Request a Demo

Pairzon License Agreement

SOFTWARE LICENSE AGREEMENT

This Software License Agreement (“Agreement”) is entered into on the Effective Date (as defined in the Order Form) by and between Pairzon Ltd., a company registered in the State of Israel, with a place of business at 8A Horesh St., Binyamina, Israel, 30500 (“Pairzon”) and the Customer (as defined in the Order Form). This Agreement is an integral part of the order form signed by the parties (the “Order Form”). Other than the Order Form, there shall be no force or effect to any different terms of any related purchase orders, terms and conditions, similar forms or documents, even if signed by the parties after the date hereof.

Customer hereby acknowledges that by executing the Order Form it is agreeing to the terms and conditions of this Agreement. 

WHEREAS Pairzon is the owner of certain proprietary technology defined herein as the “Technology”; and WHEREAS Customer desires to receive a right to access and use the Technology in order to utilize it; and WHEREAS Pairzon is willing to grant Customer such rights under the terms and conditions set forth herein.

NOW, THEREFORE, the parties hereby agree as follows:

  • LICENSE

Subject to the terms and conditions of this Agreement, including, without limitation, Customer’s payment of the fees set forth herein, Pairzon hereby grants Customer a non-exclusive, non-transferable, limited and revocable right throughout the applicable term, to access its proprietary AI and machine learning-based software (the “Technology”) in order to use the Technology, as set forth in this Agreement (including, without limitation, Exhibit A attached hereto). Such access and use shall be limited only within the scope of access and use as explicitly set forth in this Agreement. Customer may exercise the rights granted herein only through its employees and contractors, and only for its internal benefit. 

  • SUPPORT SERVICES
    1. During the applicable term, Pairzon will provide Customer with certain maintenance and support services as described in the service level agreement set forth at Exhibit C (“Service Level Agreement” or “SLA”), hereby incorporated as an integral part of this Agreement. 
    2. Pairzon will provide initial training for Customer’s relevant employees to effectively use the Technology. The duration and content of said initial training will be mutually agreed by the parties. The training will be conducted through on-line teleconferencing. 

  • INTELLECTUAL PROPERTY RIGHTS & RESTRICTIONS
      1. All Intellectual Property Rights in the Technology and any part thereof, including any and all derivatives, changes and improvements thereof lie exclusively with Pairzon (or its licensors, in the event of third-party software). Customer shall use the Technology expressly as permitted herein and shall not (i) attempt to infiltrate or hack the Technology, or any part thereof for any purpose nor shall it reverse-engineer, decompile, disassemble, or otherwise attempt to derive the source code of the Technology; (ii) represent that it possess any proprietary interest in the Technology; (iii) not directly or indirectly, take any action to contest Pairzon’s Intellectual Property Rights or infringe them in any way; (iv) except as specifically permitted hereunder, use the name, trademarks, trade-names, and logos of Pairzon; (v) use the Technology to provide third parties with managed services or any other services whether or not in return for remuneration of any kind; (vi) remove, alter, or obscure any copyright, trademarks, trade names, logos, and other proprietary rights notices of Pairzon or third-parties contained on or within the Technology; (vii) distribute, copy, manufacture, rent, lease, adapt, lend, trade-in, translate or otherwise make available to any third party, stand-alone copies of the Technology or any part thereof; (viii) transfer, use or export the Technology in violation of any applicable laws or regulations of any government or governmental agency; (ix) modify or create derivative works of the Technology or any part thereof; and (x) use any portion of the Technology to create a software product that is the same or substantially similar to the Technology or any part thereof. Nothing in this Agreement shall constitute a waiver of Pairzon’s Intellectual Property Rights under any law, or be in any way construed or interpreted as such. No rights or licenses are granted except as expressly set forth herein
      2. “Intellectual Property Rights” means all intangible legal rights, titles and interests evidenced by or embodied in all: (i) inventions (regardless of patentability and whether or not reduced to practice), improvements thereto, and patents, patent applications, and patent disclosures, together with all reissuances, continuations, continuations in part, revisions, extensions, and reexaminations thereof; (ii) trademarks, service marks, trade dress, logos, trade names, and corporate names, together with translations, adaptations, derivations, and combinations thereof, including goodwill associated therewith, and applications, registrations, and renewals in connection therewith; (iii) any work of authorship, regardless of copyright ability, copyrightable works, copyrights (including moral rights) and applications, registrations, and renewals in connection therewith; (iv) trade secrets and Confidential Information; and (vi) all rights associated with the foregoing and all other proprietary rights and any other similar rights, in each case on a worldwide basis, and copies and tangible embodiments thereof, in whatever form or medium.
      3. Customer Content shall be provided by Customer. Customer will at all times retain all rights, title, and interests in and to all Customer content.  Customer Content means information, data (including Personal Data as that term is defined in the Data Processing Agreement) and other material, in any format, provided by Customer or Customer’s Users that reside in, or run on or through, the Technology. 
  • PAIRZON’S REPRESENTATIONS AND WARRANTIES

