Subscription Service Software Agreement - Cytrack Customer Experience Technology

Cytrack Subscription Service Software Agreement

Important

YOU SHOULD READ THIS AGREEMENT CAREFULLY BEFORE USING THIS SOFTWARE. BY (i) PROCEEDING WITH AN ORDER FOR SOFTWARE, AND/OR UPGRADE OF THE SOFTWARE, AFTER RECEIVING A COPY OF THIS DOCUMENT; OR (ii) CLICKING “I Accept the Terms of the Licence Agreement,” WHEN REGISTERING FOR OR USING THE SOFTWARE, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTAND THIS AGREEMENT AND AGREE TO BE BOUND AND ABIDE BY ITS TERMS AND CONDITIONS.

This is a software subscription agreement (‘Licence Agreement’) between you (‘you’ or ‘Licensee’) and Cytrack Intelligence Systems Pty Ltd (‘Cytrack’) for use of the online software system provided by Cytrack (‘Software’). This is not an agreement for sale of the Software. This is a licence agreement only. Please read the terms and conditions of this Licence Agreement before using the Software. By verifying and/or using the Software, you are agreeing to be legally bound by this Licence Agreement and the terms and conditions set out below.

By entering into this Licence Agreement, you also agree to be bound by Cytrack’s Terms and Conditions. You may also order additional support services, which will be subject to Cytrack’s Support Services Terms and Conditions.

Ordering

You may place an order for a subscription to the Software by completing and signing the order form provided by Cytrack. The order must specify:
1. your name and contact details, as prompted;
2. the services to be selected for the subscription;
3. the minimum term for your subscription (‘Minimum Term’) from the options available on the order form;
4. the regular invoicing cycle (‘Subscription Period’) and subscription fee payable for each Subscription Period (‘Subscription Fees’) based on the options selected in your order; and
5. any other information required by mandatory fields on the order form.

Subscription accounts

Cytrack will set up:
1. an administrator account associated with the Licensee’s subscription (‘Administrator Account’); and
2. linked accounts for each individual (‘User’) permitted to use the Software (each a ‘User Account’), if you request it and provide the relevant Users’ details;
and will provide the access details required to access each account to the Licencee or each relevant User.

The Licensee’s nominated administrator may use the Software:
1. to create additional User Accounts;
2. to modify User Accounts; and
3. to delete User Accounts.
Each User Account may only be used by the nominated User associated with the User Account.

The Licensee shall ensure that its Administrator Account and each User Account is protected at all times from misuse or any form of unauthorised use or access. The Licensee shall be solely responsible for the use, supervision, management and control of its accounts. The Licensee is responsible for all activities that occur under the accounts regardless of whether the activities are undertaken by the Licensee, its employees, permitted users or a third party. The Licensee must notify Cytrack immediately if it believes an unauthorised third party may be using or attempting to use one of its accounts. Cytrack is not responsible for unauthorised access to an account.

Licence

In consideration of the Licensee’s payment of the relevant fees to Cytrack, Cytrack grants the Licensee a limited, non-exclusive, non-transferable licence to access and use the Software, documentation and related materials, including any updates, new releases, modifications or enhancements provided by Cytrack (collectively, the ‘Licenced Material’) for the Term, solely in accordance with the terms and conditions set out in this Licence Agreement. It does not give the Licensee the right to own the Licenced Material.

Bundled software licence information

The Licensee might also receive Software produced by other companies as part of a ‘bundle’ of utility Software (‘Bundled Software’). This Software might have been included in the Cytrack product to enhance productivity. Bundled Software is provided under licence from the original manufacturer. In the absence of a discrete licence from the manufacturer to the customer, the Licensee is permitted to use the Bundled Software under the same terms as this licence from Cytrack. The Licensee agrees to be legally bound by the provisions of this licence for use of any and all Bundled Software included with the Software that does not have its own licence included in its packaging. Under the provisions of this Licence Agreement, ‘Bundled Software’ is included in the terms ‘Licenced Material’ and ‘Software’.

