Legal

Privacy Policy

Last Updated: January 1, 2019

This privacy policy (“Policy”) describes how Inkit Inc. and its related companies (“Company”) collect, use and share personal information of users of this website, www.inkit.io or Company’s services (the “Site”). This Policy also applies to any of our other websites that post this Policy. This Policy does not apply to websites that post different statements.

1. What We Collect

We get information about you in a range of ways.

1.1 Information You Give Us. We collect your‎ name, postal address, email address, phone number, fax number, username, password, demographic information (such as your gender and occupation) as well as other information you directly give us on our Site.

1.2 Information We Get From Others. We may get information about you from other sources. We may add this to information we get from this Site.

1.3 Information Automatically Collected. We automatically log information about you and your computer. For example, when visiting our Site, we log your computer operating system type, browser type, browser language, the website you visited before browsing to our Site, pages you viewed, how long you spent on a page, access times and information about your use of and actions on our Site.

1.4 Cookies. We may log information using “Cookies“. Cookies are small data files stored on your hard drive by a website. We may use both session Cookies (which expire once you close your web browser) and persistent Cookies (which stay on your computer until you delete them) to provide you with a more personal and interactive experience on our Site. This type of information is collected to make the Site more useful to you and to tailor the experience with us to meet your special interests and needs. For more information on how we use Cookies please visit our Cookies Policy.

2. Use of Personal Information

We use your personal information as follows:

2.1 We use your personal information to operate, maintain, and improve our sites, products, and services.
2.2 We use your personal information to process and deliver contest entries and rewards.
2.3 We use your personal information to respond to comments and questions and provide customer service.
2.4 We use your personal information to send information including confirmations, invoices, technical notices, updates, security alerts, and support and administrative messages.
2.5 We use your personal information to communicate about promotions, upcoming events, and other news about products and services offered by us and our selected partners.
2.6 We use your personal information to link or combine user information with other personal information.
2.7 We use your personal information to protect, investigate, and deter against fraudulent, unauthorized, or illegal activity.
2.8 We use your personal information to provide and deliver products and services requested by customers.

3. Sharing of Personal Information

We may share personal information as follows:

3.1 We may share personal information with your consent. For example, you may let us share personal information with others for their own marketing uses. Those uses will be subject to the privacy polices of such others.

3.2 We may share personal information when we do a business deal, or negotiate a business deal, involving the sale or transfer of all or a part of our business, or assets. These deals can include (without limitation) any merger, reorganization, recapitalization, spin-off, split-off, split-up, financing, acquisition, or bankruptcy transaction or proceeding.

3.3 We may share personal information for legal, protection, and safety purposes.

3.4 We may share information to comply with laws, including court orders or agency investigations.

3.5 We may share information to respond to lawful requests and legal processes.

3.6 We may share information to protect the rights and property of Inkit Inc., our agents, customers, and others. This includes enforcing our agreements, policies, and terms of use.

3.7 We may share information in an emergency. This includes protecting the safety of our employees and agents, our customers, or any person.

3.8 We may share information with those who need it to do work for us.

3.9 We may also share aggregated and/or anonymized data with others for their own uses.

4. Information Choice and Changes

Our marketing emails tell you how to “opt-out.” If you opt out, we may still send you non-marketing emails. Non-marketing emails include emails about your accounts and our business dealings with you.

You may send requests about personal information to our Contact Information below. You can request to change contact choices, opt-out of our sharing with others, and update your personal information.

You can typically remove and reject cookies from our Site with your browser settings. Many browsers are set to accept cookies until you change your settings. If you remove or reject our cookies, it could affect how our Site works for you.

5. Contact Information

We welcome your comments or questions about this privacy policy. You may also contact us at our address:

Inkit Legal Department

Inkit Inc.

619 S 10th St #301

Minneapolis, MN 55404

Telephone: 612-444-1182

Email: [email protected]

6. Changes To This Privacy Policy

We may change this Policy. If we make any changes, we will change the Last Updated date above.

Acceptable Use

Many business and people use Inkit, and we’re proud of the trust placed in us. In exchange, we trust you to use our services responsibly. You agree not to misuse the Inkit website, application, and services (the “Service“) or help anyone else to do so.

If you violate this policy, we may suspend or terminate your account. We may also suspend or terminate accounts according to our Terms of Service where we see behavior, content, or other factors that poses a risk to our Services.

1. For example, you must not even try to do any of the following in connection with the Services:

1.1 Search, access, or create accounts for the Services by any means other than our publicly supported interfaces (for example, “scraping” or creating accounts in bulk).

1.2 Access, tamper with, or use non-public areas or parts of the Services, or shared areas of the Services you haven’t been invited to.

1.3 Interfere with or disrupt any user, host, or network, for example by sending a virus, overloading, flooding, spamming, or mail-bombing any part of the Services.

1.4 Abuse referrals or promotions to get more discount credits than deserved.

1.5 Circumvent account storage and mailing limits.

1.6 Publish or share materials that are unlawfully indecent or pornographic, or that contain extreme acts of violence.

1.7 Advocate bigotry or hatred against any person or group of people based on their race, religion, ethnicity, sex, sexual preference, gender identity, disability, or impairment.

1.8 Violate the law in any way, including publishing, mailing, emailing or sharing material that’s fraudulent, defamatory, or misleading or violate the privacy or infringe the rights of others.

1.9 Probe, scan, or test the vulnerability of any system or network.

1.10 Breach or otherwise circumvent any security or authentication measures.

1.11 Send unsolicited communications, promotions or advertisements, or spam.

1.12 Send altered, deceptive or false source-identifying information, including “spoofing” or “phishing”.

1.13 Promote or advertise products or services other than your own without appropriate authorization.

1.14 Sell the Services unless specifically authorized to do so.

2. You Agree Not To Send

2.1 Send mail or email that violates CAN-SPAM Laws.

2.2 Send mail or email that violates United States Postal Service and other service provider’s rules and regulations.

2.3 Send mail or email offering to sell illegal goods or services.

2.4 Pornography/adult/sexually explicit content.

2.5 Unfortunately some industries have higher-than-average abuse complaints, which can jeopardize our Services. We do not allow businesses that offer these types of products, services or content:

a. Pharmaceutical products.

b. Affiliate marketing.

c. Multi-level marketing.

d. List brokers or list rental services.

e. Work from home, make money online and lead generation opportunities.

f. Gambling products or services.

g. Escort, adult entertainment and dating services.

h. Get out of debt and credit repair services.

3. Mail Subject to Additional Scrutiny

Certain types of content may cause higher-than-average abuse rates. In general, hard bounce rates should be less than 5%, and spam complaint rates should be less than 0.1%. We reserve the right to review, suspend, or disable accounts that exceed these rates or offer the following services, products, or content:

3.1 Real estate services.

3.2 Mortgages and loans services.

3.3 Insurance services.

3.4 Nutritional, herbal, and vitamin supplements.

3.5 Services that assist or support sending mail or email on behalf of third parties without creating or reviewing the content.

