SERVICE AGREEMENT FOR
BRAIN CORPORATION’S SOFTWARE
This Service Agreement (this “Agreement”) is made by and betweenBrain Corporation, a California corporation (“Brain”), and the individual or legal entity licensing the Softwareunder this Agreement (the “Customer”).This Agreement governs the use of Brain’ssoftware (the “Software”) andassociated services (the “Services”)contained on or relating to any BrainOS® powered product (including anyauthorized add-ons or accessories to such products) provided under the “Brain”or “BrainOS” trademark (each, a “Robot”)obtained by the Customer from an authorized manufacturer, reseller, ordistributor (an “Authorized Seller”).Brain’s Authorized Sellers, subcontractors, and affiliates shall be referred tocollectively herein as “Brain Affiliates”.
1. Acceptingthis Agreement
By the Customer (a) using the Software or the Services, (b) clicking a boxindicating acceptance, or (c) executing with Brain or an Authorized Seller asubscription agreement, order document, or other instrument that referencesthis Agreement (a “Service Document”),the Customer agrees to be bound by thisAgreement’s terms and conditions. In addition, byaccepting this Agreement, the Customerrepresents that he or she has the authority to bind the Customer (or its employer or other entity on whose behalf the Customer is agreeing) to the terms and conditions of thisAgreement.
2. Services
During the subscription period specified in the respectiveService Document for the particular Services purchased by the Customer, theCustomer will receive such Services as set forth in Exhibit A attachedhereto (the “Service-Specific Terms”). TheService-Specific Terms shall be considered part of this Agreement andincorporated herein by reference.
3. Use ofthe Software and Services by the Customer
The Customer agrees to be responsible for the operation anduse of the Services by the Customer and its employees, agents, contractors, andany transferee or other entity that the Customer permits to use the Robotand/or Services (its “Permittees”).The Customer agrees to use the Robot, Software, or Services only in accordancewith (collectively, the “Restrictions onUse”): (a) this Agreement; (b) any applicable law, regulation, or generallyaccepted practices or guidelines in the relevant jurisdictions (including anylaws regarding the export of data or software to and from the United States, orsuch other country in which the Customer purchases or uses the Robot); (c) thethen-current user manuals, guides, and instructions provided with the Robot, inthe Software, or by Brain or by an Authorized Seller (the “Instructions”); and (d) the terms provided in the applicableService-Specific Terms.
4. Licensefrom Brain
4.1 LicenseGrant. Subject to theterms of this Agreement, Brain grants the Customer a royalty-free,non-sublicensable, and non-exclusive license, solely during the period when theCustomer has access to the Services as provided in Section 2, solely for theCustomer’s (and its Permittees’) Use of the Software in the country in whichBrain or an Authorized Seller delivered the Robot to the Customer inconjunction with (a) the Robot pre-loaded with the Software that the Customeracquired and (b) the Services. “Use”in this Section 4 shall mean the ability to run or execute the Software througha user interface on the Robot or other interface as provided by Brain inaccordance with the Restrictions on Use.
4.2 Reservationof Rights. All rights not specifically grantedunder this Agreement are reserved by Brain and, as applicable, Brain’slicensors. The Software is licensed,not sold. The Customer is permitted to Use the Software only in accordance withthe terms of, and only as expressly allowed by, this Agreement. The Customerlicense confers no title or ownership in the Software and should not beconstrued as a sale of any rights in the Software. This Agreement also appliesto any patches or updates the Customer may obtain for the Software, and to theSoftware on any Robot that is Used by the Customer.
4.3 IntellectualProperty. The Customer agrees that Brain, itsaffiliates, and its licensors own all legal right, title and interest in and tothe Software (including any patches and updates to the Software and allcopies), including any Intellectual Property Rights that subsist in theSoftware. “Intellectual Property Rights”means any and all rights under patent law, copyright law, moral rights, tradesecret law, trademark law, and all other proprietary rights. Brain reserves allrights not expressly granted to the Customer. Brain’s Software is protected bythe copyright laws of the United States, international copyright treaties andconventions, and other laws of the country in which the Customer purchases orUses the Robot. The Customer may not: (a) copy, modify, adapt, redistribute,decompile, reverse engineer, disassemble, or create derivative works of theSoftware or any part of the Software; (b) sell, rent, lease, license,distribute or otherwise transfer, commercialize, or offer or provide a servicewith any software or device (other than the Robot as provided to the Customer)incorporating the Software or any part of the Software; or (c) infringe theSoftware in any other manner pursuant to the copyright laws of the UnitedStates, international copyright treatises and conventions, EU copyrightdirectives, and/or any other laws of the country in which the Customerpurchases or Uses the Robot.
4.4 ProprietaryNotices. The Customeragrees not to remove, obscure, or alter any proprietary rights notices(including patent, copyright, and trademark notices) that may be affixed to orcontained within the Software or the Robot. Nothing in this Agreement gives theCustomer any right to any of Brain’s trade names, trademarks, service marks,logos, domain names, or parts thereof, or other distinctive brand features.