Subscription conditions

You may only:
1. access the Software using the directions and allocated Administrator Account or User Account; and
2. access the version of the Software provided by Cytrack under this Licence Agreement.
You may be required to install the Software, or parts of it, on your hardware in order to utilise the Software. Before ordering the Software, you should check with Cytrack whether the Software will be compatible with the hardware you intend to use the Software on.
Use of the Software may require an internet connection. You will be responsible for all internet connection costs.
You must not:
1. copy, resell, distribute or transfer all or any part of the Software or Licenced Material except as permitted under the Copyright Act 1968 (Cth) (‘Copyright Act’);
2. provide access to the Software or Licenced Material to any person other than permitted Users each with their own User Account;
3. allow any person other than the nominated User to use or access a User Account;
4. sub-license or sub-contract any of its rights under this Licence Agreement without the written consent of Cytrack, which may by withheld in its absolute discretion;
5. attempt to circumvent usage limits or quotas (including but not limited to limits on the number of Users accessing the Software at any one time) or avoid incurring fees;
6. merge all or any part of any software contained in or provided in connection with the Software with any other software without Cytrack’s prior written permission;
7. commercially exploit the Software;
8. make any part of the Software available to any third party;
9. distribute or transmit any part of the Software by any means.
10. link to, frame or mirror any part of the Software without Cytrack’s written consent;
11. attempt to disassemble, decompile or otherwise reverse engineer or reverse compile the Software, except as permitted under the Copyright Act;
12. alter, customise, modify, tamper with or create derivative works of the Software or Licenced Material;
13. remove, obliterate or alter any proprietary notice on the Software or Licenced Material; or
14. use or encourage, promote, facilitate or instruct others to use Software or any other software provided in connection with Software for any illegal, harmful or offensive use, or to transmit, store, display, distribute or otherwise make available content that is illegal, harmful or offensive.

Unauthorised use

The Licensee shall notify Cytrack immediately if the Licensee becomes aware of any unauthorised use of the whole or part of the Software by any person, including any activity that would violate the subscription conditions in clauses 7 or 8.

Intellectual property

All industrial or intellectual property rights throughout the world including but not limited to copyright (including future copyright), patents, trade marks, trading names, business names, domain names, websites, website content, designs, drawings, graphics, artwork, brands, logos, know-how, ideas, inventions, improvements, systems, methods, plans, models, processes, manuals, strategies, solutions, technical data, formulae, databases, trade secrets, computer software, source code, object code, circuit layouts, whether or not now existing, and including all future rights whether or not registered or registrable at law, and all associated goodwill and moral rights (collectively, ‘Intellectual Property’) are reserved, except as otherwise provided under this Licence Agreement.
In relation to any information or material the Licensee adds or uploads to the Software (‘Content’), the Licensee:
1. grants Cytrack a limited, non-exclusive, transferable, irrevocable, royalty-free licence to use the Content for the purposes of Cytrack performing its obligations (including under this Licence Agreement and any other agreement with the Licensee) and facilitating the operation of the Software;
2. represents and warrants that the Content does not violate the law (including privacy laws), misappropriate the rights of any third party, or otherwise violate a term of this Licence Agreement or Cytrack’s Terms and Conditions;
3. represents and warrants that the Licensee owns all Intellectual Property in the Content or is otherwise authorised to add or upload the Content to the Software; and
4. acknowledges that Cytrack reserves the right to remove any Content without notice.
The parties agree that, as between the parties:
1. Cytrack retains the title to the Licensed Material, and all Intellectual Property therein; and
2. the Licensee retains the title to the Content, and all Intellectual Property therein.
The Licensee covenants and agrees:
1. not to do any act or thing which might invalidate or be detrimental to the Licensed Material or to the Intellectual Property therein;
2. not to represent that it has any proprietary, intellectual or moral right, title or interest in the Licensed Material, or register or attempt to register any such rights;
3. not to use or register any Intellectual Property which through its similarity might be confused with any Intellectual Property in the Licensed Material;
4. to bring to the immediate attention of Cytrack any actual, suspected or threatened infringement of Intellectual Property in the Licensed Material, and to provide Cytrack with reasonable assistance in such a claim.
If any part of the Software is modified, altered or enhanced (‘Modifications’), whether or not they are made or authorised by Cytrack:
1. as between the parties, the modified Software remains the property of Cytrack in all respects;
2. all Intellectual Property arising out of any such Modifications is hereby assigned to and vests in Cytrack;
3. the Licensee must execute all documents and do all acts and things required to give effect to this clause, including obtaining a written assignment of the Intellectual Property from a third party to Cytrack; and
4. the Licensee must provide Cytrack with a copy of any such Modifications.

