Data Processing Addendum

With effect as of its execution by Tickets99 and Customer, this Data Processing Addendum (“DPA”) forms part of the Tickets99 commercial agreement ("Agreement") between Tickets99 Inc. and its affiliates (collectively, “Tickets99”) and the person or entity who acquires the Service under the Agreement (“Customer”).

This DPA reflects the parties’ agreement with regard to the Processing of Personal Data. This DPA serves as an integral part of the Agreement, however, the terms of this DPA will prevail over any conflicting terms in the Agreement. All capitalized terms not defined herein will have the meaning ascribed to them in the Agreement.

DATA PROCESSING TERMS

In the course of providing the Tickets99 services ("Service") to Customer pursuant to the Agreement, Tickets99 may Process Personal Data on behalf of the Customer. The parties agree to comply with the following provisions with respect to Personal Data Processed by Tickets99 as part of the Service for Customer.

1. DEFINITIONS

• 1.

  "Data Subject" means an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

• 2.

  "Personal Data" means any information relating to a Data Subject.

• 3.

  "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

• 4.

  "Personnel" means persons authorized by Tickets99 to Process Customer's Personal Data.

• 5.

  "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).

• 6.

  "Privacy Shield" means the EU-US Privacy Shield Framework, as administered by the U.S. Department of Commerce and approved by the European Commission pursuant to Decision C(2016)4176 of July 12, 2016.

• 7.

  "Privacy Shield Principles" mean the Privacy Shield Principles, as supplemented by the Supplemental Principles and contained in Annex II to the European Commission Decision C(2016)4176 of July 12, 2016, as may be amended, superseded or replaced.

• 8.

  "Process" or "Processing" means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, blocking, erasure or destruction.

• 9.

  "Standard Contractual Clauses" mean the annex to the EU Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council. "Tickets99 Information Security Documentation" means the information security documentation applicable to the specific Service purchased by Customer, as updated from time to time, and made available by Tickets99 upon request and subject to adequate confidentiality arrangements.

2. DATA PROCESSING

• 1

  Scope and Roles. This DPA applies when Personal Data is processed by Tickets99 as part of Tickets99 provision of the Service. In this context and for the purposes of the GDPR, Customer is the data controller and Tickets99 is the data processor.

• 2

  Subject Matter, Duration, Nature and Purpose of Processing. Tickets99 processes Customer's Personal Data as part of providing Customer with the Service, pursuant to the specifications and for the duration under the terms of the Agreement.

• 3

  Type of Personal Data and Categories of Data Subjects. Tickets99 has no control over the type of Personal Data that Customer and users authorized by Customer upload to the Service. Accordingly, Tickets99 has no control over the categories of Data Subjects that Customer's Personal Data relates to.

• 4

  Instructions for Tickets99 Processing of Personal Data. Tickets99 will only Process Personal Data on behalf of and in accordance with Customer’s instructions. Customer instructs Tickets99 to Process Personal Data for the following purposes: (i) Processing related to the Service in accordance with the terms of the Agreement; and (ii) Processing to comply with other reasonable instructions provided by Customer where such instructions are consistent with the terms of the Agreement. The customer undertakes to provide Tickets99 with lawful instructions only. Tickets99 will inform Customer immediately if in Tickets99 opinion an instruction infringes any provision under the GDPR and will be under no obligation to follow such instruction, until the matter is resolved in good-faith between the parties. As required under the GDPR, Customer will provide all necessary notices to relevant Data Subjects and secure all necessary permissions and consents from them, for the Processing of Personal Data by Tickets99 pursuant to this DPA.

3. ASSISTANCE

Taking into account the nature of the Processing, Tickets99 will assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer's obligation to respond to requests for exercising the Data Subjects' rights under the GDPR. Tickets99 will further assist Customer in ensuring compliance with Customer's obligations in connection with the security of Processing, notification of a Personal Data Breach to supervisory authorities and affected Data Subjects, Customer's data protection impact assessments and Customer's prior consultation with supervisory authorities, in relation to Tickets99 Processing of Personal Data under this DPA. Except for negligible costs, Customer will reimburse Tickets99 with costs and expenses incurred by Tickets99 in connection with the provision of assistance to Customer under this DPA.