5. Privacy andInformation
5.1 To continually innovate, update, and improve their products, and provideproducts or services to the End User, Brain may, itself or through BrainAffiliates, collect data (which, for clarity, may include Personal Data (asdefined below)) from the Software or Robot (“Robot Data”), including as provided in this Agreement, Brain’sPrivacy Policy (described at https://www.braincorp.com/legal/privacy-policy)and/or the Data Protection Addendum related hereto (attached hereto as ExhibitB), as updated from time to time (collectively the “Privacy Policies”). The End User may be subject to, or have,additional limitations, consents, responsibilities, or rights related toBrain’s and/or Brain Affiliates’, collection, processing, maintenance, use, ortransfer of Robot Data or other information under or relating to thisAgreement. The End User retains all ownership or other rights over all RobotData subject to the rights and permissions granted to Brain herein. The EndUser hereby irrevocably grants to Brain a non-exclusive, worldwide, perpetual,paid-up, right and license, including the right to grant and authorizesublicenses through multiple levels, to access, use, process, transfer, store,manipulate, modify, compile with other data or works and/or create derivativeworks of the Robot Data as are necessary or useful to Brain to: (1) enforcethis Agreement; (2) exercise their rights or perform obligations hereunder; (3)provide, improve or develop their services, products and offerings (includingnew services, products and offerings); and (4) for all other legitimatebusiness purposes. The End User has sole responsibility for obtaining allconsents, authorizations, and permission (including providing notices to usersor third parties) and satisfying all requirements necessary to permit use ofRobot Data by Brain and Brain Affiliates. Unless agreed in writing, Brain andBrain Affiliates have no obligations to archive Robot Data for future use andmay delete it in their discretion. The End User consents to any transfer ofRobot Data outside of its country of origin, except that Personal Data (asdefined below) is subject to the Privacy Policies.
5.2 Brain owns all right, title, and interest, including all IntellectualProperty Rights, that are: (i) developed or created by it or Brain Affiliatesby processing or analysis of Robot Data; (ii) generated or identified throughsupport, monitoring or other observation of End User’s use of the Robot orServices; or (iii) End User’s or Permittees’ suggestions, comments or feedbackregarding the Software and/or any related data. The operation and performanceof the Robot, Software, and Services is Brain’s confidential information. Ifthe End User provides suggestions, comments or feedback regarding the Robot orSoftware, Brain owns all such information, and the End User hereby assigns toBrain all right, title and interest in and to the same without restriction. Theclauses in this Section 5.2 describe the rights as between Brain and the EndUser, and the End User acknowledges that these rights may be divided betweenBrain and Brain Affiliates, in Brain’s discretion.
5.3 To provide certain features of the Services, Brain and Brain Affiliateswill collect, use, process, transfer, store, and maintain Robot Data, includingcertain diagnostic, use, and operational data relating to the applicable Robot,together with information from the End User’s customer account, includinginformation relating to model numbers, serial numbers, account identifiers,service and maintenance history, and any Personal Data (as defined below) thatmay be necessary or useful to provide the Services, fulfill the purposes ofthis Agreement or any other agreements that Brain has with the End User, orimprove or develop services, products or offerings or for any other legitimatebusiness purpose. The type and amount of Robot Data collected by the Softwarewill vary by Robot type and may change at any time without notice. The End Userhereby agrees to Brain’s and Brain Affiliates’ collection, use, processing,transfer, storage and maintenance of such Robot Data and the other rights withrespect to Robot Data granted in this Agreement.
5.4 Brain and BrainAffiliates may process certain data and information about the End User,Permittees, users of the Services, and the End User’s employees, customers,suppliers or affiliates that are recognized under applicable law as “personaldata, “personally identifiable information” or similar terms (“Personal Data”) in connection with thisAgreement. For avoidance of doubt, End User shall be the “controller” or“business”, Brain shall be the “processor” or “service provider” (as such termsare defined under applicable data protection laws) with respect to any PersonalData.
6. Terminatingthis Agreement
This Agreement will continue to apply until terminated byeither the Customer or Brain as set out below:
6.1 Terminationby Customer. In the event that Brain has breachedany provision of this Agreement and failed to cure such breach within 30 days’notice of such breach from the Customer, the Customer may terminate thisAgreement by ceasing completely the use of the Software and the Services. TheCustomer may be required to separately terminate the Services under terms andconditions provided in the Customer’s respective Service Document executed with Brain or an Authorized Seller.
6.2 Terminationby Brain. To the extent permitted under anyapplicable law, regulation, or directive, Brain may, at any time, immediatelyterminate this Agreement with the Customer if: (a) the Customer has breachedany provision of this Agreement and failed to cure such breach within 30 days’notice of such breach from Brain; or (b) Brain is required to do so by law.Notwithstanding the foregoing, in the event the Customer makes any use of theSoftware, Services, or Services not expressly permitted by this Agreement, theCustomer’s license rights under this Agreement shall immediately andautomatically be suspended, including the provision of Services. When thisAgreement comes to an end, all legal rights, obligations, and liabilities thatthe Customer and Brain have benefited from, been subject to (or which haveaccrued over time while this Agreement has been in force) or which areexpressed to continue indefinitely, shall not be affected and the provisions ofSection 10.4 shall continue to apply to such rights, obligations, and liabilitiesindefinitely.