Services

Cytrack may make available updates, modifications, enhancements or new releases to the Software from time to time (‘Software Updates’). Cytrack will provide any Software Updates for the duration of the Licence Agreement at no extra charge as part of the Subscription Fee.
You may order support services subject to Cytrack’s Support Services Terms and Conditions.

Subscription Fees

The Licensee must pay the relevant Subscription Fees to Cytrack in advance of each Subscription Period in accordance with Cytrack’s Support Services Terms and Conditions.
Cytrack reserves the right to review and adjust the Subscription Fees, provided that:
1. Cytrack may not increase the Subscription Fees during the Minimum Term;
2. Cytrack may not increase the Subscription Fees by more than 10% per year; and
3. Cytrack must provide the Licensee with thirty (30) days written notice of the new Subscription Fees prior to the new Subscription Fees coming into effect.

Effective date and termination

The licence is effective on the date the Licensee acquires the Licenced Material, and will remain in force until terminated in accordance with its terms.
The Licensee may terminate this Licence Agreement:
1. at or after the end of the Minimum Term, by giving at least ninety (90) days prior written notice;
2. as at the day before a proposed increase in the Subscription Fees, by giving at written notice within fourteen (14) days of receiving a notice under clause 20(c);
3. immediately by giving at written notice within sixty (60) days of receiving a notification under clause 48; or
4. immediately on written notice on the happening of one of the following events:
  1. Cytrack’s unremediable breach or threatened unremediable breach of any of its obligations under this Licence Agreement or Cytrack’s Terms and Conditions;
  2. Cytrack’s unremedied breach of any of its obligations under this Licence Agreement or Cytrack’s Terms and Conditions after having been given 60 days written notice to remedy such breach;
  3. the occurrence of any of the following events with regard to Cytrack’s affairs:
    1. any step is taken to enter into any scheme of arrangement with creditors,
    2. any step is taken to appoint a receiver or manager, a liquidator, an administrator or other like person,
    3. the suspension of debts generally, or
    4. Cytrack is deemed insolvent for the purposes of any provision of the Corporations Act 2001 (Cth) (‘Corporations Act’) or corresponding applicable laws.

Cytrack may, at its option, suspend access to the Software or terminate this Licence Agreement immediately if payment of the applicable Subscription Fee is not received by the start of any Subscription Period.
Cytrack may, at its option, suspend access to the Software or terminate this Licence Agreement immediately on written notice on the happening of one of the following events:
1. your unremediable breach or threatened unremediable breach of any of your obligations under this Licence Agreement or Cytrack’s Terms and Conditions;
2. your unremedied breach or threatened breach of any of your obligations under this Licence Agreement or Cytrack’s Terms and Conditions after having been given 30 days written notice to remedy such breach;
3. the occurrence of any of the following events with regard to your affairs:
  1. any step is taken to enter into any scheme of arrangement with creditors,
  2. any step is taken to appoint a receiver or manager, a liquidator, an administrator or other like person,
  3. the suspension of debts generally, or
  4. you are deemed insolvent for the purposes of any provision of the Corporations Act or corresponding applicable laws;
4. your merger or takeover by another party.
Upon termination of this Licence Agreement for any reason, you must immediately cease using the Software and Licenced Materials and destroy or return to Cytrack all Licenced Materials in your possession or control.

