Data Processing Addendum

This Data Processing Addendum (“DPA”) governs Plenty Labs AB’s (“Plenty Labs”) processing of personal data provided, imported, scraped, and created by you (the “Customer” or “you”) when using the Plenty Labs AI-powered marketing and ad generation platform, including its third-party connectors (the “Service”) under the relevant agreement granting you access to the Service (the “Agreement”).

By entering into the Agreement, you agree to be bound by the terms of this DPA on behalf of yourself or the company/employer you represent. If you use the Service in connection with your employment or otherwise on behalf of a company, you warrant that you are authorized to bind your company/employer to this DPA. Please do not enter into the DPA on behalf of your company/employer if you are not duly authorized to do so.

The data protection obligations in this DPA shall apply to the processing of personal data within the scope of the Service (the “Personal Data”) carried out by Plenty Labs (data processor) on behalf of you (data controller). In the event of any contradiction between the DPA and the Agreement, the DPA shall prevail.

Plenty Labs undertakes to process the Personal Data in order to fulfil its obligations related to the Service under the Agreement and as instructed by the Customer in Annex 1.

The parties undertake to fulfil their data protection obligations according to this DPA and shall comply with any applicable law or regulation concerning the processing of Personal Data, including but not limited to, the General Data Protection Regulation (EU) 2016/679 (the “GDPR”), UK GDPR, the California Consumer Privacy Act (the “CCPA”) and other legislation relating to the processing of Personal Data (“Applicable Data Privacy Laws”). The parties accept to make changes and amendments to this DPA if required under Applicable Data Privacy Laws.

Plenty Labs may process Personal Data in addition to or in violation of Customer’s instructions, if and to the extent required to do so by union or member state law to which the Plenty Labs is subject. Plenty Labs shall inform the Customer of such legal requirements prior to carrying out any such processing activities against Customer’s instructions, unless that law prohibits such information. For processing of Personal Data for Plenty Labs’s business purposes, as further described in our Privacy Notice, Plenty Labs acts as independent data controller.

Customer is the “Business” and Plenty Labs is the “Service Provider”, for purposes of CCPA. In accordance with the CCPA, and with respect to Personal Data to which CCPA applies: (a) Plenty Labs will not “sell” (as defined in the CCPA) any Personal Data and (b) Plenty Labs will not collect, share, retain or use any Personal Data except as necessary to perform services for our customers.

Customer shall ensure that all necessary consents and/or permissions are obtained, or that conditions are fulfilled (as set out in Applicable Data Privacy Laws) to enable Plenty Labs to process Personal Data under this DPA.

If data subjects, competent authorities or any other third parties request information from Plenty Labs regarding the processing of Personal Data covered by this DPA, Plenty Labs shall immediately refer such request to the Customer. Plenty Labs may not in any way act on behalf of or as a representative of Customer and may not, without prior written instructions from Customer, transfer or in any other way disclose Personal Data or any other information relating to the processing of Personal Data to any third party. In the event Plenty Labs is required to disclose the Personal Data due to mandatory laws or regulations, Plenty Labs shall be obliged to inform the Customer thereof.

Plenty Labs is granted a general authorization to engage sub-processor and/or affiliates (“Sub-processor”) it deems necessary for the fulfilment of its obligations under the Agreement and this DPA, subject to Sections 3.2-3.3 below. The Sub-processors engaged are listed Plenty Labs Sub-processors.

Plenty Labs shall notify the Customer 14 days in advance of the engagement of new Sub-processors. If Customer has legitimate objections to the appointment of any new Sub-processor, Plenty Labs shall take reasonable steps to engage a different Sub-processor acceptable to the Customer. If Plenty Labs cannot find an appropriate alternative and proceeds with engaging a Sub-processor notwithstanding your objection, Customer shall be entitled to discontinue using the Service and terminate the relevant parts of this DPA, to take effect on the date when the Sub-processor in question will commence its processing of Personal Data. If the Customer does not object within seven (7) days after written notice by Plenty Labs of its intended engagement of the new Sub-processor, Customer shall be deemed to have authorised the engagement.