7. Warranties
Brain represents and warrants that the Software will: (a)materially conform to the Robot’s then-current user manuals; and (b) provideServices as described in the Service’s applicable Service-Specific Terms asreasonably verifiable by Brain for each Robot, subject to the Restrictions onUse, during the subscription term of such Services. Upon the Customer providingwritten notice of Brain’s breach of the preceding warranties and Brain’sfailing to cure such breach within 30 days of receipt of such notice, theCustomer’s sole remedy for breach of this Section 7 for any Robot shall betermination of the Services for that Robot and a pro-rated refund of the feespaid by the Customer for the remaining time of the Customer’s Servicessubscription for such Robot. Except as expressly provided in this Section 7, tothe fullest extent permitted under any applicable law, regulation, ordirective, Brain expressly disclaims all warranties and conditions of any kind,whether express or implied, including, but not limited to the impliedwarranties and conditions of merchantability and fitness for a particularpurpose.
8. Limitationof Liability
THE CUSTOMER EXPRESSLY UNDERSTANDS AND AGREES THAT BRAIN,ITS SUBSIDIARIES AND AFFILIATES, AND ITS LICENSORS SHALL NOT BE LIABLE TO THECUSTOMER UNDER ANY THEORY OF LIABILITY FOR ANY INDIRECT, INCIDENTAL, SPECIAL,CONSEQUENTIAL, OR EXEMPLARY DAMAGES ARISING UNDER THIS AGREEMENT THAT MAY HAVEBEEN INCURRED BY THE CUSTOMER, WHETHER OR NOT BRAIN OR ITS REPRESENTATIVES HAVEBEEN ADVISED OF OR SHOULD HAVE BEEN AWARE OF THE POSSIBILITY OF ANY SUCH LOSSESARISING. IN NO EVENT WILL THE LIABILITY OF BRAIN UNDER THIS AGREEMENT EXCEEDTHE AMOUNT ACTUALLY PAID BY THE CUSTOMER (OR WITH RESPECT TO CLAIMS FOR FEESDUE, PAYABLE) FOR THE ROBOT’S SERVICES DURING THE THEN-CURRENT APPLICABLESUBSCRIPTION PERIOD IN THE SERVICE DOCUMENT GIVING RISE TO THE CLAIMS. SUCHEXCLUSION OF LIABILITY SHALL NOT APPLY TO ANY INJURY OF LIFE OR BODY, ARISINGFROM ANY GROSSLY NEGLIGENT OR INTENTIONAL CONDUCT OF BRAIN, OR TO OTHERMANDATORY STATUTORY LIABILITY OR RESPONSIBILITY PURSUANT TO THE APPLICABLE LAW,REGULATION, OR DIRECTIVE IN THE JURISDICTION IN WHICH THE CUSTOMER PURCHASEDTHE ROBOT.
9. Changes to this Agreement
Brain reserves the right, at any time and from time to time,to update, revise, supplement, and otherwise modify this Agreement and toimpose new or additional rules, policies, terms, or conditions as required forsafety, for compliance with laws or government regulations, and/or that do notmaterially impact the Customer’s use of the Robot (collectively referred to inthis Agreement as “Additional Terms”)on the Customer’s use of the Software and Services. The Additional Terms willbe effective immediately and be considered incorporated into this Agreement.The Customer’s continued use of the Software or Services following notice, atthe mailing address or email address provided to Brain, of any Additional Termswill be deemed to constitute the Customer’s acceptance of all such AdditionalTerms.
10. General Terms
10.1 Agreement Documents. Any terms (other than those explicitly recognized in thisAgreement) with respect to the Software or Services in a Service Document,purchase order, vendor agreement, extended service agreement, or any otherinstrument are void unless agreed upon in writing by Brain, and the terms andconditions of this Agreement shall control in the event of a conflict with anysuch instrument to the extent not expressly overwritten. This Agreement and anyother instrument that references this Agreement that is signed by the Customerand Brain (together the Agreement and other instrument, the “Agreement Documents”) constitutes thewhole legal agreement between the Customer and Brain and governs the Customer’suse of the Software or Services (excluding any services which Brain may provideto the Customer under a separate written agreement), and completely replacesany prior agreements between the Customer and Brain in relation to the Softwareand Services. The Customer agrees that if Brain does not exercise or enforceany legal right or remedy which is contained in the Agreement Documents (orwhich Brain has the benefit of under any applicable law), this will not betaken to be a formal waiver of Brain’s rights and that those rights or remedieswill still be available to Brain. If any court of law, having the jurisdictionto decide on this matter, rules that any provision of the Agreement Documentsis invalid, then that provision will be removed from this Agreement withoutaffecting the rest of the Agreement Documents. The remaining provisions of theAgreement Documents will continue to be valid and enforceable. This Agreement shall serve as the “Autonomous NavigationSoftware Customer License Agreement” or “EULA”as may be referenced by the Robot’s user Instructions and other documents byBrain or any Authorized Seller. The Customer may also be referred to asthe “End User.”
10.2 Export Control. The Software is subject to UnitedStates Export Laws. The Customer agrees to comply with all applicable domesticand international export and re-export restrictions and regulations, includingthose of the jurisdiction where the Robot was delivered, and not to transfer,or authorize the transfer, of the Software or Services to a prohibited countryor otherwise in violation of any such restrictions or regulations.
10.3 Assignment. The rights granted in the Agreement Documents may not be assignedor transferred by the Customer without the prior written approval of Brain. TheCustomer shall not be permitted to delegate the Customer’s responsibilities orobligations under the Agreement Documents to any third party without Brain’sprior written approval.
