LGPD Processor Addendum to the Adswerve Data Processing Terms

Adswerve and the Customer have entered into the Adswerve Data Processing Terms (“Data Processing Terms”), which supplement the Agreement.

This LGPD Processor Addendum to the Adswerve Data Processing Terms (“LGDP Processor Addendum”) is entered into by Adswerve and Customer and also supplements the Agreement. This LGDP Processor Addendum will be effective as of the later of August 16, 2020 or the date the Customer otherwise agreed to this LGPD Processor Addendum.

1.   Introduction

This LGDP Processor Addendum reflects the parties’ agreement on the terms governing the processing and security of certain data in connection with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais) (“LGPD”). The provisions of this LGDP Processor Addendum are effective solely to the extent the LGPD applies.

2.   Definitions and Interpretation

2.1.   In this LGPD Processor Addendum:

(a)   “Brazilian Customer Personal Data” means personal data that is processed by Adswerve on behalf of Customer in Adswerve’s provision of the Processor Services.

(b)   “Google Entity” means Google LLC, Google Brasil Internet Ltda or any other Affiliate of Google LLC.

2.2.   The terms “controller,” “data subject,” “personal data,” “processing” and “processor” as used in this LGPD Processor Addendum have the meanings given to them in the LGPD.

2.3.   Capitalized terms used but not defined in this LGPD Processor Addendum will have the meanings set out in the Data Processing Terms.

2.4.   If there is any conflict or inconsistency between the terms of this LGPD Processor Addendum and the remainder of the Agreement (including the Data Processing Terms), the terms of this LGPD Addendum will govern.

2.5.   If this LGPD Processor Addendum is translated into any other language, and there is a discrepancy between the English text and the translated text, the English text will govern.

3.   Processing of Data

3.1.   Roles and Regulatory Compliance; Authorization.

(a)   Processor and Controller Responsibilities. The parties acknowledge and agree that:

(i)   Adswerve is a processor of Brazilian Customer Personal Data under the LGPD and Google is a subprocessor of Brazilian Customer Personal Data under the LGPD;

(ii)   Customer is a controller or processor, as applicable, of Brazilian Customer Personal Data under the LGPD; and

(iii)   each party will comply with the obligations applicable to it under the LGPD with respect to the processing of Brazilian Customer Personal Data.

(b)   Authorization by Third Party Controller. If Customer is a processor, Customer warrants to Adswerve that Customer’s instructions and actions with respect to Brazilian Customer Personal Data, including its appointment of Adswerve and Google as another processor, have been authorized by the relevant controller.

3.2.   Customer’s Instructions. By entering into this LGPD Processor Addendum, Customer instructs Adswerve and authorizes Adswerve to instruct Google to process Brazilian Customer Personal Data only in accordance with applicable law:

(a)   to provide the Processor Services and any related technical support;

(b)   as further specified via Customer’s use of the Processor Services (including in the settings and other functionality of the Processor Services) and any related technical support;

(c)   as documented in the form of the Agreement, including this LGPD Processor Addendum; and

(d)   as further documented in any other written instructions given by Customer and acknowledged by Google as constituting instructions for purposes of this LGPD Processor Addendum.

3.3.   Adswerve’s Compliance with Instructions. Adswerve will comply with and obtain Google’s agreement to comply with the instructions described in Section 3.2 (Customer’s Instructions) unless applicable laws to which Adswerve or Google is subject require other processing of Brazilian Customer Personal Data by Adswerve or Google.

3.4.   Additional Products. If Customer uses any Additional Product, the Processor Services may allow that Additional Product to access Brazilian Customer Personal Data as required for the interoperation of the Additional Product with the Processor Services. For clarity, this LGPD Processor Addendum does not apply to the processing of personal data in connection with the provision of any Addition Product used by Customer, including personal data transmitted to or from that Additional Product.

4.   Data Deletion

4.1.   Deletion During Term.

(a)   Processor Services with Deletion Functionality. During the Term, if:

(i)   the functionality of the Processor Services includes the option for Customer to delete Brazilian Customer Personal Data;

(ii)   Customer uses the Processor Services to delete certain Brazilian Customer Data; and

(iii)   the deleted Brazilian Customer Personal Data cannot be recovered by Customer (for example, from the “trash”)

then Adswerve will or will obtain Google’s agreement to delete such Brazilian Customer Personal Data from its systems as soon as reasonably practicable and within a maximum period of 180 days, unless applicable laws require storage.

(b)   Processor Services Without Deletion Functionality. During the Term, if the functionality of the Processor Services does not include the option for Customer to delete Brazilian Customer Personal Data, then Adswerve will or will obtain Google’s agreement to comply with:

(i)   any reasonable request from Customer to facilitate such deletion, insofar as this is possible taking into account the nature and functionality of the Processor Services and unless applicable laws require storage; and

(ii)   the data retention practices described at https://policies.google.com/technologies/ads

Adswerve may charge a fee (based on Adswerve’s and Google’s reasonable costs) for any data deletion under Section 4.1.(b)(i). Adswerve will provide Customer with further details of any applicable fee, and the basis of its calculation, in advance of any such data deletion.

4.2.   Deletion on Term Expiry. On expiry of the Term, Customer instructs Adswerve and authorizes Adswerve to instruct Google to delete all Brazilian Customer Personal Data (including existing copies) from Adswerve’s and Google’s systems in accordance with applicable law. Adswerve will and will verify that Google comply with this instruction as soon as reasonably practicable and within a maximum period of 180 days, unless applicable laws require storage.

5.   Verifying Compliance. Customer agrees that Adswerve will assist Customer in verifying Adswerve’s and Google’s compliance with (i) Customer’s instructions; (ii) its obligations under this LGPD Processor Addendum; and (iii) the obligations applicable to it under the LGPD with respect to the processing of Brazilian Customer Personal Data, by:

5.1.   making the Security Documentation available for review by Customer;

5.2.   providing the information contained in the Data Processing Terms; and

5.3.   providing or otherwise making available, in accordance with Google’s standard practices, other materials concerning the nature of the Processor Services and the processing of Brazilian Customer Personal Data (for example, help centre materials).

6.   Data Subject Rights. Responses to Data Subject Requests. If Adswerve receives a request from a data subject in relation to Brazilian Customer Personal Data, Adswerve will:

6.1.   if the request is made via a Data Subject Tool, respond directly to the data subject’s request in accordance with the standard functionality of that Data Subject Tool; or

6.2.   if the request is not made via a Data Subject Tool, advise the data subject to submit his/her request to Customer, and Customer will be responsible for responding to such request.

7.   Changes to this LGPD Processor Addendum. Adswerve may change this LGDP Processor Addendum from time to time, without notice, if the change is required to comply with applicable law, applicable regulation, a court order or guidance issued by a governmental regulator or agency.

[Last updated August 13, 2020]