3.6 Adult entertainment, escort and dating services.

3.7 Additional prohibited actions.

4. Prohibited Activities

We ask that our users to play their part in making Inkit a community that everyone wants to be a part of. You agree not to:

4.1 Send or mail spam. Spam can be in the form of bulk mail or one to one commercial mail. For bulk mail we use the definition, “unsolicited bulk mail.” For single commercial mail, we define spam as any message that violates CAN SPAM law. You must be able to point to an opt-in form or show other evidence of consent for bulk mail or email.

4.2 Put into your account or mail any material that wasn’t created by you, provided for you to use, or that would violate anyone’s rights. That includes photos, text, graphics, logos, and other content.

4.3 Use any misleading or incorrect names, addresses, email addresses, titles, or other information on the website or in any mail or email created or sent using our Service.

4.4 Decipher, decompile, disassemble, or reverse engineer any of the software on our Service, or in any way used or downloaded from the Service.

4.5 Use any of the software on our Service, or downloaded from the Service, to create a competing product.

4.6 Set up multiple accounts for any person or entity in order to send similar content, unless you’re part of a franchise or agency.

4.7 Upload or send to purchased, rented, third-party, co-reg, publicly available data, or partner lists of any kind.

4.8 Host content on our Service for any purpose other than to send mail or email campaigns.

4.9 Host images on our Service for any purpose other than for use in your mail or email campaigns.

4.10 Delete, bulk unsubscribe, or otherwise modify your list or orders in order to avoid our billing thresholds.

4.11 Share your login credentials or password.

4.12 Import or incorporate any of this information into any lists, mail or uploads to our servers: Social Security numbers, bank information, payment information, passwords, security credentials, or sensitive personal information.

5. Best Practices

As a direct mail and email service provider, it’s our responsibility to be extra aware about preventing spam-related abuse. We provide, and may update from time to time, articles outlining sending best practices in our knowledge base. You may only use Inkit in accordance with these best practices and our Terms of Service. We reserve the right to suspend or terminate your account if we find that you violate them.

‍

DMCA Policy

Inkit Inc. (“Inkit”, “us“, “our“, and “we“) respects the intellectual property rights of others and expects its users to do the same. In accordance with the Digital Millennium Copyright Act of 1998, the text of which may be found on the U.S. Copyright Office website at http://www.copyright.gov/

legislation/dmca.pdf, we will respond expeditiously to claims of copyright infringement committed using the Inkit service or the Inkit website (the “Site”) if such claims are reported to our Designated Copyright Agent identified in the sample notice below.

If you are a copyright owner, authorized to act on behalf of one, or authorized to act under any exclusive right under copyright, please report alleged copyright infringements taking place on or through the Site by completing the following DMCA Notice of Alleged Infringement and delivering it to our Designated Copyright Agent. Upon receipt of Notice as described below, Inkit will take whatever action, in its sole discretion, it deems appropriate, including removal of the challenged content from the Site.

DMCA Notice of Alleged Infringement (“Notice”)

1. Identify the copyrighted work that you claim has been infringed, or – if multiple copyrighted works are covered by this Notice – you may provide a representative list of the copyrighted works that you claim have been infringed.

2. Identify the material or link you claim is infringing (or the subject of infringing activity) and to which access is to be disabled, including at a minimum, if applicable, the URL of the link shown on the Site or the exact location where such material may be found.

3. Provide your full legal name, company affiliation (if applicable), mailing address, telephone number, and, if available, email address.

4. Include both of the following statements in the body of the Notice:

• “I hereby declare that I have a good faith belief that the disputed use of the copyrighted material is not authorized by the copyright owner, its agent, or the law (e.g., as a fair use).”
• “I hereby declare that the information in this Notice is accurate and, under penalty of perjury, that I am the owner, or authorized to act on behalf of, the owner, of the copyright or of an exclusive right under the copyright that is allegedly infringed.”

5. Provide your full legal name and your electronic or physical signature.

Please note that, pursuant to 17 U.S.C. § 512(f), any misrepresentation of material fact (falsities) in a written notification automatically subjects the complaining party to liability for any damages, costs and attorney’s fees incurred by us in connection with the written notification and allegation of copyright infringement.

Deliver this Notice, with all items completed, to our Designated Copyright Agent:

Inkit Legal Department

Inkit Inc.

619 S 10th St #301

Minneapolis, MN 55404

Enterprise Terms

Last Updated: December 1, 2018

These Enterprise Terms may be revised from time to time and by any applicable policies and guidelines (“Terms”). When we update these Terms we will post the updated Terms at https://www.inkit.io/enterprise-terms and update the “Last Updated” date to indicate the date of the most recent version. We encourage you to review these Terms periodically.

1. Definitions

The following terms, when used in this Agreement will have the following meanings:

• “Confidential Information” means any information or data disclosed by either party that is marked or otherwise designated as confidential or proprietary or that should otherwise be reasonably understood to be confidential in light of the nature of the information and the circumstances surrounding disclosure, and including any Personally Identifiable Information.  However, “Confidential Information” will not include any information which (a) is in the public domain through no fault of receiving party; (b) was properly known to receiving party, without restriction, prior to disclosure by the disclosing party; (c) was properly disclosed to receiving party, without restriction, by another person with the legal authority to do so; or (d) is independently developed by the receiving party without use of or reference to the disclosing party’s Confidential Information.

• “Customer Content” means content and other material supplied or made available to Inkit by Customer or Customer’s end users through the use of or access to the Inkit Services.

• “Documentation” means the printed and digital instructions, on-line help files, technical documentation and user manuals made available by Inkit for the Inkit Services.

• “Order Form” means an Order Form that sets for the specific Inkit Services and pricing therefor.  The initial Order Form is set forth on the cover page of this Agreement.  Any subsequent Order Forms must reference this Agreement and be mutually executed by the parties.

• “Inkit Technology” means the Inkit website, Inkit APIs, Documentation, code samples and technical support that may be made available by Inkit to Customer in connection with the Services.

• “Inkit Services” or “Services” means the printing and mailing services, Web-based services, programs, functions and platform provided by Inkit to Customer (including, without limitation, the Inkit Technology), and subsequent updates or upgrades of any of the foregoing made generally available by Inkit.

• “Personally Identifiable Information” means any information provided by Customer to Inkit that specifically identifies an individual, or that is otherwise defined as ‘personal data’ or ‘personal information’ by applicable laws or regulations relating to the collection, use or disclosure of information about an identifiable individual.