4. Tickets99 PERSONNEL

• 1.

  Limitation of Access. Tickets99 will ensure that Tickets99 access to Personal Data is limited to that personnel who require such access to provide the Service in accordance with the Agreement.

• 2.

  Confidentiality. Tickets99 will impose appropriate contractual obligations upon its personnel engaged in the Processing of Personal Data, including relevant obligations regarding confidentiality, data protection, and data security. Tickets99 will ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training regarding their responsibilities, and have executed written confidentiality agreements. Tickets99 will ensure that such confidentiality agreements survive the termination of the employment or engagement of its personnel.

5. OTHER PROCESSORS

• 1.

  Tickets99 may engage third-party service providers to process Personal Data on behalf of the Customer ("Other Processors"). Customer hereby provides Tickets99 with a general authorization to engage the Other Processors, provided, however, that all Other Processors have entered into written agreements with Tickets99 that bind them by substantially the same material obligations under this DPA. Where the Other Processor fails to fulfil its data protection obligations in connection with the Processing of Personal Data under this DPA, Tickets99 will remain fully liable to Customer for the performance of that Other Processor's obligations.

• 2.

  Tickets99 may engage with a new Other Processor ("New Processor") to Process Customer Personal Data on Customer's behalf. Customer may object to the Processing of Customer's Personal Data by the New Processor, for reasonable and explained grounds, within five (5) business days following Tickets99 written notice to Customer of the intended engagement with the New Processor. If Customer timely sends Tickets99 a written objection notice, the parties will make a good-faith effort to resolve Customer's objection. In the absence of a resolution, Tickets99 will make commercially reasonable efforts to provide Customer with the same level of Service, without using the New Processor to Process Customer's Personal Data.

7. SECURITY

Tickets99 will maintain administrative, physical and technical safeguards for the protection of the security, confidentiality and integrity of Customer's Personal Data, pursuant to the Tickets99 Information Security Documentation. Tickets99 regularly monitors compliance with these safeguards. Tickets99 will not materially decrease the overall security of the Service during the term of the Agreement.

8. PERSONAL DATA BREACH MANAGEMENT AND NOTIFICATION

• 1.

  Tickets99 will maintain security incident management policies and procedures and will notify Customer without undue delay after becoming aware of a Personal Data Breach related to Customer's Personal Data which Tickets99, or any of Tickets99 Other Processors, Process. Tickets99 notice will at least: (a) describe the nature of the Personal Data Breach including where possible, the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned; (b) communicate the name and contact details of the Tickets99 data protection team, which will be available to provide any additional available information about the Personal Data Breach; (c) describe the likely consequences of the Personal Data Breach; (d) describe the measures taken or proposed to be taken by Tickets99 to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects. Where, and insofar as, it is not possible to provide the information at the same time, the information may be provided in phases without undue delay.

• 2.

  Tickets99 will work diligently, pursuant to its incident management policies and procedures to promptly identify and remediate the cause of the Personal Data Breach and will inform Customer accordingly.

• 3.

  Tickets99 will only be liable for a Personal Data Breach towards Customer and any third party to the extent that the Personal Data Breach is a result of a breach of Tickets99 information security obligations under this DPA, provided however that the Personal Data Breach is not caused by: (i) acts or omissions of Customer, or any person acting on behalf of or jointly with Customer (collectively "Customer Representatives"); (ii) Customer Representatives' instructions to Tickets99; (iii) a willful, deliberate or malicious conduct by a third party; or (iv) acts of God or force major, including, without limitation, acts of war, terror, state-supported attacks, acts of state or governmental action prohibiting or impeding Tickets99 from performing its information security obligations under the Agreement as well as this DPA, and natural and man-made disasters.