Disclaimer on warranties

In this Licence Agreement:
1. “Australian Consumer Law” means schedule 2 of the Competition and Consumer Act 2010 and any equivalent state or territory legislation; and
2. “Consumer Guarantee” means a right or guarantee under Part 3-2 (Division 1) of the Australian Consumer Law that cannot lawfully be excluded.
The Licensee expressly acknowledges and agrees that the use of the Licenced Material is at its own risk. The Licenced Material is furnished ‘as is’ and without warranty of any kind. Cytrack does not warrant that:
1. the Licenced Material or its functions will meet the Licensee’s requirements;
2. the operation of the Software will be uninterrupted or error-free;
3. the Software will provide any functions not expressly stated by Cytrack.
The Licensee acknowledges that:
1. it has not relied on any statement, representation, warranty, conduct or undertaking made or given by Cytrack or any person on its behalf, other than those set out in this Licence Agreement; and
2. it has relied on its own skill and judgment in deciding to acquire the Software and enter into this Licence Agreement.
Cytrack strongly recommends You regularly backup Your data to an independent storage facility to guard against catastrophic loss of data. Cytrack does not warrant or guarantee that any backups maintained by the Software, including those managed by third-party providers, will be failsafe or effective in any given situation. Cytrack shall not be responsible for any costs, loss or damage associated with loss of data, recreating data, substitute equipment or programs, claims by third parties or similar costs.
Cytrack will not be liable, in any respect, for any claim, liability, cost, loss or damage resulting from or arising directly or indirectly from:
1. any disruption to, or limitations of, the Licensee’s internet connection;
2. any disruption to Cytrack’s internet connection beyond Cytrack’s reasonable control;
3. any disruption to telecommunication networks or the internet generally;
4. any changes or works of the kind described in clause 23 of the Cytrack Terms and Conditions carried out without Cytrack’s prior agreement;
5. any changes to the Software made by or on behalf of the Licensee, whether or not carried out with Cytrack’s prior agreement;
6. any breach by the Licensee of this Agreement, the Cytrack Terms and Conditions or any other agreement with Cytrack; or
7. any negligence on the part of the Licensee.
By accessing the Software, the Licensee assumes all risks associated with its use, including but not limited to the risk that its computers, software or data may be damaged by any virus transmitted by the Software.
The Licensee is responsible for use of the Software by any person using the Administrator Account or any User Account. The Licensee must ensure those parties comply with the Licensee’s obligations under this Licence Agreement. The parties agree that any breach of this Licence Agreement by any person using an Administrator Account or User Account associated with the Licensee will be treated as a breach of this Licensee Agreement by the Licensee.
In no case shall the liability of Cytrack exceed the amount of the Subscription Fee paid by the Licensee in the preceding 3-month period.
To the fullest extent permitted by law, Cytrack excludes:
1. any term, condition or warranty that may otherwise be implied by custom, law or statute;
2. any liability for loss caused by the negligence of Cytrack; and
3. any liability for any loss or damage suffered by a party or any other person that is indirect or consequential, including but not limited to loss of revenue, loss of income, loss of business, loss of profits, loss of goodwill or credit, loss of business reputation, loss of use, loss of time, loss of interest, damage to credit rating or loss or denial of opportunity.
Some countries and states do not allow the exclusion of implied warranties, terms or conditions, so the above exclusions may not apply to you.
To the fullest extent permitted by law and except to the extent that the Consumer Guarantees cannot be excluded as set out under clause 36 or otherwise, Cytrack’s liability to the Licensee in connection with this Licence Agreement, the licence of the Software and the supply of any related goods and services by Cytrack (including in respect of any breach of or failure to comply with any applicable Consumer Guarantee) is limited to any one or more of the following as Cytrack determines in its absolute discretion:
1. in relation to goods:
  1. replacing or repairing the goods;
  2. supplying an equivalent item of the goods;
  3. paying the cost of replacing or repairing the goods; or
  4. paying the cost of acquiring equivalent goods; and
2. in relation to services:
  1. supplying the services again; or
  2. the payment of the cost of having the services supplied again.
Cytrack’s liability in respect of a breach of or a failure to comply with an applicable Consumer Guarantee will not be limited in the way set out in clause 35 if:
1. the goods and services supplied are ‘of a kind ordinarily acquired for personal, domestic or household use or consumption’, as that expression is used in section 64A of the Australian Consumer Law; or
2. it is not ‘fair or reasonable’ for Cytrack to rely on such limitation in accordance with section 64A(3) of the Australian Consumer Law; or
3. the relevant Consumer Guarantee is a guarantee pursuant to sections 51, 52 or 53 of the Australian Consumer Law.

Indemnity

The Licensee shall fully indemnify and hold harmless Cytrack, its related bodies corporate (as defined in the Corporations Act), and their respective directors, officers, employees, agents and subcontractors, against any claim, liability, cost, loss or damage whatsoever (whether direct, indirect or consequential, real or imagined, past, present or future) arising out of:
1. any breach by the Licensee of this License Agreement;
2. any other act or omission of the Licensee, including without limitation in relation to any claim that any Modifications made by the Licensee infringe any Intellectual Property or other rights of any third person; or
3. the use of the Software by the Licensee or by any person using any account associated with the Licensee contrary to this Licence Agreement or the directions of Cytrack.