2. Inkit Services

2.1 Provision of Services.  Subject to the terms and conditions of this Agreement and the Inkit Acceptable Use Policy (available at https://www.inkit.io/legal/acceptable-use), Inkit will use commercially reasonable efforts to make the Inkit Services available to Customer pursuant to this Agreement and the applicable Order Form, and hereby grants Customer a non-exclusive right to access and use the Inkit Technology for Customer’s use of the Inkit Services to print and send the mailpieces that are the subject of an Order Form, including the right to write and execute software applications or websites (“Customer Applications”) that interface with the Inkit Services.

2.2 Customer Limitations.  The rights granted in Section 2.1 are subject to the following restrictions:

(a) Customer will not reverse engineer, decompile, disassemble or otherwise create, attempt to create or derive, or permit or assist any third party to create or derive the source code underlying the Inkit Services;

(b) Except for Customer Applications that use the Inkit Services, Customer will not transfer, resell, lease, license, or assign Inkit Services or otherwise offer the Inkit Services on a standalone basis;

(c) Customer will not (nor will it permit any third party to) use Inkit Services or Inkit Technology in any manner that violates Inkit’s Acceptable Use Policy (or any other term of this Agreement); and

(d) Customer will not otherwise use the Inkit Services or Inkit Technology outside the scope expressly permitted hereunder and in the applicable Order Form.

2.3 Support; Service Level Agreement.  Inkit will use commercially reasonable efforts to respond to any support questions from Customer within two (2) business days.  The terms of all Inkit Service Level Agreements (available at https://www.inkit.io/legal) are also incorporated herein by reference.  If there is any conflict between the terms of this Agreement and any Inkit Service Level Agreement, the terms of the Inkit Service Level Agreement will control.

2.4 Customer Responsibilities.  Customer will (a) be responsible for all use of the Inkit Services and Documentation under its account (whether or not authorized), (b) be solely responsible for the accuracy, quality, integrity and legality of Customer Content and Customer Application(s), and (c) use commercially reasonable efforts to prevent unauthorized access to or use of the Inkit Services and Documentation and notify Inkit promptly of any such unauthorized access or use.

2.5 API Changes.  Customer acknowledges that Inkit may change, deprecate or republish APIs for any Inkit Services or feature of the Inkit Services from time to time, and that it is Customer’s responsibility to ensure that calls or requests Customer makes to the Inkit Services are compatible with then-current APIs for the Inkit Services. Although Inkit endeavors to avoid changes to its APIs or Inkit Services that are not backwards compatible, if any such changes become necessary Inkit will endeavor to notify Customer at least thirty (30) days prior to Inkit’s implementation of any such incompatible changes to the Inkit Service of which it becomes aware.

3. Fees

3.1 Fees.  Except as otherwise specified herein (a) fees are quoted and payable in United States dollars and (b) payment obligations are non-cancelable and fees paid are non-refundable, except in accordance with Section 3.3.  In addition, Inkit reserves the right to increase prices based on United States Postal Service (“USPS”) then-current mailing fees.

3.2 Net of Taxes.  All applicable federal, state or local taxes and all use, sales, commercial, gross receipts, privilege, surcharges, or other similar taxes, license fees, miscellaneous fees, and surcharges, whether charged to or against Inkit, will be payable by Customer. Customer will not withhold any Taxes from any amounts due to Inkit.

3.3 Disputes; Refunds.  Customer acknowledges and agrees that, where Inkit has provided Customer with an Intelligent Mail Barcode tracking code for a mailpiece sent via the Inkit Services, Inkit will have no liability for and Customer will not be entitled to a refund, payment or any other remedy in the event the addressee does not receive such mailpiece.  If any mailpiece contains a printing or rendering error, Customer must notify Inkit of such error within thirty (30) days of such mailpiece printing in order to qualify for a credit or reimbursement for such mailpiece.  Any fee credits or reimbursements will be made in Inkit’s sole discretion.

4. Proprietary Rights and Confidentiality

4.1 Inkit’s Ownership Rights.  Inkit exclusively owns all right, title and interest in and to the Inkit Services and Inkit Technology. Except for the express rights granted hereunder, Inkit reserves all rights, title and interests in and to the Inkit Services, Inkit Technology and Inkit’s Confidential Information.

4.2 Inkit Marks.  Inkit hereby grants Customer a non-transferable, non-sublicensable, non-exclusive license during the Term of the Agreement to display the trade names, trademarks, service marks, logos, domain names of Inkit (each, a “Inkit Mark”) for the purpose of promoting or advertising that Customer uses the Inkit Services. In using Inkit Marks, Customer may not: (a) display a Inkit Mark in any manner that implies a relationship or affiliation with, sponsorship, or endorsement by Inkit; (b) use Inkit Marks to disparage Inkit or its products or services; or (c) display a Inkit Mark on a site that violates any law or regulation. Customer will only use Inkit Marks with Inkit’s prior written consent, which may be withheld or revoked at Inkit’s discretion. Furthermore, Inkit may modify any Inkit Marks at any time, and upon notice, Customer will use only the updated Inkit Marks. Other than as permitted in this Section 4.2, Customer may not use any Inkit Marks without prior written consent.  All use of the Inkit Marks will be subject to any trademark usage guidelines that Inkit may publish from time to time, and Customer will conduct its business in a professional manner that reflects favorably on the goodwill and reputation of Inkit.

4.3 Feedback.  Customer may from time to time provide Inkit suggestions or comments for enhancements or improvements, new features or functionality or other feedback (“Feedback”) with respect to the Inkit Services.  Inkit will have full discretion to determine whether or not to proceed with the development of any requested enhancements, new features or functionality.  Inkit will have the full, unencumbered right to use, incorporate and otherwise fully exercise and exploit any such Feedback in connection with its products and services.

4.4 Customer Content.  As between the parties, the Customer Content, Personally Identifiable Information and Customer Applications will be owned by Customer.  Customer hereby grants to Inkit a non-exclusive, worldwide license to copy, distribute and use Customer Content and Personally Identifiable Information only in connection with providing the Inkit Services.  At no point in time will Inkit have any liability whatsoever for any damage, liabilities, losses (including any loss of data or profits) or any other consequences that Customer may incur with respect to the loss or deletion of Customer Content or Personally Identifiable Information.