10.4 Arbitration. The Agreement Documents shall be governed by the laws of the Stateof California without regard to its conflict of laws provisions. Anycontroversy or claim arising out of or relating to this contract, or the breachthereof, shall be settled by arbitration administered by the AmericanArbitration Association in accordance with its Commercial Arbitration Rules.Any judgment on the award rendered by the arbitrator(s) may be entered in anycourt having jurisdiction. Claims shall be heard by a single arbitrator, unlessthe claim amount exceeds $500,000, in which case the dispute shall be heard bya panel of three arbitrators. The place of arbitration shall be San Diego,California. The arbitration shall be governed by the laws of the State of California.Hearings will take place pursuant to the standard procedures of the CommercialArbitration Rules that contemplate in person hearings. The standard provisionsof the Commercial Rules shall apply. Arbitrators will have the authority to allocate the costs of thearbitration process among the parties but will only have the authority toallocate attorneys' fees if a particular law permits them to do so. Except asmay be required by law, neither a party nor an arbitrator may disclose theexistence, content, or results of any arbitration without the prior writtenconsent of both parties. The parties agree that failure or refusal of a partyto pay its required share of the deposits for arbitrator compensation oradministrative charges shall constitute a waiver by that party to presentevidence or cross-examine witness. In such event, the other party shall berequired to present evidence and legal argument as the arbitrator(s) mayrequire for the making of an award. Such waiver shall not allow for a default judgmentagainst the non-paying party in the absence of evidence presented as providedfor above. Notwithstanding the foregoing, the Customer agrees that Brain shallstill be allowed to apply for injunctive remedies (or an equivalent type ofurgent legal relief) in any jurisdiction.
11. Contact Us
For any questions,comments, or concerns about this Agreement, or for any notices to Brain, pleasecontact Brain by postal mail or email at:
Brain Corporation
Attn: EULA
10182 Telesis Court,Suite 100
San Diego, CA 92121
eula@braincorp.com
EXHIBIT A
Service-Specific Terms for
BrainOS Sense Suite
These Service-Specific Terms for BrainOS Sense Suite supplements and isincorporated into the Service Agreement between Brain and the Customer (the “Service Agreement”), and applies to theCustomer’s use of BrainOS Sense Suite (as defined below) associated with aRobot. All capitalized terms used herein and not otherwise defined herein shallhave the respective meanings given to them in the Service Agreement, which theCustomer acknowledges remains in full force and effect.
1. BrainOS Sense Suite
“BrainOS Sense Suite” is Brain’ssubscription service used in conjunction with a Dane AIR Scanner (the “Dane AIR”), which is a scanning Robotmanufactured by Dane Technologies, Inc. (“Dane”)that is configured to work with the BrainOS Sense Suite. Dane AIRs must bepurchased separately and the terms and conditions of the hardware purchase andsupport are outside the scope of the Service Agreement and theseService-Specific Terms. The BrainOS Sense Suite features that will be part ofCustomer’s subscription will be described in the Agreement Documents.
2. Use of the Software and BrainOSSense Suite by the Customer
The Customer must comply with the additional Restrictions onUse established below that apply to BrainOS Sense Suite:
2.1 Approved Uses. BrainOS Sense Suiteis designed to image and analyze inventory, and the Customer and its Permitteesshall only use BrainOS Sense Suite for this purpose. The Customer and itsPermittees shall use the BrainOS Sense Suite only in accordance with theInstructions.
2.2 ConductRestrictions. The Customer, as well as its Permittees,shall not engage in any of the following conduct or activities: (a) operatingBrainOS Sense Suite in any manner that constitutes a prohibited use under theInstructions; (b) intentionally tampering with, modifying, or damaging theRobot or any hardware or sensors containing or associated with the Software orBrainOS Sense Suite; (c) installing or modifying, or attempting to install ormodify, any software other than the Software on the Robot (except solely asotherwise permitted pursuant to any open source licenses, if any, provided tothe Customer by Brain, in connection with the Software licensed hereunder); (d)installing or attempting to install the Software on any hardware or deviceother than the Robot; or (e) attempting to deliberately damage or undermine thelegitimate operation of BrainOS Sense Suite or the Software. The Robot,Software, and BrainOS Sense Suite are not designed or intended for use inenvironments where any failure of the Robot, Software, and BrainOS Sense Suitewould reasonably likely lead directly to death, personal injury, or severephysical or property damage.
3. Service Levels
3.1 System Availability. Each Robot with an active subscription to BrainOS SenseSuite connects to Brain’s cloud instance for Support Services (the “Cloud”). With respect to the Cloud,Brain will provide 99% System Availability calculated on a per Robot basis overperiods comprising each calendar month. The following definitions will applywith respect to System Availability:
3.1.1 “Downtime” means the time (inminutes) following written notice by the Customer that the Cloud is notoperational for connection to a Robot for BrainOS Sense Suite, as reasonablyverifiable by Brain, while the Customer has an active subscription to BrainOSSense Suite for that Robot. Downtime does not include unavailability of theCloud relating to: (a) any Force Majeure Event or System Maintenance; (b) anymodifications to the Robot, Software, BrainOS Sense Suite or Services that areunauthorized by Brain; (c) abuses or other behaviors that interfere with thelegitimate operation of the Cloud; (d) usage that is inconsistent with theInstructions or in violation of the terms of the Service Agreement; or (e)failure of the Customer or its Permittees to provide information or performactions in a timely manner as prompted by the Software of the Robot or Brain.