Privacy and personal data

Please refer to Appendix A Privacy and Personal Information
Please refer to Appendix B Data Transfer Agreement for STANDARD CONTRACTUAL CLAUSES Cytrack, within the context of the execution of its End-User License Agreement (hereafter referred to as “EULA”) commits to respect the following Standard Contractual Clauses pursuant to European Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries

Governing law and severability

This Licence Agreement shall be governed and construed in accordance with the laws of Australia and the State of Queensland. Furthermore it is understood that this Licence Agreement shall be treated as though it were executed in Queensland and the parties agree that any action relating to this Licence Agreement shall be instituted and prosecuted in the courts of the competent jurisdiction of the State of Queensland.
If for any reason, a court of competent jurisdiction finds any provision or portion of this Licence Agreement unlawful, void, or for any reason unenforceable, it shall be deleted and shall in no way affect the enforceability of any other provisions of this Licence Agreement.

General

The failure or delay by a party to exercise any right under this Licence Agreement will not be taken as a waiver of the right. No waiver of any right is effective unless made in writing. Waiver of any particular right does not in any way release any other party from strict compliance in the future with the same or any other obligation.
Cytrack may assign this Licence Agreement at any time. The Licensee may assign this Licence Agreement with the prior written consent of Cytrack, which consent shall not be unreasonably withheld.
Cytrack may subcontract any of its obligations under this Licence Agreement to any person.
Clauses 8, 11, 13–16 and 25–36 survive termination of this Licence Agreement.

Interpretation

The following rules of interpretation apply unless the context requires otherwise:
1. headings are for convenience only and do not affect interpretation;
2. the singular includes the plural and vice versa;
3. if a word or phrase is defined, then its other grammatical forms have a corresponding meaning;
4. a reference to a clause, schedule, annexure or exhibit is to a schedule, annexure or exhibit to this Licence Agreement;
5. a reference to legislation, includes but is not limited to a modification or re-enactment of it, a legislative provision substituted for it and a regulation or statutory instrument under it;
6. a reference to conduct, includes but is not limited to, an omission, statement or undertaking whether or not in writing;
7. a provision of this document must not be construed adversely to a party on the grounds that the party drafted that provision;
8. a reference to writing, includes any mode of representing and reproducing words, figures, drawings or symbols in a visible form;
9. if a period of time runs to or from a given date, act or event, then the time is calculated exclusive of the date, act or event; and
10. a reference to $ means Australian dollars unless otherwise indicated.

Questions

Should you have any questions regarding this Licence Agreement, you may call your local office available at www.cytrack.io or write to Cytrack.

Acceptance

By:
1. proceeding with an order for Software and/or installation or upgrade of the Software, after receiving a copy of this document; or
2. clicking “I accept the terms of the Licence Agreement,” when registering for or using the Software,
you acknowledge that you have read and understand this Licence Agreement and agree to abide by its terms and conditions.
Cytrack reserves the right to amend, revise or replace this Licence Agreement from time to time by posting a notification via the Software. By:
1. continuing to use the Software after receiving such a notification; or
2. clicking “I accept the terms of the amended Licence Agreement,”
you acknowledge that you have read and understand the amended Licence Agreement and agree to abide by its terms and conditions. Amendments, revisions and replacements will be effective sixty (60) days after posting the notification, or on a later effective date specified in the notification, unless this Licence Agreement is terminated earlier.
Except as expressly stated, this Licence Agreement is the complete and exclusive agreement between us concerning the Software and supersedes all prior agreements, proposals or communications, verbal or written between us relating to the subject matter in this Licence Agreement.

Appendix A Privacy and Personal Data

Description of the processing

Details of the provided services and processing operations carried out accordingly: Please review our policy statement for further details

Purposes of the processing: Please review our policy statement for further details

Term of the processing: termination of the Agreement relationship

Types of personal data processed: Please review our policy statement for further details

Categories of data subjects: Licensee’s employees and prospects; licensee’s clients.

I. Principle

The present article applies in the case of the execution of the present Agreement subscribed by the Licensee with Cytrack.

As part of the performance of the services covered by the Agreement, Cytrack may be required to process Licensee’s Data (“Data” meaning any information filled by the Licensee into the Software).