4.5 Confidentiality.  Each party agrees that it will use the Confidential Information of the other party solely in accordance with the provisions of this Agreement and it will not disclose, or permit to be disclosed, the same directly or indirectly, to any third party without the other party’s prior written consent, except as otherwise permitted hereunder.  However, either party may disclose this Agreement, in whole or in part  to its employees, officers, directors, attorneys, auditors, financial advisors, actual or potential investors and/or subcontractors who have a need to know and are legally bound to keep such information confidential by confidentiality obligations consistent with those of this Agreement; and  as reasonably deemed by a party to be required by law (in which case each party will provide the other with prior written notification thereof, will provide such party with the opportunity to contest such disclosure, and will use its reasonable efforts to minimize such disclosure to the extent permitted by applicable law).  Each party agrees to exercise due care in protecting the Confidential Information from unauthorized use and disclosure.  In the event of actual or threatened breach of the provisions of this Section 4.5 or Section 2.2, the non-breaching party will be entitled to seek immediate injunctive and other equitable relief, without waiving any other rights or remedies available to it.  Each party will promptly notify the other in writing if it becomes aware of any violations of the confidentiality obligations set forth in this Agreement.

4.6 Data Security.  Inkit will: (a) employ at least industry standard practices to protect Customer Content and Personally Identifiable Information, and use and access Customer Content and Personally Identifiable Information only for the purpose of performing its obligations hereunder; (b) comply with all applicable laws relating to privacy and data protection; and (c) provide Customer with written notice of any unauthorized access or use of the Customer Content or any Personally Identifiable Information of which Inkit becomes aware, and reasonably cooperate with Customer in the investigation and resolution of any such incident.

4.7 Aggregated Information.  Notwithstanding anything to the contrary, Inkit shall have the right to aggregate, collect and analyze data and other information relating to the provision, use and performance of the Inkit Services and shall be free (during and after the term hereof) to (a) use such data and other information to develop and improve the Inkit Services and other Inkit offerings, and (b) disclose such data and other information solely in an aggregated and anonymized format that does not identify Customer or any individual.

5. Warranties and Disclaimers

5.1 Inkit.  Inkit warrants that it will, consistent with prevailing industry standards, maintain the Inkit Services in a manner which minimizes errors and interruptions in the Inkit Services and perform the Inkit Services in a professional and workmanlike manner.

5.2 Customer.  Customer represents and warrants that it has the necessary rights, licenses, consents, permissions, waivers and releases to use, make available and distribute the Customer Applications and Customer Content in connection with the Inkit Services as contemplated herein.

5.3 DISCLAIMER.  EXCEPT AS EXPRESSLY SET FORTH HEREIN, EACH PARTY DISCLAIMS ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, TITLE, NON-INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE. INKIT DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR FREE; NOR DOES IT MAKE ANY WARRANTY AS TO THE RESULTS THAT MAY BE OBTAINED FROM USE OF THE SERVICES.  EXCEPT AS EXPRESSLY SET FORTH IN THIS SECTION, THE SERVICES AND IMPLEMENTATION SERVICES ARE PROVIDED “AS IS” AND INKIT DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF NON-INFRINGEMENT.

6. Indemnification

6.1 Indemnification by Customer.  Customer will defend Inkit against any Claim made or brought against Inkit by a third party arising out of the Excluded Claims or Customer’s failure to comply with Inkit’s Acceptable Use Policy or other Inkit Service Level Agreements, and Customer will indemnify Inkit for any damages finally awarded against (or any approved settlement) Inkit in connection with any such Claim; provided that (a) Inkit will promptly notify Customer of such Claim, (b) Customer will have the sole and exclusive authority to defend and/or settle any such Claim (provided that Customer may not settle any Claim without Inkit’s prior written consent, which will not be unreasonably withheld, unless it unconditionally releases Inkit of all liability) and (c) Inkit reasonably cooperates with Customer in connection therewith.

7. Limitation of Liability

UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY, WHETHER IN TORT, CONTRACT, OR OTHERWISE, WILL EITHER PARTY BE LIABLE TO THE OTHER FOR (A) ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES OF ANY CHARACTER, INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF GOODWILL, LOST PROFITS, LOST SALES OR BUSINESS, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, LOST DATA, OR FOR ANY AND ALL OTHER DAMAGES OR LOSSES, EVEN IF A REPRESENTATIVE OF SUCH PARTY HAS BEEN ADVISED, KNEW OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGES, OR (B) EXCLUDING CUSTOMER’S PAYMENT OBLIGATIONS, ANY DIRECT DAMAGES, COSTS, OR LIABILITIES IN EXCESS OF THE AMOUNTS PAID BY CUSTOMER DURING THE TWELVE MONTHS PRECEDING THE INCIDENT OR CLAIM.

8. Termination

8.1 Term.  The term of this Agreement will commence on the Effective Date and continue until terminated as set forth below.

8.2 Termination.  Each party may terminate this Agreement upon written notice to the other party if there are no Order Forms then in effect. Each party may also terminate this Agreement upon written notice in the event (a) the other party commits any material breach of this Agreement and fails to remedy such breach within thirty (30) days after written notice of such breach or (b) subject to applicable law, upon the other party’s liquidation, commencement of dissolution proceedings or assignment of substantially all its assets for the benefit of creditors, or if the other party become the subject of bankruptcy or similar proceeding that is not dismissed within sixty (60) days.  Inkit may also suspend any Inkit Services immediately upon notice (i) if Customer violates (or gives Inkit reason to believe it has violated) any provision of the Terms of Service, API Terms, or other Inkit Service Level Agreement; or (ii) if Inkit reasonably determines that its provision of any of the Inkit Services is prohibited by applicable law, or has become impractical or unfeasible for any legal or regulatory reason.

8.3 Survival.  Upon termination or expiration of this Agreement all rights and obligations will immediately terminate except that Sections 2.2, 2.3, 3, 4.1, 4.2, 4.3, 4.4, 6, 7, 8.2 and 9 will survive the termination or expiration of this Agreement for any reason whatsoever.

9. General

9.1 Export Compliance.  Each party will comply with the export laws and regulations of the United States and other applicable jurisdictions in providing and using the Inkit Services.

9.2 Publicity.  Customer agrees that Inkit may refer to Customer’s name and trademarks in Inkit’s marketing materials and website, and in press releases, customer references and case studies, with a description of the relationship.

9.3 Assignment.  Neither party hereto may assign or otherwise transfer this Agreement, in whole or in part, without the other party’s prior written consent, except that either party may assign this Agreement without consent to a successor to all or substantially all of its assets or business related to this Agreement.  Any attempted assignment, delegation, or transfer by either party in violation hereof will be null and void.  Subject to the foregoing, this Agreement will be binding on the Parties and their successors and assigns.

9.4 Amendment; Waiver.  No amendment or modification to this Agreement, nor any waiver of any rights hereunder, will be effective unless assented to in writing by both parties.  Any such waiver will be only to the specific provision and under the specific circumstances for which it was given, and will not apply with respect to any repeated or continued violation of the same provision or any other provision.  Failure or delay by either party to enforce any provision of this Agreement will not be deemed a waiver of future enforcement of that or any other provision.

9.5 Counterparts.  This Agreement may be executed in multiple counterparts, each of which will be deemed an original, but all of which together will constitute one and the same instrument.

