Data Sharing Agreement

(Controller-to-Controller) — incorporated by reference into the GatherUs Terms of Service

This Data Sharing Agreement (“DSA”) is entered into between the GatherUs contracting entity identified in the applicable Order Form — CIC International B.V., Stationsplein 45, 3013 AK Rotterdam, the Netherlands (KvK no. 65212142), for Clients in the EEA, the United Kingdom or Switzerland, or otherwise CIC Venture Cafe Global Institute, Inc., 1 Broadway, 14th Floor, Cambridge, MA 02142, USA — (“GatherUs”) and the Client identified in the applicable Order Form (the “Organiser”), together the “Parties”. It governs the Personal Data that the Parties, each acting as an independent controller, share with each other in connection with Events organised by the Organiser using the GatherUs platform. Capitalised terms not defined here have the meanings given in the GatherUs Terms of Service (“ToS”) or the Data Processing Agreement (“DPA”).

1. ROLES

1. Each Party is an independent controller of the Shared Data (as defined in Schedule 1) that it processes for its own purposes. The Parties expressly agree that they are not joint controllers within the meaning of Article 26 GDPR: each Party independently determines its own purposes and means of processing, and neither Party processes Shared Data on the other’s instructions under this DSA. The exchange of Shared Data between the Parties is a transmission between separate controllers.
2. This DSA does not apply to (a) Processing by GatherUs on the Organiser’s documented instructions, which is governed by the DPA .(for example, End Users’ responses to Organiser-configured registration questions processed for the Organiser’s Event, and participant lists uploaded by the Organiser processed to invite and register the individuals concerned); or (b) GatherUs’s processing, for its own purposes and as described in the GatherUs Privacy Policy, of End User account and platform usage data, of networking suggestions to End Users and of event and community communications sent to End Users. Where the same Personal Data is both Processed by GatherUs under the DPA for the Organiser’s Event and disclosed to GatherUs under this DSA for the purposes set out in Schedule 1, each Processing is governed by the instrument applicable to it.

2. SHARED DATA AND PURPOSES

1. The categories of Shared Data, the direction of each flow and the permitted purposes are set out in Schedule 1. Neither Party shall process Shared Data for purposes incompatible with those set out in Schedule 1.
2. The Organiser shall not (a) use Shared Data received from GatherUs for direct marketing unless the Organiser has its own valid legal basis (and, where required, consent) for doing so; (b) sell Shared Data or share it for cross-context behavioural advertising within the meaning of the CCPA/CPRA; or (c) attempt to re-identify any anonymized or aggregated data received from GatherUs.

Communications to End Users through the platform. Registration confirmations, Event reminders, post-Event surveys and community newsletters sent to End Users through the platform are sent by GatherUs as independent controller under the GatherUs Privacy Policy and, in the case of newsletters, on the basis of the End User’s consent obtained by GatherUs. The Organiser may contribute content relating to its Events and community to such communications; GatherUs determines the recipients, the sending and the suppression of End Users who have unsubscribed. The Organiser shall ensure that any content it contributes is lawful and does not promote anything other than its own Events and community, and shall not use the platform’s communication features to send its own direct marketing. Clause 2.2(a) applies to any direct marketing the Organiser conducts outside the platform using Shared Data.

3. COMPLIANCE OBLIGATIONS OF EACH PARTY

1. Each Party shall process Shared Data in compliance with applicable data protection law, including the GDPR, the UK GDPR, the Swiss FADP, applicable US state privacy laws and, where applicable, Japan’s APPI (together, “Data Protection Law”), and shall be individually and separately responsible for its own compliance.
2. Each Party shall have a valid legal basis for its processing and its disclosure of Shared Data to the other Party. The Organiser shall present its own privacy notice (and any Event Rules) to End Users at or before registration for its Event; GatherUs makes its Privacy Policy available to End Users at account creation. Each Party’s transparency information shall identify the other Party as a recipient/source of the Shared Data as required by Articles 13 and 14 GDPR.
3. Each Party shall implement appropriate technical and organisational measures to protect Shared Data, appropriate to the risk, and shall ensure persons authorised to process Shared Data are bound by confidentiality.
4. Special-category data: the Organiser shall not configure registration questions collecting special-category (sensitive) data unless it has a valid Article 9 GDPR condition (or local-law equivalent) and shall not transmit such data to GatherUs beyond what the platform necessarily stores for the Organiser under the DPA. GatherUs shall exclude from the Shared Data it receives for networking suggestions under Schedule 1 any registration fields that the Organiser has designated as special-category data in the Order Form or in the App, and the Organiser shall designate such fields accordingly.
5. Networking suggestions: the Organiser acknowledges that GatherUs, as independent controller, offers End Users who enable that feature suggestions of people they may wish to meet, at Events and outside Event times, based on their account data, their Event history and the Shared Data disclosed by the Organiser under Schedule 1. GatherUs shall process Shared Data received for this purpose only for networking suggestions and related security purposes, shall provide suggestions only to End Users who have enabled the feature, and shall cease processing the Shared Data of an End User who disables it or objects. The Organiser’s privacy notice shall identify GatherUs as a recipient of registration answers and attendance data for this purpose.

