance with Clause 4(a) to (i).
Obligations of the data importer
The data importer agrees and warrants:
- to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
- that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
- that it has implemented the technical and organisational security measures specified in Appendix 2 before processing the personal data transferred;
- that it will promptly notify the data exporter about:
- any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation,
- any accidental or unauthorised access, and
- any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;
- to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;
- at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;
- to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;
- that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent;
- that the processing services by the subprocessor will be carried out in accordance with Clause 11;
- to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data exporter.
- The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensation from the data exporter for the damage suffered.
- If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity.
The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities.
- If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the subprocessor agrees that the data subject may issue a claim against the data subprocessor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the subprocessor shall be limited to its own processing operations under the Clauses.
Mediation and jurisdiction
- The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject:
- to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;
- to refer the dispute to the courts in the Member State in which the data exporter is established.
- The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.
Cooperation with supervisory authorities
- The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.
- The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.
- The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any subprocessor preventing the conduct of an audit of the data importer, or any subprocessor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5 (b).
The Clauses shall be governed by the law of the Member State in which the data exporter is established.
Variation of the contract
The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.
- The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on the data importer under the Clauses . Where the subprocessor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the subprocessor’s obligations under such agreement.
- The prior written contract between the data importer and the subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
- The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established.
- The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5 (j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.
Obligation after the termination of personal data processing services
- The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.
- The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1.
to the Standard Contractual Clauses
This Appendix forms part of the Clauses.
Data exporter: Licensee
The data exporter is a Licensee of data importer’s software services. It uses data importer’s technology within the framework of its customer services.
Data importer: Cytrack
The data importer is a provider of software services for its Cytrack Telephony Applications and Call Centre Solutions
The customers of Licensee’s, having purchased the Data exporter’s goods or services and needing after sales services or assistance.
Data exporter’s employees using data importer’s software within the scope of their job description.
Categories of data
to the Standard Contractual Clauses
This Appendix forms part of the Clauses.
Cytrack commits to protect all Personal Data subject to these Clauses and to implement adequate security measures as described in the EULA.
 Parties may reproduce definitions and meanings contained in Directive 95/46/EC within this Clause if they considered it better for the contract to stand alone.
 Mandatory requirements of the national legislation applicable to the data importer which do not go beyond what is necessary in a democratic society on the basis of one of the interests listed in Article 13(1) of Directive 95/46/EC, that is, if they constitute a necessary measure to safeguard national security, defence, public security, the prevention, investigation, detection and prosecution of criminal offences or of breaches of ethics for the regulated professions, an important economic or financial interest of the State or the protection of the data subject or the rights and freedoms of others, are not in contradiction with the standard contractual clauses. Some examples of such mandatory requirements which do not go beyond what is necessary in a democratic society are, inter alia, internationally recognised sanctions, tax-reporting requirements or anti-money-laundering reporting requirements.
 This requirement may be satisfied by the subprocessor co-signing the contract entered into between the data exporter and the data importer under this Decision.