9.6 Relationship.  Nothing contained herein will in any way constitute any association, partnership, agency, employment or joint venture between the parties hereto, or be construed to evidence the intention of the parties to establish any such relationship. Neither party will have the authority to obligate or bind the other in any manner, and nothing herein contained will give rise or is intended to give rise to any rights of any kind to any third parties.

9.7 Unenforceability.  If a court of competent jurisdiction determines that any provision of this Agreement is invalid, illegal, or otherwise unenforceable, such provision will be enforced as nearly as possible in accordance with the stated intention of the parties, while the remainder of this Agreement will remain in full force and effect and bind the parties according to its terms.

9.8 Governing Law.  This Agreement will be governed by the laws of the State of Minnesota, USA, exclusive of its rules governing choice of law and conflict of laws.  This agreement will not be governed by the United Nations Convention on Contracts for the International Sale of Goods.  All disputes arising out of the Agreement will be subject to the exclusive jurisdiction and venue of the state and federal courts of Hennepin County, Minnesota, USA, and the parties hereby consent to the personal jurisdiction of these courts.

9.9 Notices.  Any notice required or permitted to be given hereunder will be given in writing to the party at the address specified in this Agreement by personal delivery, certified mail, return receipt requested, or by overnight delivery. Inkit’s address for notice is: Inkit, 619 S 10th St #301, Minneapolis, MN 55404.

9.10 Entire Agreement.  This Agreement comprises the entire agreement between Customer and Inkit with respect to its subject matter, and supersedes all prior and contemporaneous proposals, statements, sales materials or presentations and agreements (oral and written).  No oral or written information or advice given by Inkit, its agents or employees will create a warranty or in any way increase the scope of the warranties in this Agreement.

9.11 Force Majeure.  Neither Party will be deemed in breach hereunder for any cessation, interruption or delay in the performance of its obligations due to causes beyond its reasonable control, including, without limitation, earthquake, flood, or other natural disaster, act of God, labor controversy, civil disturbance, terrorism, war (whether or not officially declared) or the inability to obtain sufficient supplies, transportation, or other essential commodity or service required in the conduct of its business, or any change in or the adoption of any law, regulation, judgment or decree.

9.12 Amendment; No Waiver.  We may update and change any part or all of these Terms, including fees associated with the use of the Inkit services. If we update or change these Terms, the updated Terms will be posted at https://www.inkit.io/enterprise-terms. The updated Terms will become effective and binding on the next business day after they are posted. When we change these Terms, the “Last Updated” date above will be updated to reflect the date of the most recent version. We encourage you to review these Terms periodically. No delay in exercising any right or remedy or failure to object will be a waiver of such right or remedy or any other right or remedy. A waiver on one occasion will not be a waiver of any right or remedy on any future occasion.

9.13 Government Terms.  Inkit provides the Inkit Services, including related software and technology, for ultimate federal government end use solely in accordance with the terms of this Agreement.  If Customer (or any of its customers) is an agency, department, or other entity of any government, the use, duplication, reproduction, release, modification, disclosure, or transfer of the Inkit Services, or any related documentation of any kind, including technical data, software, and manuals, is restricted by the terms of this Agreement.  All other use is prohibited and no rights than those provided in this Agreement are conferred. The Inkit Services were developed fully at private expense.

‍

Service Level Agreement

Last Updated: January 1, 2019

This Service Level Agreement (“SLA”) governs the provision of the software services (“Software Service”) by Inkit Inc. (“Inkit”, “us” or “we“) to customer (“Customer“) if specified by the terms of the Inkit Customer Agreement (the “Agreement“).  All capitalized terms not defined herein shall have the meanings given to them in the Enterprise Terms.  “Service Levels” means Availability or Problem Resolution as specified below.

1. Service Availability

“Availability” means System Availability or Website Availability as specified below.  The Software Service shall perform in accordance with the following standards: “System Availability” means Software Service monthly uptime of 99%, excluding scheduled downtime (of which Inkit will give at least one (1) week notice and which Inkit will schedule during the weekend hours from 6:00 p.m. PT Friday to 3:00 a.m. PT Monday), not to exceed forty-eight (48) hours in any twelve (12) month period.  “Website Availability” means minimum webpage connect time of 2.0 seconds 90% of the time and 4.0 seconds 100% of the time.

2. Technical Support & Problem Resolution

2.1 Problem Resolution.  Inkit will correct all problems that are reported by Customer or of which Inkit otherwise becomes aware in accordance with the following table.  The priority level of the problems reported by Customer shall be determined by Inkit.

Priority

Description

Response and Fix Time

1

The Software Service is not working, a significant function of the Software Service is not properly working or a significant number of users are unable to access or use some functionality.

Inkit will respond to and Inkit’s senior engineers will commence efforts to fix Priority 1 problems no later than one (1) hour after Customer’s report of such problem or Inkit’s detection of such problem, whichever is earlier.  Inkit will use best and continuous efforts, twenty-four (24) hours per day, seven (7) days per week to provide an acceptable work-around for the Priority 1 problem, and will provide a permanent fix for the Priority 1 problem no later than thirty (30) days after Customer’s report of such problem or Inkit’s detection of such problem, whichever is earlier.

2

Functionality of the Software Service is impaired or some users are unable to access or use some functionality.

Inkit will respond to and Inkit’s senior engineers will commence efforts to fix Priority 2 problems no later than one (1) hour after Customer’s report of such problem or Inkit’s detection of such problem, whichever is earlier. Inkit will use reasonable and continuous efforts to fix Priority 2 problems during normal business hours, and if an acceptable work-around is provided, will provide a permanent fix of the Priority 2 problem no later than thirty (30) days after Customer’s report of such problem or Inkit’s detection of such problem, whichever is earlier.

3

Low impact to users of the Software Service.

Inkit will respond to Priority 3 problems within four (4) hours after Customer’s report of such problem or Inkit’s detection of such problem, whichever is earlier, during Customer’s regular business hours (or on the next business day, if the problem is reported outside of Customer’s regular business hours). Inkit will fix Priority 3 problems no later than thirty (30) days after Customer’s report of such problem or Inkit’s detection of such problem, whichever is earlier.

3. Failure to Achieve Service Levels

If Service Levels falls below the Availability or Fix Times during any calendar month, Customer may elect to receive a credit from Inkit against fees and payments due for the months following any month in which Service Levels do not meet the Availability or Fix Times, as liquidated damages and not as a penalty, an amount equal to ten percent (10%) of the Platform Amount fees due to Inkit for that month.  In order to receive credit, Customer must submit a claim by notifying Inkit support. To be eligible, the claim must be received during the subsequent month’s billing cycle after which the incident occured. The claim must include (i) dates and times of each problem (ii) the logs that document the errors and corroborate Customer’s claimed outage. If the claim is accepted by Inkit and is less than the Availability, then Inkit will issue a credit within thirty days following the month your claim is accepted. Customer’s failure to submit a claim and provide the preceding information will disqualify Customer from receiving a credit.