If Licensee Data contains Personal Data (“Personal Data” meaning any information relating to an identified or identifiable natural person), each Party undertakes to comply with its obligations under the Applicable Regulations (“Applicable Regulations” meaning Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, the laws and regulations ratifying, transposing, supplementing or replacing Regulation (EU) 2016/679 and the guidelines, recommendations or codes of good practice issued by the competent national supervisory authorities, as well as any other relevant data protection national law).

The Parties undertake not to commit any act likely to put the other Party in a position of violation of the said Applicable Regulations. Amendment to this Agreement shall be made when needed for ensuring compliance with law.

It is specified between the Parties that if specific requirements resulting from the processing of Data increase the workload of Cytrack, the Parties shall agree on an amendment to consider the conditions, particularly financial, of this extension.

Each Party undertakes to comply with all the legal obligations applicable with regard to the protection of personal data and privacy, in particular European Regulation 2016/679, the laws and regulations supplementing, ratifying or transposing them and the recommendations of any independent public authority established by a Member State of the European Union and responsible for monitoring the compliance of the Parties with the Applicable Regulation (“Supervisory Authority“).

It is further specified that the Parties shall detail the technical and organisational security measures that each Party undertakes to implement in accordance with Article 32 of European Regulation 2016/679.

II. Licensee’s Obligations

The Licensee is solely liable and guarantees the quality, lawfulness and relevance of the Licensee’s Data.

The Licensee also guarantees to be the holder of the rights allowing it to process and have the Data processed by Cytrack. The Licensee guarantees Cytrack at first request against any prejudice that would result from Cytrack being held liable by a third party for a breach of this guarantee.

Cytrack guarantees to provide functionality to anonymise the Data in accordance with the Applicable Regulations.

The Licensee, as data controller according to the Applicable Regulation, warrants Cytrack that the processing meets the requirements of the Applicable Regulation, in particular that the Personal Data are processed in a lawful, fair and transparent manner, that they have been collected for specific, explicit and legitimate purposes and that the information required by the data subjects by the processing has indeed been provided to them at the time of Data collection.

As such, the Licensee guarantees Cytrack against any legal action, complaint or claim from a natural person whose Personal Data would be processed by Cytrack on behalf of the Licensee and, consequently, to indemnify Cytrack.

The Licensee undertakes to document, in writing, any instructions concerning the processing of Personal Data by Cytrack. In this respect, the Licensee undertakes to provide, when executing the Agreement, details of the concerned processing in the Appendix “Description of the processing” and to make available to Cytrack all information necessary for the proper performance of this Agreement.

The Licensee shall ensure, beforehand and throughout the processing period, that Cytrack complies with the obligations set out in the Applicable Regulations, in particular by carrying out Audits in accordance with the “Audit” Article set out below.

III. Cytrack’s Obligations

Within the limits of the provisions of the Article “Disclaimer on warranties” of the Agreement, Cytrack shall make its best efforts to preserve the security, integrity and confidentiality of the Data with regard to the legal obligations.

Cytrack, as a data processor within the meaning of the Applicable Regulations, will implement, for those which concern it, the appropriate technical and organisational measures so that the processing operations, carried out on behalf of the Licensee, meet the requirements of the Applicable Regulations. It is expressly agreed that Cytrack:

processes the Data only for the purpose(s) which are stated in the Appendix “Description of the processing operation”;
will only process the Data on the Licensee’s written and documented instructions, including with regard to transfers to third countries. Furthermore, if Cytrack is required to transfer Data to a third country or international organisation under the law of the Union or the law of the Member State to which Cytrack is subject, it shall inform the Licensee of this legal obligation before processing, unless the legislation concerned prohibits such information on important grounds of public interest;
immediately inform the Licensee if Cytrack considers that an instruction given by the Licensee constitutes a violation of the Applicable Regulations. The Parties specify that in the context of the subject matter of the Agreement, Cytrack shall not be required to ensure effective compliance or to advise the Licensee with regard to the Applicable Regulations concerning the processing carried out by the Licensee;
ensure that the persons authorised to process the Data undertake to respect confidentiality or are subject to an appropriate legal obligation;
may sub process all or part of the processing activities carried out on behalf of the Licensee. In the event of a planned change concerning the addition or replacement of one or more sub- processors, Cytrack shall also inform the Licensee, thus giving him the possibility to object to these changes;
imposes the same obligations as those set out herein on its sub-processors;
shall notify the Licensee of any breach of Personal Data, as soon as possible from the time it became aware of it, ] being specified that it is the Licensee’s duty to notify such breach to the competent supervisory authority and to the data subjects, as the case may be. Nevertheless, assistance may be provided by Cytrack in the context of these notifications, at the Licensee’s request and in accordance with the procedures discussed between the Parties;
at the Licensee’s option, deletes any Personal Data collected or returns them to the Licensee at the end of the Agreement, and destroys existing copies, unless otherwise provided by law;
provides the Licensee with all the information necessary to demonstrate compliance with its obligations and to enable audits to be carried out.
Subject to what is permitted under Applicable Regulation, if Cytrack receives a request or complaint from a Supervisory Authority regarding any Personal Data, it shall without delay notify Licensee identifying the Authority, the scope of the request and grounds presented for the request or complaint.