3.1.2 “Force Majeure Event” means any failure or delay caused by or theresult of causes beyond the reasonable control of a party and could not havebeen avoided or corrected through the exercise of reasonable diligence,including, but not limited to, acts of God, fire, flood, hurricane or othernatural catastrophe, terrorist actions, laws, orders, regulations, directionsor actions of governmental authorities having jurisdiction over the subjectmatter hereof, or any civil or military authority, national emergency,insurrection, riot or war, or other similar occurrence.
3.1.3 “System Availability” shall meanthe percentage, for each Robot and expressed to one decimal point, resultingfrom the following calculation: [1-(Downtime/Total Time)] x 100.
3.1.4 “System Maintenance” means time(in minutes) that the Cloud is not accessible for connection to a Robot due tomaintenance, including for maintenance and upgrading of the software andhardware used by Brain to provide the Support Services. System Maintenanceincludes scheduled maintenance and unscheduled, emergency maintenance. In theevent Downtime is anticipated, Brain will provide the Customer with at least 72hours’ advance written notice of any scheduled maintenance or 60 minutes’advance written notice for unscheduled, emergency maintenance.
3.1.5 “Total Time” means the totalnumber of minutes in a calendar month, excluding any Force Majeure Event(s) orSystem Maintenance, in which the Customer has an active subscription toAutonomy Services for a Robot.
3.2 WiFi Connection. During operation, if access to a Wi-Fi network meeting therequirements described in the Instructions is not available for a Robot, Brainmay not be able to provide that Robot the applicable Services associated withBrainOS Sense Suite. For this reason, Brain is not responsible for anyinability of a Robot to connect to a Wi-Fi network, and any calculation ofDowntime expressly excludes any inability of a Robot to access an otherwiseoperational Cloud due to lack of Wi-Fi network connectivity.
3.3 Credits. If the SystemAvailability for a Robot during any given month falls below 99%, Brain willprovide the Customer with a credit to its future invoices for the BrainOS SenseSuite of that Robot (a “Service Credit”)as set forth in the chart below:
In order to receive a Service Credit, the Customer mustnotify Brain in writing, providing with specificity the circumstances givingrise to the Customer’s request, within 30 days from the time the Customerbecomes eligible to receive the Service Credit. If the Customer does not complywith the requirements of this paragraph, the Customer shall forfeit its rightto receive a Service Credit.
EXHIBIT B
Brain Corporation
EULA Data Protection Addendum
This EULA Data Protection Addendum (the “Addendum”) is incorporated into and subject to the terms andconditions of the End User License Agreement between you (the “End User”) and Brain Corporation(“Brain”) (the “EULA”; together the EULA and theAddendum shall be referred to herein as the “Agreement”).
1. Defined Terms. Capitalized terms used in this Addendum that are not otherwise definedherein will have the same meaning ascribed to them as set forth in the EULA.
“Affiliate” means any entity that directly or indirectly Controls, is controlled by,or is under common Control with the subject entity. “Control,” for purposes ofthis definition, means direct or indirect ownership or control of more than 50%of the voting interests of the subject entity.
“BrainOS-enabledRobots” means any robot containing theSoftware and provided under an active subscription under the EULA.
“End User Personal Data” meansthe Personal Data provided to Brain by the End User employees, contractors, orother designated agents when utilizing Software of BrainOS-enabled Robots.
“Controller” means the entity which determines the purposes and means of the Processingof Personal Data.
“Data Laws” means data protection and privacy laws and regulations applicable to theprocessing of Personal Data in any relevant jurisdiction.
“Data Subject” means the identified or identifiable person to whom End User Personal Datarelates.
“EEA” means the European Economic Area.
“European Data Laws” means allapplicable data protection and privacy laws and regulations in Europeanjurisdictions, including, for EEA territories, the General Data ProtectionRegulation (EU) 2016/679 and any successor legislation and associated nationalimplementations thereto (the “GDPR”) and, for the United Kingdom, the UnitedKingdom Data Protection Act 2018.
“Non-European Data Laws” meansall applicable data protection and privacy laws and regulations outside ofEuropean jurisdictions as described in Appendix IV.
“Personal Data” means personaldata under applicable Data Laws.
“Process, Processed,and Processing” means any operation or set ofoperations which is performed on End User Personal Data or on sets of End UserPersonal Data, whether or not by automated means, such as collection,recording, organization, structuring, storage, adaptation or alteration, retrieval,consultation, use, disclosure by transmission, dissemination or otherwisemaking available, alignment or combination, restriction, erasure, ordestruction.
“Security Incident” means, inconnection with the Services: (i) the loss or misuse (by any means) of End UserPersonal Data; (ii) the inadvertent, unauthorized, and/or unlawful disclosure,Processing, alteration, corruption, sale, rental, or destruction of End UserPersonal Data or other breach with respect to End User Personal Data; (iii) anycompromise or exploit of a vulnerability of End User Personal Data within theServices; or (iv) any confirmed exposure or exploit of a vulnerability of theEnd User Personal Data (which may stem from an act or omission to act) thatwould result in any of the events described in this clause (1.k.i) or(1.k.iii).
“Services” means services provided by Brain to the End User pursuant to the EULA.
