Data Processing Addendum

DATA PROCESSING ADDENDUM

This Data Processing Addendum ("​DPA​") amends and supplements the Image Creators Guild Terms of Use (“"Agreement​") entered into between you, the user, together with any company or other business entity you are representing, if any (collectively, "Artist", "​Photographer​", "Videographer"), and Image Creators Guild. ("Image Creators Guild") and is hereby incorporated by reference into the Agreement. All capitalized terms not otherwise defined in this DPA will have the meaning given to them in the Agreement. If there is any inconsistency or conflict between this DPA and the Agreement as it relates to data protection, this DPA will govern. This DPA applies only to the extent Artist, Photographer, Videographer uses the Services or Products to process personal data from residents of the European Economic Area (“​EEA​”) or Switzerland.

1. DEFINITIONS​.
“​Artist, Photographer, Videographer Personal Data”​ means Personal Data originating in the EEA or Switzerland and Processed

by Image Creators Guild on behalf of Artist, Photographer, Videographer in provision of the Services or Products.

“​Data Subject​” means the individual to whom Artist, Photographer, Videographer Personal Data relates.

“​Controller to Processor Standard Clauses​” means the standard clauses for the transfer of Personal Data to Processors established in third countries approved by the European Commission from time to time, the approved version of which in force at present is that set out in the European Commission's Decision 2010/87/EU of 5 February 2010, available at: http://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32010D0087​.

“​Data Protection Legislation​” means as applicable: (a) the GDPR; and/or (b) the Federal Data Protection Act of 19 June 1992 (Switzerland).

“​GDPR​” means the General Data Protection Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, and any amendment or replacement to it.

“​Personal Data​” means any information that relates to a Data Subject, including but not limited to a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the Data Subject.

“​Process​” or “​Processing​” means any operation or set of operations which is performed on Personal Data, whether or not by automated means, such as the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of Artist, Photographer, Videographer Personal Data.

“​Security Breach​” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Artist, Photographer, Videographer Personal Data transmitted, stored or otherwise Processed. The terms “​controller​,” “​data subject​,” “​personal data,​” “​processor​,” and “​supervisory authority​” as used in this DPA will have the meanings ascribed to them in the GDPR.

2. PROCESSING OF DATA.

2.1. Purpose of Processing. The purpose of data Processing under this Agreement is the provision of the Services or Products pursuant to the Agreement.

page1image433110768 page1image433111056

2.2. Processor and Controller Responsibilities. The parties acknowledge and agree that: (a) Image Creators Guild is a processor of Artist, Photographer, Videographer Personal Data under the Data Protection Legislation; (b) Artist, Photographer, Videographer is a controller of Artist, Photographer, Videographer Personal Data under the Data Protection Legislation; and (c) each party will comply with the obligations applicable to it under the Data Protection Legislation with respect to the Processing of Photographer Personal Data.

  1. 2.4.  Artist, Photographer, Videographer Instructions. Artist, Photographer, Videographer instructs Image Creators Guild to Process, Artist, Photographer, Videographer Personal Data: (a) in accordance with the Agreement; and (b) to comply with other reasonable written instructions provided by Artist, Photographer, Videographer where such instructions are consistent with the terms of the Agreement. Artist, Photographer, Videographer will ensure that its instructions for the Processing of Artist, Photographer, Videographer Personal Data shall comply with the Data Protection Legislation. Artist, Photographer, Videographer shall have sole responsibility for the accuracy, quality, and legality of Artist, Photographer, Videographer Personal Data and the means by which Artist, Photographer, Videographer obtained the Artist, Photographer, Videographer Personal Data.

  2. 2.5.  Image Creator Guild’s Compliance With Artist, Photographer, Videographer Instructions. Image Creators Guild shall only Process Artist, Photographer, Videographer Personal Data in accordance with Artist, Photographer, Videographer’s instructions and shall treat Artist, Photographer, Videographer Personal Data as confidential information. Image Creators Guild may Process Artist, Photographer, Videographer Personal Data other than on the written instructions of Artist, Photographer, Videographer if it is required under applicable law to which Image Creators Guild is subject. In this situation, Image Creators Guild shall inform Artist, Photographer, Videographer of such requirement before Image Creators Guild Processes the Artist, Photographer, Videographer Personal Data unless prohibited by applicable law. If Image Creators Guild believes or becomes aware that any of Artist, Photographer, Videographer’s instructions conflict with any Data Protection Legislation, Image Creators Guild shall inform Artist, Photographer, Videographer immediately.

3. SECURITY; PRIVACY IMPACT ASSESSMENTS.

  1. 3.1.  Image Creators Guild Personnel. Image Creators Guild shall ensure that its personnel engaged in the Processing of Artist, Photographer, Videographer Personal Data are informed of the confidential nature of the Artist, Photographer, Videographer Personal Data, and are subject to obligations of confidentiality and such obligations survive the termination of that individual’s engagement with Image Creators Guild.

  2. 3.2.  Security. Image Creators Guild will implement appropriate technical and organizational measures to safeguard Artist, Photographer, Videographer Personal Data taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.

3.3 Data Privacy Impact Assessments. Image Creators Guild will take reasonable measures to cooperate and assist Artist, Photographer, Videographer in conducting a data protection impact assessment and related consultations with any supervisory authority, if Artist, Photographer, Videographer is required to do so under Data Protection Legislation.