Plenty Labs shall ensure that any Sub-processor engaged is bound by a written agreement that imposes data protection obligations providing a level of protection for Personal Data that is substantially similar to, and no less protective than, the obligations set out in this DPA, taking into account the nature and scope of the processing carried out by the Sub-processor. Plenty Labs shall remain fully liable to the Customer for the performance of the Sub-processor’s obligations.

Plenty Labs may transfer Personal Data outside of the EU/EEA only if there is a valid transfer mechanism in place (including additional safeguards, if necessary) before the transfer commences. If Plenty Labs will onward transfer Personal Data to a third party outside the EU/EEA, Plenty Labs shall ensure that:

1. the onward transfer is to a country benefiting from an adequacy decision pursuant to article 45 GDPR that covers the onward transfer;
2. the third party is bound by the standard contractual clauses annexed to the European Commission’s Decision (EU) 2021/914 of 4 June 2021 (the SCC’s); or
3. the third party otherwise ensures appropriate safeguards with respect to the processing in question.

Plenty Labs shall assist Customer in fulfilling its legal obligations under Applicable Data Privacy Laws, including obligation to respond to requests for exercising the data subject’s rights according to Applicable Data Privacy Laws and, upon your request, assist Customer with carrying out data protection impact assessments in accordance with Applicable Data Privacy Laws. Furthermore, Plenty Labs shall, upon your request, assist the Customer with carrying out prior consultations with a supervisory authority, where such consultations are required according to Applicable Data Privacy Laws.

Plenty Labs shall take all necessary actions to assist Customer in carrying out obligations regarding Personal Data Breaches related to the Service and in accordance with Applicable Data Privacy Laws, and shall notify the Customer as soon as possible in writing in relation to any accidental or unauthorized access to the Personal Data or any other security incidents (“Personal Data Breach”).

Plenty Labs shall not disclose or otherwise make Personal Data processed under this DPA available to any third party, except for Sub-processors engaged in accordance with this DPA, without Customer’s prior written consent, unless required by law.

Plenty Labs shall ensure that members of its personnel who are granted access to the Personal Data are bound by a confidentiality obligation concerning this Personal Data to the same extent as the Plenty Labs in accordance with this DPA and that they are informed how they may process the Personal Data.

The duties of confidentiality set forth in this Section 6 shall survive the expiry or termination of the DPA.

Plenty Labs shall take appropriate technical and organizational measures to protect the Personal Data. The measures shall at least result in a level of security which is appropriate according to Applicable Data Privacy Laws.

Customer shall be entitled to take measures as necessary to verify that Plenty Labs is able to comply with its obligations under this DPA, and that Plenty Labs has in fact undertaken the measures to ensure such compliance.

Plenty Labs undertakes to, upon written notice reasonable time in advance, make available to Customer all information and all assistance necessary to demonstrate compliance with the obligations laid down in this DPA and, no more than once a year and solely during business hours, allow for and contribute to audits, including on-site inspections, conducted by Customer or another auditor mandated by the Customer. Such audit shall not unreasonably interfere with Plenty Labs’s day-to-day operations.

The provisions in this DPA shall apply during the term of the Agreement or to the extent that Plenty Labs continues to process the Personal Data, whichever is longer.

Upon expiry of this DPA, Plenty Labs shall, upon Customer’s request, delete or return all Personal Data to you, except to the extent that Plenty Labs is legally required to retain any Personal Data.

The limitations of liability set forth in the Agreement shall apply to this DPA, except that the total aggregate liability of Plenty Labs under this DPA shall be limited to two (2) times the total fees paid by you under the Agreement during the twelve (12) months immediately preceding the date on which the liability arose.

This DPA shall be governed by Swedish law. Any dispute or claim arising from or in connection with this DPA shall be resolved by Swedish courts of general jurisdiction where the court of Stockholm (sw: Stockholms tingsrätt) shall be the court of first instance.