4. Contingencies

Inkit will, in accordance with industry best practice, maintain detailed and comprehensive contingency plans against events which could affect the ability of Inkit to provide support in accordance with this SLA, including, without limitation, loss of production, loss of systems, loss of equipment, industrial relations problems with Inkit’s or Inkit’s subcontractors’ personnel, failures in the supply chain, failure of carriers and the failure of Inkit’s or its vendors’ equipment, computer systems or business systems.

5. General

This SLA is subject to occasional revision, and if we make any substantial changes, we may notify Customer by sending them an e-mail to the last e-mail address Customer provided to us (if any), and/or by prominently posting notice of the changes on our website. Customer is responsible for providing us with their most current e-mail address. In the event that the last e-mail address that Customer has provided us is not valid, or for any reason is not capable of delivering to Customer the notice described above, our dispatch of the e-mail containing such notice will nonetheless constitute effective notice of the changes described in the notice. Any changes to this SLA will be effective upon the earlier of thirty (30) calendar days following our dispatch of an e-mail notice to Customer (if applicable) or thirty (30) calendar days following our posting of notice of the changes on our website. These changes will be effective immediately for new users of the Inkit Technology. Continued use of the Inkit Technology following notice of such changes shall indicate your acknowledgement of such changes and agreement to be bound by the terms and conditions of such changes.

6. Exclusions

The Availability does not apply to any unavailability, suspension or termination of Inkit’s Software Services, or any other Inkit performance issues: (i) that result from a violation of Inkit’s Terms of Service or Inkit Customer Agreement; (ii) caused by factors outside of Inkit’s reasonable control, including any force majeure event or internet access or related problems beyond the demarcation point of Inkit’s Software Service; (iii) that result from any actions or inactions of Customer or any third party; (iv) that result from Customer’s software, equipment or other technology and/or third party software, equipment or other technology (other than third party equipment within Inkit’s direct control); (v) that result from any scheduled downtime as provided; or (vi) arising from Inkit’s suspension and termination of Customer’s right to use the Software Service in accordance with Inkit’s Terms of Service. If availability is impacted by factors other than those used in the Availability calculation, then Inkit may issue a credit at its own discretion.

HIPAA Addendum

Last Updated: July 1, 2020

Pursuant to the Master Subscription Agreement between Inkit and the Customer (“Agreement”) and any additional terms set forth in this HIPAA Addendum, the Customer intends to submit Protected Health Information, as defined in 45 CFR §160.103 (“PHI”), to Inkit’s Services, either directly or indirectly, and Inkit has agreed to store and process such PHI subject to the terms of a Business Associate Addendum between the Parties and the terms of this HIPAA Addendum. Capitalized terms used but not defined in this HIPAA Addendum have the meanings given to them in the Agreement.

1. The Customer agrees that, in connection with the use of the Services to collect or store PHI, the Customer shall notify Inkit in writing of: (i) the type of PHI being sent to, or collected by, the Services by or on behalf of the Customer; (ii) the way that the PHI is being submitted to the Services (e.g., by API); and (iii) the specific end user attributes or events related to the submission of any PHI.

2. The Customer acknowledges and agrees that, if the Customer uses any third-party integrations with the Services (such as print, mail, or fulfillment functionalities provided by third parties), such third-party integrations may not be HIPAA compliant and Inkit is not liable for any non-compliance, data breaches, or damages that may arise as a result of the Customer’s use of any such third-party integrations.

3. The Customer is responsible for securing and controlling its logins and API keys related to the Services. Inkit urges the Customer to use IP whitelisting for dashboard and server usage and an API key secret manager. Inkit is not liable to the Customer for violations of HIPAA arising from any incidents, non-compliance, data breaches, or damages that are attributable, directly or indirectly, to the Customer’s failure to protect its logins or API keys related to the Services.

4. The Customer agrees that: (i) it shall not store or submit to the Services medical reports, medical records, or medical images; and (ii) it shall use the Services exclusively for engagement, retention, customer relationship management, and marketing purposes and not as part of any patient treatment. The Customer acknowledges that Inkit does not warrant the availability of PHI maintained through the Services and that the Customer is responsible for ensuring that all PHI submitted to or stored on the Services exists elsewhere in duplicate.

5. The Customer is exclusively responsible, and Inkit has no liability to the Customer for, the Customer’s compliance with HIPAA in connection with the Customer’s export or transfer, directly or indirectly, of PHI from or via the Services.

6. Inkit disclaims any liability for violations of HIPAA arising from the Customer’s use of the Services to send messages or other materials that contain PHI or that are related to clinical quality issues, patient safety issues, clinical or medical care, or patient health-related issues.

7. The Customer will be provided with custom HTTPS endpoints for ingestion of Customer Data, including PHI, into the Services in a HIPAA-compliant manner. The Customer acknowledges that it is the Customer’s responsibility to ensure that Customer Data, including PHI, sent via API uses these endpoints and failure to do so may result in processing of the Customer Data in a non-HIPAA-compliant manner. Inkit is not liable to the Customer for breaches of HIPAA arising from the Customer’s failure to use the custom HTTPS endpoints provided by Inkit.

Except as modified by this HIPAA Addendum, the Agreement remains unmodified and in full force and effect. The Customer hereby ratifies and reaffirms acceptance of all terms and conditions of the Agreement.

HIPAA Business Associate Addendum

Last Updated: July 1, 2020

This HIPAA Business Associate Addendum (the “BAA”) is made a part of, and incorporated into, the Agreement. The purpose of this BAA is to implement certain requirements of the Health Insurance Portability and Accountability Act of 1996 and the rules and regulations promulgated thereunder, as supplemented and amended by the requirements of Subtitle D of the Health Information Technology for Economic and Clinical Health (HITECH) Act provisions of the American Recovery and Reinvestment Act of 2009 and the rules and regulations promulgated thereunder (collectively, “HIPAA”). The Parties acknowledge that those regulations include both the federal privacy regulations, as amended from time to time, issued pursuant to HIPAA and codified at 45 CFR Parts 160 and 164 (Subparts A & E) (the “Privacy Rule”), and the federal security regulations, as amended from time to time, issued pursuant to HIPAA and codified at 45 CFR Parts 160 and 164 (Subparts A& C) (the “Security Rule”).

