Data Processing Addendum

Last update: 01/04/2022

The Aqurate Data Processing Addendum is an Annex to the Aqurate Standard Service Terms agreement between Aqurate, henceforth called the Company,

and You, the user of the analysis and prediction services, henceforth called the Customer, (each called a “party” and together, the “parties”).

BY CLICKING ON THE “I AGREE” BUTTON, REGISTERING TO USE THE SERVICE, OR USING THE SERVICE, (1) YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTAND, AND AGREE TO BE BOUND BY THESE TERMS, AND (2) YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO ENTER INTO THESE TERMS, PERSONALLY AND ON BEHALF OF THE COMPANY YOU HAVE NAMED AS THE CUSTOMER, AND TO BIND THAT COMPANY TO THESE TERMS. IF YOU DO NOT AGREE TO THESE TERMS, OR IF YOU DO NOT HAVE SUCH AUTHORITY, YOU SHOULD NOT USE THE SERVICE.

1. Definitions

1.1. Agreement: the Aqurate Standard Service Terms.

1.2. Aqurate: means MACHINE LEARNING SOLUTIONS SRL, with its registered office in Romania, 2-4 Calea Circumvalatiunii, Timisoara, Timis county, Office 413, VIES (VAT) code RO40330105, EUID ROONRC.J35/4631/2018.

1.3. Breach of personal data security: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

1.4. Data controller: the natural or legal person, organization, public authority, agency or body that, alone or jointly with others, determines the purposes and means of processing personal data.

1.5. Data processor: the natural or legal person, organization, public authority, agency or body that processes the data on behalf of the data controller.

1.6. End Users: a natural/legal person that is a client or website visitor of the Customer’s and whose data and interaction with the Customer may be provided to the Company through one or more Integrations.

1.7. Integration: a data source such as sales data (e.g., from an eCommerce platform), website traffic data (e.g., from Google Analytics), or ads data (e.g., from Facebook Ads) that the Customer authorizes the Company to access and retrieve data in order to provide the Service.

1.8. Personal data: any information regarding a natural person which is identified or identifiable („data subject”); an identifiable natural person is a person which can be identified either directly or indirectly.

1.9. Processing: any operation or set of operations performed on personal data or datasets of personal data, with or without automated means.

1.10. Regulation or GDPR: the EU Regulation no. 679/2016 of the European Parliament and Council dated April 27, 2016 on data protection, privacy and transfer of personal data, applicable from May 25, 2018 onwards.

1.11. Service: any of the web-based applications, tools, APIs and platforms available as a subscription, developed, operated and maintained by the Company, accessible via https://aqurate.ai or another designated URL, and any ancillary products and services, including cloud hosting, provided to the Customer.

2. Data subjects

2.1. As per the provisions of the Agreement, the Parties process the personal data of the designated contact persons and the representatives of each Party.

2.2. Seeing that the Service provided by the Company based on the Agreement cannot be performed without access to any personal data, the Parties agree that the Customer may transfer to the Company any personal data pertaining to End Users obtained from Integrations.

2.3. Should the data processing performed by the Customer with regard to the End Users entail analysing their behaviour and/or creating user and behaviour profiles, the Customer in its capacity as Data Controller shall take all necessary measures towards observing the legislation on data protection, security and transfer. The Company shall not be involved in this activity, given that it does not process any of the End Users’ personal data.

3. Processed personal data

3.1. In the context of the Agreement, the Parties shall process these types of personal data:

  • Type 1
    Data subject: Designated contact persons and representatives of each Party
    Personal data: First name, last name, email, phone, role in the company
    Parties’ capacity: Customer - data controller. Company - data controller
    Purpose of processing: conclusion and execution of the Agreement
    Legal ground of processing: article 6 paragraph 1 (b) GDPR

  • Type 2
    Data subject: End User data, depending on Service and the Customer’s ability to anonymise it
    Personal data: First name, last name, email, phone, address, IP
    Parties’ capacity: Customer - data controller. Company - data processor
    Purpose of processing: rendering of the Service
    Legal ground of processing: article 6 paragraph 1 (a) GDPR

4. Rights and obligations of the Parties

4.1. The Parties undertake to observe all obligations pursuant to the legislation applicable to data protection, privacy, and transfer of personal data in their actions under the Agreement and marketing thereof.

4.2. The Customer is responsible to obtain the consent to record, store and process data from its End Users, in accordance with the applicable laws and regulations regarding Personal Data, as necessary for Company and its Affiliates to provide the Service.

4.3. The Customer shall not send/transfer/disclose to the Company any sensitive personal information of its End Users. If it is necessary for Customer to share/disclose/transfer such personal information to the Company, it shall always be de-personalised, anonymised and/or otherwise encrypted (or hashed) so as to no longer constitute Personal Data within the meaning of the EU General Data Protection Regulation 2016/679 or any other legislation regarding personal data before disclosure/transfer to the Company.

4.4. The Company may collect and use the End User data in an anonymized manner to improve its services and products or create new services and products.

4.5. Irrespective of either Party’s capacity in their actions of processing data as per article 3 herein, it represents that it:

  • Processes personal data of data subjects in observance of the rights and liberties thereof;
  • Shall process personal data in good faith and of an adequate manner with respect to the purpose;
  • Shall not process personal data for any purposes outside the scope of the Agreement;
  • Shall ensure adequate informing of the representatives and contact persons of the other Party with regard to the disclosure of their personal data to the other Party.

4.6. Name of data protection officer / contact person
For the Customer
First and last name (Required):

E-mail (Required):

For the Company
First and last name: Raul-Teodor Mazilu
E-mail: dpo@aqurate.ai

5. Parties’ liability

5.1. Each Party hereby represents that it is informed of and observes the provisions of the data protection legislation and accepts all consequences deriving from its capacity of independent Data controller and, respectively, Data processor as specified under article 3.

5.2. Neither Party shall be held liable for how the other Party, its employees, or partners fulfil their legal obligations. Thus, each Party shall be held liable for its own actions and inactions, as well as for those of its employees and partners.

5.3. Each Party’s liability towards the other Party and towards the data subjects shall be established with respect to the Party’s capacity specified under article 3 above, the cause and location of the data breach, the data security measures employed, the actions employed to avoid such incidents and the observance of obligations specified under article 4.

6. Final provisions

6.1. The provisions of this Data Processing Addendum shall prevail should there be any inconsistencies with the clauses in the Agreement.