Data processing assistance

As part of its obligation to assist the Licensee, Cytrack undertakes, where applicable under financial conditions to be defined between the Parties, to:

assist the Licensee, through appropriate technical and organizational measures, to the maximum extent possible, in fulfilling its obligation to respond to requests from the data subjects relating to their rights;
help the Licensee to guarantee compliance with security obligations. It is understood between the Parties that Cytrack’s commitments relate only to the means it is able to implement to ensure the confidentiality and security of the Personal Data;
assist the Licensee in the context of notifications of Personal Data violations and when the Licensee decides to carry out a privacy impact assessment relating to Personal Data protection as well as, if necessary, for the prior consultation to the supervisory authority, by providing any useful documentation at its disposal that the Licensee does not hold.

The Parties agree on the principle that the assistance provided to the Licensee by Cytrack under this clause is carried out taking into account the nature of the processing and the level of information Cytrack receives from the Licensee and within the limits of the obligations that it shall comply with. Additional requests for assistance not covered by this Agreement shall give rise to a specific agreement between the Parties.

Transfers

Cytrack is located in Australia. The Licensee acknowledges that Australia is not deemed a country granting adequate level of protection to Personal Data according to the European Union Commission. Therefore, the ground for international transfer of Licensee’s Personal Data is the commitment from Cytrack to comply with the standard contractual clauses referenced in Appendix B.

Cytrack may need to transfer Licensee’s Personal Data to its sub-processors. Licensee will be informed by Cytrack of the identity, location and legal ground associated with each international transfer of its Personal Data beforehand.

In the event of an instruction given by the Licensee involving a transfer of Data to a third country, Cytrack guarantees the Licensee that any such transfers will be carried out in compliance with the Applicable Regulations.

Audit

The Licensee, during the performance of the Agreement, within the limit of one (1) time every 12 months, has the possibility to carry out, at its own expense and under its responsibility, an audit whose purpose is to verify the conformity of the services performed by Cytrack on behalf of the Licensee from a Personal Data processing perspective.

This audit is notified by the Licensee to Cytrack by registered letter with acknowledgement of receipt detailing the documents requested and, where applicable, the protocol that will be carried out, the methods used and the data audited, thirty (30) working days before the planned date of its implementation.

It is expressly agreed between the parties that, as far as possible, a desk audit is preferred and that an on-site audit will be scheduled if the elements made available by Cytrack are not sufficient to demonstrate compliance with its obligations under this clause.

In this second case, the Licensee assumes the additional costs resulting in particular from the need for an increase in staff to enable the audit to be carried out and Cytrack’s activity to continue.

The audit is carried out by the Licensee or by a third party designated by the Licensee, provided that this third party is not a direct or indirect competitor of Cytrack, that it is subject to professional confidentiality and that it has entered into a confidentiality agreement, a copy of which will be submitted to Cytrack for approval.

It is also understood that this audit approach excludes any communication of documents of a financial or accounting nature or relating to Cytrack’s relations with other Licensees.

The audit will be conducted during Cytrack’s working hours.

The audit results will be the subject of an adversarial debate and validation by the Parties.

Cytrack may not communicate all or part of this audit without the Licensee’s written authorisation.

Audit costs will remain the responsibility of the Licensee, as well as any costs incurred and time spent by Cytrack.