“Standard ContractualClauses” or “SCC” means the agreementexecuted by and between the End User and Brain, and attached hereto as AppendixV, pursuant to the European Commission’s implementing decision (EU) 2021/914 of4 June 2021 on Standard Contractual Clauses for the transfer of personal datato processors established in third countries which do not ensure an adequatelevel of data protection pursuant to Regulation (EU) 2016/679 of the EuropeanParliament and of the Council.
“Sub-processor” means any third party that Brain engages in accordance with Appendix IIIof this Addendum in order to perform the Processing.
“Term” means the duration of the active subscription under the EULA.
2. Processing of Data.
a. Roles ofthe Parties. The Partiesacknowledge that with regard to the Processing of End User Personal Data inaccordance with the Services, the End User is the Controller and Brain is theprocessor.
b. Brain’sProcessing of Personal Data. Brain andits Affiliates shall process End User Personal Data in accordance with the EndUser’s documented written instructions. Brain and the End User agree that Brainand its Affiliates shall process End User Personal Data for the purposes,duration and other details set forth in Appendix I.
c. End UserCompliance Obligations. Withoutlimiting the generality of this Section 2, (Processing of Data) the End Userwarrants that:
i. the EndUser shall have sole responsibility for the accuracy, quality, and legality ofEnd User Personal Data and the means by which the End User acquired End UserPersonal Data;
ii. the EndUser specifically acknowledges that its use of the Services will not violatethe rights of any data subject that has opted-out from sales or otherdisclosures of End User Personal Data, to the extent applicable under DataLaws; and
iii. the EndUser has taken and further undertakes that throughout the Term it shall takeall necessary steps (having regard to the nature of the circumstances in whichEnd User Personal Data will be collected) to provide affected Data Subjectswith an accurate, comprehensible, concise, conspicuous and easily accessibledescription of all processing of End User Personal Data carried out under andin connection with the Addendum, which are sufficient to meet the standards andrequirements of Article 13/14 of the GDPR.
3. Data Security.
a. Brain’sSecurity Measures. Takinginto account the state of the art, the costs off implementation and the nature,scope, context and purposes of processing (as set forth in Appendix I) as wellas the risk of varying likelihood and severity for the rights and freedoms ofnatural persons, Brain has implemented and maintains technical andorganizational measures designed to protect End User Personal Data againstaccidental or unlawful destruction, loss, alteration, unauthorized disclosureor access, to End User Personal Data as further described in Appendix II. Brain may update or modify its securityprogram from time to time, provided that such updates and modifications do notmaterially decrease the overall security of the End User Personal Data.
b. SecurityCompliance by Brain Staff. Brainwill grant access to End User Personal Data only to employees, contractors, andSub-processors who need such access for the scope of their performance and aresubject to appropriate confidentiality arrangements.
c. Brain’sSecurity Assistance. Takinginto account the nature of the processing of End User Personal Data and theinformation available to Brain, Brain will provide the End User with reasonableassistance necessary for the End User to comply with its obligations in respectof End User Personal Data under European Data Protection Legislation, includingArticles 32 to 34 (inclusive) of the GDPR, by:
i. ensuringBrain’s Sub-processors are implementing and maintaining the security measuresin accordance with Section 3(a) (Security Measures);
ii. complyingwith the terms of Section 4 (Security Incidents); and
iii. providingthe End User with the materials in accordance with Section 5 (Audit) and theAgreement, including this Addendum.
4. SecurityIncidents.
a. Brain’s Obligations. Brain shall notify the End User by email and/or phone of anyactual Security Incident without undue delay after Brain becoming aware. Brainshall take reasonable steps to investigate the cause of such Security Incident,minimize harm to the End User, and prevent a recurrence of such SecurityIncident. Brain will investigate any such Security Incident and take necessarysteps to eliminate or contain the exposures that led to such Security Incidentin accordance with Brain’s security program and applicable law. The Partiesagree to coordinate in good faith on developing the content of any relatedpublic statements or any required notices for the affected Data Subjects and/ornotices to the relevant data protection authorities.
b. EndUser’s Obligations. Otherthan agreeing on the content of related public statements or required notices,the End User is solely responsible for complying with incident notificationlaws applicable to the End User and fulfilling any third-party notificationobligations related to any Security Incident(s). Brain’s notification of orresponse to a Security Incident will not be construed as an acknowledgement byBrain of any fault or liability with respect to the Security Incident.
The End User agrees that, without prejudice to Brain’s obligations underSection 4, (Security Incidents) the End User is solely responsible for its useof the Services, including:
i. makingappropriate use of the Services to ensure a level of security appropriate tothe risk in respect of the End User Personal Data;
ii. securingthe account authentication credentials, systems, and devices the End User usesto access the Services;
iii. securingthe End User’s systems and devices that Brain uses to provide the Services; and
iv. backingup End User Personal Data.
5. Audits. Brain evaluates, tests, and monitors the effectiveness ofthe Brain security program and adjusts and/or updates the Brain securityprogram as reasonably warranted by the results of such evaluation, testing, andmonitoring. Brain, from time to time, may conduct an assessment of theimplementation and maintenance of Brain’s End User Personal Data protectionprogram and its related compliance with Data Laws (“Audit Report”). Upon the End User’s reasonable request,Brain shall provide its then-current Audit Report; provided, however, that theEnd User agrees that any such Audit Report is the Confidential Information ofBrain.