• 4.

  Accounts with two months inactivity will be deleted from our database and to access our product, or products, or services, it is mandatory for all account holders to maintain a valid email status all the time.

9. AUDIT AND DEMONSTRATION OF COMPLIANCE

Tickets99 will make available to Customer all information necessary for Customer to demonstrate compliance with the obligations laid down under Article 28 to the GDPR in relation to the Processing of Personal Data under this DPA by Tickets99 and its Other Processors.

Tickets99 will allow for and contribute to audits, including inspections, conducted by Customer or another auditor mandated by Customer, in relation to Tickets99 obligations under this DPA. Tickets99 may satisfy the audit obligation under this Section 9.2 by providing Customer with attestations, certifications and summaries of audit reports conducted by accredited third party auditors. Audits by Customer are subject to the following terms: (i) the audit will be pre-scheduled in writing with Tickets99, at least forty-five (45) days in advance and will be performed not more than once a year (except for an audit following a Personal Data Breach); (ii) the auditor will execute a non-disclosure and non-competition undertaking toward Tickets99; (iii) the auditor will not have access to non-Customer data (iv) Customer will make sure that the audit will not interfere with or damage Tickets99 business activities and information and network systems; (v) Customer will bear all costs and assume responsibility and liability for the audit; and (vi) Customer will receive only the auditor's report, without any Tickets99 'raw data' materials, will keep the audit results in strict confidentiality and will use them solely for the specific purposes of the audit under this section; (vii) at the request of Tickets99, Customer will provide it with a copy of the auditor's report; and (viii) as soon as the purpose of the audit is completed, Customer will permanently dispose of the audit report.

10. DELETION OF PERSONAL DATA

At the choice of Customer, Tickets99 will delete or return all Customer's Personal Data to Customer after the end of the provision of Services relating to Processing of Customer's Personal Data and delete existing copies unless a law of the European Union or an EU member state requires the storage of the Personal Data.

11. ANONYMIZED AND AGGREGATED DATA

Tickets99 may process data based on extracts of Personal Data on an aggregated and non-identifiable forms, for Tickets99 legitimate business purposes, including for testing, development, controls, and operations of the Service, and may share and retain such data at Tickets99 discretion.

12. DISPUTE RESOLUTION

The parties agree to communicate regularly about any open issues or process problems that require resolution. The parties will attempt in good faith to resolve any dispute related to this DPA as a precondition to commence legal proceedings, first by direct communications between the persons responsible for administering this DPA and next by negotiation between executives with authority to settle the controversy. Either party may give the other party a written notice of any dispute not resolved in the normal course of business. Within two (2) business days after delivery of the notice, the receiving party will submit to the other party a written response. The notice and the response will include a statement of each party’s position and a summary of arguments supporting that position and the name and title of the executive who will represent that party. Within five (5) business days after delivery of the disputing party’s notice, the executives of both parties will meet at a mutually acceptable time and place, including by phone, and thereafter as often as they reasonably deem necessary, to resolve the dispute. All reasonable requests for information made by one party to the other will be honored. All negotiations pursuant to this clause are confidential and will be treated as compromise and settlement negotiations for purposes of applicable rules of evidence.

13. ORDER OF PRECEDENCE

The terms of this DPA will prevail over any conflicting terms in the Agreement.

14. TERM

• 1.

  This DPA will commence on the later of the date of its execution or the effective date of the Agreement to which it relates and will continue until the Agreement expires or terminated.

• 2.

  This DPA may be modified or amended only by a written amendment to this DPA which will be signed by both Tickets99 and Customer.

15. COMPLIANCE

Tickets99 is responsible to make sure that all relevant Tickets99 personnel adhere to this DPA. Tickets99 compliance team can be reached at: privacy@Tickets99.com.

IN WITNESS WHEREOF, the parties hereto have executed this DPA as a sealed instrument

Tickets99 - Agreed

Customer - Agreed