Appendix B Data Transfer Agreement STANDARD CONTRACTUAL CLAUSES

Cytrack, within the context of the execution of its End-User License Agreement (hereafter referred to as “EULA“) commits to respect the following Standard Contractual Clauses pursuant to European Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries

Clause 1
Definitions

For the purposes of the Clauses:

‘personal data’, ‘special categories of data’, ‘process/processing’, ‘controller’, ‘processor’, ‘data subject’ and ‘supervisory authority’ shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ;
‘the data exporter’ means the controller who transfers the personal data, meaning the Licensee under the EULA’s terms;
‘the data importer’ means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country’s system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC, meaning Cytrack;
‘the subprocessor’ means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;
‘the applicable data protection law’ means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established;
‘technical and organisational security measures’ means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

1 Parties may reproduce definitions and meanings contained in Directive 95/46/EC within this Clause if they considered it better for the contract to stand alone.

Clause 2
Details of the transfer

The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 which forms an integral part of the Clauses.

Clause 3
Third-party beneficiary clause

The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.
The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.
The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.

Clause 4
Obligations of the data exporter

The data exporter agrees and warrants:

that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;
that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter’s behalf and in accordance with the applicable data protection law and the Clauses;
that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this contract;
that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;
that it will ensure compliance with the security measures;
that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;
to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;
to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;
that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and
that it will ensure compliance with Clause 4(a) to (i).

Clause 5
Obligations of the data importer

The data importer agrees and warrants:

to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
that it has implemented the technical and organisational security measures specified in Appendix 2 before processing the personal data transferred;
that it will promptly notify the data exporter about:
1. any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation,
2. any accidental or unauthorised access, and
3. any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;
to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;
at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;
to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;
that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent;
that the processing services by the subprocessor will be carried out in accordance with Clause 11;
to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data exporter.

2 Mandatory requirements of the national legislation applicable to the data importer which do not go beyond what is necessary in a democratic society on the basis of one of the interests listed in Article 13(1) of Directive 95/46/EC, that is, if they constitute a necessary measure to safeguard national security, defence, public security, the prevention, investigation, detection and prosecution of criminal offences or of breaches of ethics for the regulated professions, an important economic or financial interest of the State or the protection of the data subject or the rights and freedoms of others, are not in contradiction with the standard contractual clauses. Some examples of such mandatory requirements which do not go beyond what is necessary in a democratic society are, inter alia, internationally recognised sanctions, tax-reporting requirements or anti-money-laundering reporting requirements.

Clause 6
Liability

The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensation from the data exporter for the damage suffered.
If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity.

The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities.
If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the subprocessor agrees that the data subject may issue a claim against the data subprocessor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the subprocessor shall be limited to its own processing operations under the Clauses.

Clause 7
Mediation and jurisdiction

The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject:
1. to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;
2. to refer the dispute to the courts in the Member State in which the data exporter is established.
The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.

Clause 8
Cooperation with supervisory authorities

The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.
The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.
The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any subprocessor preventing the conduct of an audit of the data importer, or any subprocessor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5 (b).

Clause 9
Governing Law

The Clauses shall be governed by the law of the Member State in which the data exporter is established.

Clause 10
Variation of the contract

The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.

Clause 11
Subprocessing

The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on the data importer under the Clauses . Where the subprocessor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the subprocessor’s obligations under such agreement.
The prior written contract between the data importer and the subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established.
The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5 (j), which shall be updated at least once a year. The list shall be available to the data exporter’s data protection supervisory authority.

3 This requirement may be satisfied by the subprocessor co-signing the contract entered into between the data exporter and the data importer under this Decision.

Clause 12
Obligation after the termination of personal data processing services

The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.
The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1.

Appendix 1 to the Standard Contractual Clauses

This Appendix forms part of the Clauses.

Data exporter: Licensee

The data exporter is a Licensee of data importer’s software services. It uses data importer’s technology within the framework of its customer services.

Data importer: Cytrack

The data importer is a provider of software services for its Cytrack Telephony Applications and Call Centre Solutions

Data subjects

The customers of Licensee’s, having purchased the Data exporter’s goods or services and needing after sales services or assistance.

Data exporter’s employees using data importer’s software within the scope of their job description.

Categories of data

Please refer to Cytrack’s Privacy Policy and this EULA.

Appendix 2 to the Standard Contractual Clauses