6. Legally Required Disclosures. Brain may disclose End User Personal Data and any otherinformation about the End User to government or law enforcement officials orprivate parties if, in Brain’s reasonable discretion, Brain believes it isnecessary or appropriate in order to respond to legal requests, demands, andorders, including subpoena, judicial, administrative, or arbitral order of anexecutive or administrative agency, regulatory agency, or other governmentalauthority, to protect the safety, property, or rights of Brain or of any thirdparty, to prevent or stop any illegal, unethical, or legally actionableactivity, or to comply with applicable law. Except as otherwise required byapplicable law, Brain will notify the End User of any legal requests, demands,and orders that Brain receives, and that relate to the processing of End UserPersonal Data.
7. Data Subject Rights.
a. EndUser’s Responsibility for Requests. If Brain receives a request from a data subject in relationto End User Personal Data, Brain will advise the data subject to submit itsrequest to the End User and the End User will be responsible for responding toany such request.
b. Brain’sData Subject Request Assistance. Taking into account the nature of the processing of End UserPersonal Data, Brain will require its Sub-processors to provide the End Userwith reasonable assistance as necessary for the End User to fulfill its obligation under applicable law torespond to requests by data subjects, including if applicable, the End User’sobligation to respond to requests for exercising a data subject’s rights setout in in Chapter III of the GDPR. The End User shall reimburse Brain for anysuch assistance beyond providing self-service features included as part of theServices at Brain’s then-current professional services rates, which shall bemade available to the End User upon request.
8. Data Transfers Out of the EEA. If the storage and/or processing of End User Personal Dataoccurs within the EEA, involves transfers of End User Personal Data out of theEEA or Switzerland, and the European Data Protection Legislation applies to thetransfers of such data, Brain and its Sub-processors will make such transfersin accordance with the SCCs, and make information available to the End Userabout such transfers upon request.
9. Sub-processors. The End User acknowledges and agrees that Brain may engageSub-processors to process End User Personal Data on the End User’s behalf. Alist of approved Sub-processors is set forth in Appendix III. The End Useragrees that all such approved Sub-processors are permitted to Process End UserPersonal Data for the nature and purposes set forth herein. Brain will maintaina list of Sub-processors as described in Appendix III. Brain will update itswebsite to reflect new Sub-processors within ten (10) calendar days prior to aSub-processor beginning to process End User Personal Data. The End User shallhave ten (10) calendar days to reasonably object to the addition of any newSub-processor.
10. Record Retention and Destruction. Brain shall maintain records related to its Processingactivities performed on behalf of the End User relating to End User PersonalData for at least the Term. Upon termination of this Agreement, Brain shalldelete any End User Personal Data in its possession, provided, however, thatBrain may retain a copy of any such End User Personal Data to the extentrequired by applicable law.
11. Notices. Notices required or permitted to be given to the End Userhereunder may be provided to the End User’s primary point of contact withBrain. Notices required or permitted to be given to Brain hereunder may beprovided by sending an email to privacy@braincorp.com. The End User is solelyresponsible for ensuring that such email address is valid.
12. Jurisdiction Specific Terms. To the extent Brain Processes End User Personal Dataoriginating from and protected by Non-European Data Laws, then the termsspecified in Appendix IV with respect to those applicable jurisdictions furtherapply in addition to the terms set forth herein. In the event of any conflictbetween such jurisdiction-specific terms and this Addendum, suchjurisdiction-specific terms shall control.
Effect of These Terms. Except as otherwise set forthherein, the terms and conditions of this Addendum, including the Appendices,are part of and incorporated into the Agreement, and the terms and conditionsof this Addendum constitute the entire and exclusive agreement between theParties with respect to its subject matter. To the extent of any conflict orinconsistency between this Addendum and the terms of the EULA, this Addendumwill govern.
Appendix II – Security Measures
Brain safeguards include appropriate technical, physical, andorganizational measures, standards, requirements, specifications, orobligations designed to ensure a level of security appropriate to the riskspresented by the Processing and the nature of the Personal Data to beprotected, taking into account the state of the art; costs of implementation;the nature, scope, context, and purposes of Processing; and the risk of varyinglikelihood and severity for the rights and freedoms of natural persons. Furthertechnical and organizational security measures implemented by the data importerare as described in the Addendum.
Appendix III – Approved Sub-processors
The End User may findthe list of approved Brain Sub-processors available at: https://www.braincorp.com/brain-corp-data-sub-processors/.