In the course of providing the Services to the Customer pursuant to the Agreement, Inkit may, on behalf of the Customer, receive, maintain, or transmit information entered into the Services as Customer Data that constitutes Protected Health Information, as defined in 45 CFR §160.103 (“PHI”), and as a result may, for certain purposes and under certain circumstances, be deemed a Business Associate, as such term is defined in 45 CFR §160.103, under HIPAA. This BAA governs the Customer’s and Inkit’s respective responsibilities with respect to PHI when Inkit acts as a Business Associate to the Customer, including Inkit’s Use and Disclosure of PHI, as such terms are defined in 45CFR §160.103.

Capitalized terms used but not defined in this BAA have the meaning given to them in the Agreement. If any such term is not defined in the Agreement, then such term has the meaning given to it under HIPAA.

The Parties hereby agree as follows:

1. Use and Disclosure of PHI by the Customer.

The Customer shall Use and Disclose PHI, including in any data export of PHI, only as permitted by HIPAA. The Customer shall not authorize, request, or require Inkit to Use or Disclose PHI in any manner that would violate HIPAA if the Use or Disclosure were carried out by the Customer, except as permitted under HIPAA and set forth in this BAA. The Customer shall not voluntarily add any limitation to any notice of privacy practices or agree to any restriction request to the extent that such limitation or restriction would further limit Inkit’s Use or Disclosure of PHI under this BAA. To the extent that the Customer is required by law to include a limitation in its notice of privacy practices or to agree to a restriction request that further limits Inkit’s Use or Disclosure of PHI under this BAA, the Customer shall immediately notify Inkit of such limitation or restriction. To the extent that an Individual revokes a consent, authorization, or permission that results in further limitation on Inkit’s Use or Disclosure of PHI under this BAA, the Customer shall immediately notify Inkit of such limitation.

2. Use and Disclosure of PHI by Inkit.

Inkit shall Use or Disclose PHI only in the manner and for the purposes set forth in this BAA and not in any other manner or for any other purposes. The Customer hereby authorizes Inkit to do the following:

2.1 Use and Disclose PHI as necessary to provide the Services, to prevent or address service or technical problems, and to perform support services to the Customer, so long as such Use or Disclosure would not violate HIPAA if done by the Customer; and

2.2 Use and Disclose PHI for Inkit’s proper management and administration, provided that any Disclosure is (a) Required by Law or (b) Inkit receives reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and Used or further Disclosed only as Required by Law or for the purposes for which it was Disclosed to the person and that the person will notify Inkit of any instances of which the person is aware in which the confidentiality of the PHI has been breached.

2.3 Use PHI to create de-identified information in accordance with 45 CFR§164.514(b), and such resulting de-identified information shall no longer be subject to HIPAA or this BAA.

For clarity, Inkit makes no representations about the Use and Disclosure of PHI by any Third-Party Provider or Third-Party Vendor accounts and/or websites operated by or on behalf of the Customer with respect to which the Customer is using the Services.

3. Protection of PHI.

In connection with its receipt, maintenance, or transmission of PHI on behalf of the Customer, Inkit agrees to do the following:

3.1 in accordance with 45 CFR §164.502(e)(1), ensure that any Subcontractors that receive, maintain, or transmit PHI on behalf of Inkit agree to restrictions and conditions no less restrictive than those that apply to Inkit in this BAA with respect to such PHI;

3.2  use administrative, technical, and physical safeguards, and comply, where applicable, with the Security Rule with respect to any PHI that constitutes Electronic Protected Health Information, to prevent Use or Disclosure of PHI other than as provided for by this BAA;

3.3 comply with the applicable requirements of the Security Rule; and

3.4  to the extent Inkit is to carry out the Customer’s obligations under the Privacy Rule, comply with the requirements of the Privacy Rule that apply to the Customer in the performance of those obligations; notwithstanding the foregoing, the Parties acknowledge that, under the Agreement and this BAA, unless otherwise agreed upon by the Parties in writing, Inkit has no obligations to carry out any of the Customer’s obligations under the Privacy Rule.

The Parties acknowledge that Inkit makes no representations about the accuracy of PHI that is received, maintained, or transmitted by or on behalf of the Customer by the Services.

4. Breach Notification.

4.1 Inkit shall report to the Customer any Use or Disclosure of PHI not provided for in this BAA of which Inkit becomes aware, including any Breach of Unsecured Protected Health Information in accordance with 45 CFR §164.410. In addition, Inkit shall provide to the Customer all information required by 45CFR §164.410(c) to the extent known and provide any additional available information reasonably requested by the Customer for purposes of investigating the Breach. For purposes of this BAA, “Breach” means the acquisition, access,Use, or Disclosure of PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of the PHI as defined, and subject to the exclusions set forth, in 45 CFR §164.402.

4.2 Inkit shall be required to report to the Customer, without unreasonable delay, any successful Security Incidents pertaining to PHI of which Inkit becomes aware, except that this section hereby serves as notice, and no additional reporting shall be required, of the regular occurrence of unsuccessful attempts at unauthorized access, use, disclosure, modification, or destruction of PHI, and unsuccessful attempts at interference with systems containing PHI.

5. Access by HHS.

Inkit shall make its internal practices, books, and records relating to the Use and Disclosure of PHI available to the Secretary of the United States Department of Health and Human Services for purposes of determining the Customer’s compliance with HIPAA.

6. Individual Access Requests.

Inkit shall forward to the Customer any requests Inkit receives from an Individual for access to the Individual’s PHI that is entered in the Services by the Customer to which the Customer shall respond in accordance with the requirements of 45 CFR §164.524.By virtue of providing the Services, Inkit shall make available to the Customer all PHI that is entered in the Services by or on behalf of the Customer, including PHI about an Individual, to facilitate the Customer’s compliance with the requirements of 45 CFR §164.524.

7. Individual Amendment Requests.

The Customer shall be exclusively responsible for responding to all requests by Individuals for amendment to their PHI in accordance with HIPAA. By virtue of providing the Services, Inkit shall make available to the Customer all PHI that is entered in the Services by or on behalf of the Customer, including any PHI required to be made available for amendment in accordance with 45 CFR §164.526, in a manner that allows the Customer to reasonably incorporate any amendments to the PHI in accordance with 45 CFR §164.526.

8. Individual Accounting Requests.

Inkit shall, in accordance with and as required by 45 CFR §164.504(e)(2), document Disclosures of PHI made by Inkit and maintain information related to such Disclosures. Inkit shall make related information reasonably available to the Customer to assist the Customer to comply with its legal obligations under 45 CFR §164.528 and for the Customer to respond to requests by Individuals for an accounting of Disclosures of their respective PHI.

9. Termination.

Upon termination of the Agreement, the Customer may export Customer Data submitted to the Services in accordance with the Agreement and Customer Data submitted to the Services will be securely over written or deleted by Inkit, as set forth in the Agreement. Such data deletion process is subject to applicable legal requirements. If export or destruction of Customer Data that constitutes PHI is not feasible, Inkit shall extend the confidentiality and security protections of this BAA to that Customer Data and limit further Uses and Disclosures of such Customer Data to those purposes that make the return or destruction of the Customer Data infeasible.