4. DATA SUBJECT RIGHTS AND COMMUNICATIONS

1. Each Party shall handle data subject requests it receives that concern its own processing. Where a Party receives a request that concerns the other Party’s processing, it shall (a) inform the requester which Party is the relevant controller and how to contact it, and (b) forward the request to the other Party without undue delay, and in any event within five (5) business days.
2. The Parties shall provide each other reasonable assistance (at the requesting Party’s reasonable cost) in responding to data subject requests, supervisory authority enquiries and complaints concerning the Shared Data.

5. PERSONAL DATA BREACHES

1. Each Party shall notify the other without undue delay (and in any event within seventy-two (72) hours) after becoming aware of a personal data breach affecting Shared Data, providing the information reasonably needed for the other Party to meet its own notification duties. Each Party is responsible for its own notifications to authorities and data subjects. The Parties shall reasonably cooperate in investigating and remediating any such breach.

6. INTERNATIONAL TRANSFERS

1. Where the transfer of Shared Data between the Parties is a Restricted Transfer (for example, from an Organiser established in the EEA to GatherUs in the United States), the transfer is made under the EU Standard Contractual Clauses, Module One (controller-to-controller), which are incorporated into this DSA by reference and completed as set out in Schedule 2, together with the UK Addendum and/or Swiss adjustments where UK or Swiss law applies. Where the receiving Party holds a valid certification under an applicable adequacy framework (such as the EU-US Data Privacy Framework), the transfer may instead rely on that framework, with the SCCs as fallback.
2. Each Party shall carry out any transfer impact assessment required of it and implement supplementary measures identified as necessary.

7. ONWARD DISCLOSURE

1. A Party may disclose Shared Data to its processors and service providers bound by written terms consistent with Data Protection Law, and to authorities where legally required. Any other onward disclosure requires that the disclosing Party has its own lawful basis and provides for protections consistent with this DSA.

8. LIABILITY, TERM, GENERAL

1. Each Party is liable for its own breaches of this DSA and of Data Protection Law. Liability between the Parties is subject to the limitations in the ToS, except that nothing limits a Party’s liability to data subjects or authorities under Data Protection Law.
2. This DSA takes effect on the Effective Date of the applicable Order Form and continues for as long as a Party processes Shared Data received under it, notwithstanding termination of the ToS.
3. In case of conflict: (a) the SCCs prevail over this DSA to the extent of the conflict; (b) this DSA prevails over the ToS with respect to the sharing of Personal Data between the Parties as independent controllers; and (c) the DPA governs where GatherUs acts as the Organiser’s processor.
4. Governing law and jurisdiction follow the ToS, save where Data Protection Law requires otherwise.

SCHEDULE 1 — SHARED DATA FLOWS AND PURPOSES

SCHEDULE 2 — SCC COMPLETION (MODULE ONE)

1. Clause 7 (docking): included. Clause 11(a) optional independent dispute resolution: not included.
2. Clause 17 (governing law): the law of the Netherlands. Clause 18 (forum): the courts of Amsterdam, the Netherlands.
3. Annex I.A (parties): the Parties as identified in the applicable Order Form. Annex I.B (description of transfer): as per Schedule 1 of this DSA. Annex I.C (competent supervisory authority): [to be determined by the data exporter’s establishment / Art. 27 representative].
4. Annex II (technical and organisational measures): for transfers to GatherUs, Annex 2 (Security Measures) to the DPA applies mutatis mutandis; for transfers to the Organiser, the measures notified by the Organiser in the Order Form.
5. UK transfers: the SCCs as completed above apply as amended by the UK International Data Transfer Addendum (version B1.0). Swiss transfers: the SCCs apply with the adjustments required by the FDPIC, including protection of data of legal entities to the extent required.