AppendixIV – Jurisdiction Specific Terms
California:
(1) The following additional terms applyrelated to the Processing of Personal Data of California residents:
- Each of the Parties will comply with the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”) (collectively, “California Privacy Law”)
- To the extent that Brain receives any End User Personal Data (for purposes of this Appendix, Personal Data as defined under California Privacy Law) of any “consumer” (as defined under California Privacy Law) for processing (as defined under California Privacy Law) on behalf of the End User pursuant to the Agreement, Brain shall:
i. be a “Service Provider” to the End User under the CaliforniaPrivacy Law;
ii. not retain, use or disclose the Personal Data for anypurpose other than for the specific purpose of the Services or as otherwisepermitted by the California Privacy Law, including for any “business purpose”(as defined under California Privacy Law);
iii. confirm that any authorized subcontractor or third party towhom Service Provider discloses or provides access to Brain Personal Data issubject to these same obligations;
iv. not retain, use or disclose the Personal Data for a“commercial purpose” (as defined under California Privacy Law) other thanproviding the Services;
v. not process any of the Personal Data for its own or for anyother third party's purpose. For the avoidance of doubt, Service Provider shallnot “sell” or “share” Personal Data, as those terms are defined by CaliforniaPrivacy Law. Service Provider will not take any action that would cause theService Provider to cease being a “service provider,” as defined under theCalifornia Privacy Law, with respect to Personal Data and certifies that itunderstands the restrictions under the Applicable Agreements and applicableprivacy legislation. Any obligations required of a service provider in order tomeet and maintain service provider status under the California Privacy Law, orother applicable privacy legislation, now or hereafter existing are deemedincorporated by reference as express obligations of the Service Providerhereunder;
vi. after the completion of Services, Service Provider shall, atyour direction, delete all Personal Data processed on your behalf and certifythat it has done so, or return to you all Personal Data processed on its behalfand delete existing copies;
vii. cooperate with and assist you in addressing its ownCalifornia Privacy Law compliance, as stipulated by the Applicable Agreements,including but not limited to by providing requested Personal Data in responseto consumer requests as well as correcting or deleting Personal Data orlimiting the use of sensitive Personal Data, as defined by California PrivacyLaw, in response to such requests;
viii. grant yourights to take reasonable and appropriate steps, including reasonableassessments, to help ensure that the Service Provider is using the PersonalData transferred in a manner consistent with Brain’s obligations underCalifornia Privacy Law. Service Provider must immediately notify you if itmakes a determination that it can no longer comply with the requirements ofCalifornia Privacy Law;
ix. comply with, and provide the same level of privacyprotection as is required by California Privacy Laws, to the extent applicableto Service Provider’s processing of your Personal Data. Further, ServiceProvider will also impose California Privacy Law requirements, to the extentapplicable, on all subcontractors processing Personal Data; and
x. promptly (and, in any case within seven days of receipt)comply with the End User’s written instructions associated with responding toan individual’s request to exercise their privacy rights with respect to theirPersonal Data.
(2) If Brain authorizes any subcontractor, Service Provider or third partyto Process Personal Data of the End User, Brain shall enter into contractualprovisions so that such subcontractor, service provider or third party is a“service provider” as defined in the CCPA and not a “third party” as definedunder California Privacy Law.
Canada:
(1) Thefollowing additional terms apply related to the Processing of Personal Data ofCanadian residents:
a. To the extent any Sub-processor processes End User PersonalData associated with Canadian residents, such Sub-processor is a third partyunder the Personal Data Protection and Electronic Documents Act, with whomBrain has entered into a written contract with substantially similarprotections as set forth in this Addendum. Further, Brain conducts appropriatedue diligence on any such Sub-processor.
Appendix V StandardContractual Clauses
STANDARDCONTRACTUAL CLAUSES
Having regard to theEuropean Commission’s implementing decision (EU) 2021/914 of 4 June 2021 onStandard Contractual Clauses for the transfer of personal data to processorsestablished in third countries which do not ensure an adequate level of dataprotection pursuant to Regulation (EU) 2016/679 of the European Parliament andof the Council
End User (as defined in the EULA)
The data exportingorganization identified in the table above (the “data exporter”)
- And –
Brain Corporation
(the “data importer”)
each a “party”;together “the parties”,
HAVE AGREED on the Contractual Clauses for the transfer of personal data to thirdcountries from a data controller in the European Economic Area to a dataprocessor in the United States pursuant to the European Commission implementingdecision of 4 June 2021 on Standard Contractual Clauses for the transfer ofPersonal Data to Processors established in third countries under Regulation(EU) 2016/679 of the European Parliament and of the Council (the Clauses) inorder to adduce adequate safeguards with respect to the protection of privacyand fundamental rights and freedoms of individuals for the transfer by the dataexporter to the data importer of the personal data specified in Appendix 1.
The Clauses are attached hereto by reference with the options and optionalmodules selected as follows:
● All Sections: Module TWO
● Section II, Clause 9(a): OPTION 2, general writtenauthorization for sub-processing.
● Section II, Clause 11(a): OPTION NOT INCLUDED
● Section IV, Clause 17: OPTION 1, the location of the dataexporter.
● Section IV, Clause 18: the jurisdiction associated with thedata exporter.
Annex I, II, III, and IV are attached to the Clauses hereto.
ANNEX I TO APPENDIX V
A. LIST OF PARTIES
Data exporter(s): EndUser, the Data Controller (as defined in the EULA)
Data importer(s):Brain Corporation, the Data Processor
B. DESCRIPTION OF THE TRANSFER
The parties agree that the details of Brain’s processing activities are setforth in Appendix I to the Addendum.
ANNEX II TO APPENDIX V
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICALAND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA.
The parties agree that the technical and organization measures are setforth in Appendix II to the Addendum.
ANNEX III TO APPENDIX V
LIST OF SUB-PROCESSORS
The parties agree that the list of approved sub-processors is set forth inAppendix III to the Addendum.
ANNEX IV TO APPENDIX V
The parties agree that the Standard Contractual Clauses arean appropriate safeguard to ensure an adequate level of protection for End UserPersonal Data transferred from the EEA. The Data Processor has documented atransfer impact assessment supporting this determination which is available toData Controller upon written request.