10. Non-Compliance.

In the event either Party becomes aware that the other Party has engaged in a pattern of activity or practice that constitutes a material breach or violation of this BAA, the non-breaching Party may request in writing that the breaching Party cure the breach or violation.If the breach or violation is not cured within 30 days of the written notice, the non-breaching Party may terminate this BAA, the Agreement, and any outstanding Order Form(s).

11. Amendment.

The Parties shall take such action as is necessary to amend the Agreement and this BAA from time to time as is necessary for the Parties to comply with changes to the rules and regulations under HIPAA. If the Parties cannot agree as to a necessary amendment, either Party may terminate the Agreement, any outstanding Order Form(s), and this BAA with 30 day prior written notice to the other Party.

12. Interpretation.

Any ambiguity in this BAA shall be resolved to permit the Parties to comply with HIPAA.

Standard Contractual Clauses (Processors)

Last Updated: July 1, 2020

These Standard Contractual Clauses form part of the Data Processing Addendum between Inkit Inc. and the Customer or any applicable Authorized Affiliate (the “DPA”) to reflect the parties’ agreement with regard to the Processing of Personal Data (as defined in the DPA). For purposes of these Standard Contractual Clauses, when and as applicable, the Customer and any applicable Authorized Affiliate are each the data exporter, and the Customer’s signing of the DPA or an Agreement referencing the DPA, or a Customer’s Affiliate signing an Order Form under an Agreement referencing the DPA, shall be treated assigning of these Standard Contractual Clauses and their appendices. All capitalized terms not defined herein have the meaning set forth in the DPA.

For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection.

Name of the data exporting organisation: Customer or Customer Authorized Affiliate as set forth in the DPA or any applicable Order Form

Address:as set forth in the DPA or any applicable Order Form

Tel./ Fax/email: as set forth in the DPA or any applicable Order Form

Other information needed to identify the organisation: Not applicable

(the data exporter)

And

Name of the data importing organisation: Inkit Inc.

Address: 619 S 10th St., #301, Minneapolis, MN 55404

Tel: 612-223-3000; email: [email protected]

Other information needed to identify the organisation: Not applicable

(the data importer)

each a “party”; together“the parties”,

HAVE AGREED on the following Contractual Clauses (the Clauses) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.

*********************

Clause 1

Definitions

For the purposes of the Clauses:

(a)        'personal data', 'special categories of data', 'process/processing', 'controller', 'processor', 'data subject' and 'supervisory authority' shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data[1];

(b)        'the data exporter'means the controller who transfers the personal data;

(c)         'the data importer'means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country's system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;

(d)        'the subprocessor' means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;

(e)        'the applicable data protection law' means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established;

(f)         'technical and organisational security measures' means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss,alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

Clause 2

Details of the transfer

The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 which forms an integral part of the Clauses.

Clause 3

Third-party beneficiary clause

1.          The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a)to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.

2.          The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.

3.          The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and (g),Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.

4.          The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.

Clause 4

Obligations of the data exporter

The data exporter agrees and warrants:

(a)        that the processing,including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;

(b)        that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter's behalf and in accordance with the applicable data protection law and the Clauses;

(c)        that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this contract;

(d)        that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;

(e)         that it will ensure compliance with the security measures;

(f)         that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;

(g)        to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;

(h)        to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;

(i)         that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and

(j)         that it will ensure compliance with Clause 4(a) to (i).

Clause 5

Obligations of the data importer[2]

The data importer agrees and warrants:

(a)        to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;

(b)        that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;

(c)        that it has implemented the technical and organisational security measures specified in Appendix 2 before processing the personal data transferred;

(d)        that it will promptly notify the data exporter about:

(i)         any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation,

(ii)       any accidental or unauthorised access, and

(iii)      any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;

(e)        to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;

(f)         at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;

(g)        to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;

(h)        that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent;

(i)         that the processing services by the subprocessor will be carried out in accordance with Clause 11;

(j)         to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data exporter.

Clause 6

Liability

1.          The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensation from the data exporter for the damage suffered.

2.          If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity.

The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities.

3.          If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the subprocessor agrees that the data subject may issue a claim against the data subprocessor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the subprocessor shall be limited to its own processing operations under the Clauses.

Clause 7

Mediation and jurisdiction

1.          The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject:

(a)        to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;

(b)       to refer the dispute to the courts in the Member State in which the data exporter is established.

2.          The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.

Clause 8

Cooperation with supervisory authorities

1.          The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.

2.          The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.

3.          The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any subprocessor preventing the conduct of an audit of the data importer, or any subprocessor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5 (b).

Clause 9

Governing Law

The Clauses shall be governed by the law of the Member State in which the data exporter is established.

Clause 10

Variation of the contract

The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.

Clause 11

Subprocessing

1.          The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on the data importer under the Clauses[3]. Where the subprocessor fails to fulfill its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the subprocessor's obligations under such agreement.

2.          The prior written contract between the data importer and the subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.

3.          The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established.

4.          The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5 (j), which shall be updated at least once a year. The list shall be available to the data exporter's data protection supervisory authority.

Clause 12

Obligation after the termination of personal data processing services

1.          The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.

2.          The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1.

*********************

APPENDIX 1 TO THE STANDARD CONTRACTUAL CLAUSES

This Appendix forms part of the Clauses and must be completed and signed by the parties.

The Member States may complete or specify,according to their national procedures, any additional necessary information to be contained in this Appendix.

Details relevant for this Appendix 1,completed by the parties, are available in Schedule 2 to the DPA.

*********************

APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES

This Appendix forms part of the Clauses and must be completed and signed by the parties.

Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached):

Refer to Inkit’s Security, Privacy, and Architecture Datasheet attached as Schedule 1 to the DPA.

[1] Parties may reproduce definitions and meanings contained in Directive 95/46/EC within this Clause if they considered it better for the contract to stand alone.

[2] Mandatory requirements of the national legislation applicable to the data importer which do not go beyond what is necessary in a democratic society on the basis of one of the interests listed in Article 13(1) of Directive 95/46/EC, that is, if they constitute a necessary measure to safeguard national security, defence, public security, the prevention, investigation, detection and prosecution of criminal offences or of breaches of ethics for the regulated professions, an important economic or financial interest of the State or the protection of the data subject or the rights and freedoms of others, are not in contradiction with the standard contractual clauses. Some examples of such mandatory requirements which do not go beyond what is necessary in a democratic society are, interalia, internationally recognised sanctions, tax- reporting requirements or anti-money-laundering reporting requirements.  

[3] This requirement may be satisfied by the subprocessor co-signing the contract entered into between the data exporter and the data importer under this Decision.