4. DATA SUBJECT RIGHTS.

  1. 4.1.  Assistance with Artist, Photographer, Videographer’s Obligations. To the extent Artist, Photographer, Videographer in its use or receipt of the Services or Products, does not have the ability to correct, amend, restrict, block or delete Artist, Photographer, Videographer Personal Data, as required by Data Protection Legislation, Image Creators Guild shall promptly comply with reasonable requests by Artist, Photographer, Videographer to facilitate such actions to the extent Image Creators Guild is legally permitted and able to do so.

  2. 4.2.  Notification Obligations. Image Creators Guild shall, to the extent legally permitted, promptly notify Artist, Photographer, Videographer if it receives a request from a Data Subject for access to, correction, amendment, deletion of or objection to the Processing of Artist, Photographer Videographer Personal Data relating to such individual. Image Creators Guild shall not respond to any such Data Subject request relating to Artist, Photographer, Videographer Personal Data without Artist, Photographer, Videographer’s prior written consent except to confirm that the request relates to Artist, Photographer, Videographer. Image Creators Guild shall provide Artist, Photographer, Videographer with commercially reasonable cooperation and assistance in relation to handling of a Data Subject request, to the extent legally permitted and to the extent Artist, Photographer, Videographer does not have access to such Artist, Photographer, Videographer Personal Data through its use or receipt of the Services or Products.

5. SUBCONTRACTORS.

5.1​. General Authorization. ​Artist, Photographer, Videographer generally authorizes the use of subprocessors to Process Artist, Photographer, Videographer Personal Data in connection with fulfilling Image Creators Guild’s obligations under the Agreement and/ or this DPA.

5.2 New Subprocessors. When Image Creators Guild engages any new subprocessor to process Artist, Photographer, Videographer Personal Data, Image Creators Guild will inform Artist, Photographer, Videographer of the engagement via email to the email address on file for Artist, Photographer, Videographer’s account and give Artist, Photographer, Videographer the opportunity to object to such subprocessor

5.3. Image Creators Guild Obligations. Image Creators Guild will remain liable for the acts and omissions of its subprocessors to the same extent Image Creators Guild would be liable if performing the services of each subprocessor directly under the terms of this DPA. Image Creators Guild will contractually impose data protection obligations on its subprocessors that are at least equivalent to those data protection obligations imposed on Image Creators Guild under this DPA.

6. DATA TRANSFERS.

6.1. Governing Terms. When an Artist, Photographer, Videographer located in a Member State of the EEA or Switzerland transfers or discloses Personal Data to Image Creators Guild, such transfers will be governed by the Controller to Processor Standard Clauses. For purposes of the Controller to Processor Standard Clauses, (i) the Artist, Photographer, Videographer located in the EEA or Switzerland will be referred to as the “Data Exporter” and (ii) Image Creators Guild will be referred to as the “Data Importer.” Annex 1 to this Agreement shall apply as Appendix 1 of the Controller to Processor Standard Clauses.

7. SECURITY BREACH.

  1. 7.1.  Notification Obligations. In the event Image Creators Guild becomes aware of any Security Breach, Image Creators Guild will notify Artist, Photographer, Videographer of the Security Breach without undue delay. The obligations in this Section 7 do not apply to incidents that are caused by Artist, Photographer, Videographer or Artist, Photographer, Videographer's personnel or end users or to unsuccessful attempts or activities that do not compromise the security of Artist, Photographer, Videographer Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.

  2. 7.2.  Manner of Notification. Notification(s) of Security Breaches, if any, will be delivered to one or more of Artist, Photographer, Videographer’s business, technical or administrative contacts by any means Image Creators Guild selects, including via email. It is Artist, Photographer, Videographer’s sole responsibility to ensure it maintains accurate contact information on Image Creators Guild’s support systems at all times.

8. TERM AND TERMINATION.

  1. 8.1.  Term of DPA. This DPA will remain in effect until, and automatically expire upon, deletion of all Artist, Photographer, Videographer Personal Data as described in this DPA.

  2. 8.2.  Deletion of Artist, Photographer, Videographer Data​. Image Creators Guild shall delete or return Artist, Photographer, Videographer Personal Data to Artist, Photographer, Videographer after the end of the provision of Services or Products under the Agreement and shall delete all existing copies thereof, except to the extent that Image Creators Guild is required under Data Protection Legislation to keep a copy of the Artist, Photographer, Videographer Personal Data.

9. COMPLIANCE INFORMATION.

9.1. Information Available. Image Creators Guild will make available all information necessary to demonstrate compliance with the obligations set forth in this Addendum and will contribute to audits as necessary.

10. LIMITATION OF LIABILITY. Image Creators Guild’s liability for breach of its obligations in this DPA are subject to the limitation of liability provision in the Agreement.

ANNEX 1: APPENDIX 1 TO THE CONTROLLER TO PROCESSOR STANDARD CLAUSES Data exporter

The data exporter is: ​The Artist, Photographer, Videographer who has agreed to the Image Creators Guild Terms of Use and uses Image Creators Guild’s Services or Products to collect Personal Data from individuals residing in the EEA or Switzerland.

Data importer

The data importer is: ​Image Creators Guild Data subjects

The personal data transferred concern the following categories of data subjects: ​Individuals who use Artist, Photographer, Videographer’s services or interact with Artist, Photographer, Videographer’s Image Creators Guild-powered website or mobile application.

Categories of data

The personal data transferred concern the following categories of data: ​Names, contact information, payment information, purchase history, location.

Special categories of data (if appropriate)

The personal data transferred concern the following special categories of data: ​None Processing operations

The personal data transferred will be subject to the following basic processing activities: ​Storage, marketing in accordance with the Artist, Photographer, Videographer’s direction, and order processing.