Pairzon hereby represents and warrants to Customer as follows:

  1. It is the sole and exclusive owner of the intellectual property rights and/or has been granted the required licenses for the lawful use of the Technology and that to the best of its knowledge, there is no legal and/or contractual and/or any other restriction, which precludes it from providing Customer with the right to use the Technology as set forth in this Agreement.
  2. that the Technology shall materially conform to the functional specifications in Exhibit A, which is hereby incorporated as an integral part of this Agreement. Pairzon’s sole liability and Customer’s exclusive remedy for any breach of this warranty shall be to use reasonable commercial efforts to remedy any failure of the Technology to materially conform to Exhibit A in accordance with the terms of the SLA, provided that (i) Customer is not otherwise in breach of this Agreement, and (ii) Customer has reported in writing to Pairzon the claimed failure promptly upon discovery.
  • DISCLAIMER OF WARRANTY

EXCEPT FOR THE WARRANTIES PROVIDED IN THIS AGREEMENT, PAIRZON PROVIDES THE USAGE OF THE TECHNOLOGY TO CUSTOMER AND ANY SUPPORT SERVICES ON AN “AS IS” BASIS, WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTY OF MERCHANTABILITY, NON-INFRINGEMENT, AND FITNESS FOR PARTICULAR PURPOSE OR ACCURACY. NOTWITHSTANDING ANYTHING TO THE CONTRARY HEREIN, PAIRZON DOES NOT WARRANT THAT THE TECHNOLOGY OR ANY SERVICES RELATED THERETO WILL BE DELIVERED OR PERFORMED ERROR-FREE OR WITHOUT INTERRUPTION.

  • CUSTOMER’S REPRESENTATIONS, WARRANTIES AND UNDERTAKINGS

Customer hereby represents and warrants to Pairzon as follows: 

  1. It has no knowledge of any legal and/or contractual and/or other restriction to prevent it from licensing or using the Technology.
  2. It is and will continue to comply with all applicable legal requirements regarding to: (i) the required disclosure to its customers in connection with the generation of digital receipts and/or invoices by Pairzon and their delivery to Customer’s customers through Pairzon; (ii) the Customer’s current and future use of the data collected by it from its customers via use of the Technology and  in accordance with the terms of this Agreement and the Customer’s instructions as they may be provided to Pairzon from time to time.
  3. It complies with all the required data protection measures to ensure that Customer’s computing systems and its interface with the Technology are secured. Customer shall be solely responsible for any damages caused to Pairzon and/or to any of the Customer’s customers, in the event that any third party will gain access to the information collected in Customer’s systems through the use of the Technology and a result of such exposure.
  4. To comply with the provisions of all applicable laws and regulations, including (without limitation) those regarding to privacy, data protection and the distribution of advertisements to recipients whose information Customer received from the Pairzon.
  5. Without derogating from the generality of the above, to obtain all required permissions and authorizations for the transfer of its customers’ data to Pairzon and for Pairzon’s use of said data, as required by and in accordance with the provisions of this Agreement.
  6. Not to insert nor permit the insertion or introduction of any Malicious Code (as defined below) into the Technology. Customer will take all commercially reasonable actions and precautions to prevent the introduction and proliferation of Malicious Code into the Technology. “Malicious Code” means (i) any code, program, or sub-program which causes damage or maliciously interferes with the operation of a computer software containing the code, program or sub-program, or halts, disables, or interferes with the operation of the Technology, or (ii) any device, method, or token that permits any person to circumvent without authorization the normal security of the Technology.
  7. Without derogating from any other provision of this Agreement, it shall fully comply with and adhere to the technical specifications set forth in Exhibit B, hereby incorporated as an integral part of this Agreement. 
  8. The party signing this Agreement on its behalf is an authorized signatory, authorized to commit on behalf of and bind the Customer with her or his signature. 
  • THIRD-PARTY LICENSES

The Technology includes certain third-party software and materials (“Third-Party Software”) that are subject to their respective third-party licenses and the title to which remains with the applicable third-party (“Third-Party Licenses”). By executing this Agreement, Customer undertakes to strictly comply with the terms and condition of the Third-Party Licenses, as may be amended from time to time. In the event of any inconsistencies or conflicting provisions between the provisions of the Third-Party Licenses and the provisions of this Agreement, the provisions of the Third-Party Licenses shall prevail but solely in connection with the related Third-Party Software. Without derogating from the generality of the foregoing, it is clarified that any Third-Party Software is provided on an “AS IS” basis, without indemnity or warranty of any kind, whether express or implied.

  • CONFIDENTIALITY

The parties undertake to maintain confidentiality in accordance with the confidentiality undertaking attached hereto as Exhibit D (hereby incorporated as an integral part of this Agreement), mutatis mutandis, except as specified and set forth in Section 12.3 herein. 

  • FEES
      1. Customer shall pay Pairzon the fees as set forth in Order Form. Payment terms shall be as set forth in the Order Form. 
      2. Customer is solely responsible for payment of any taxes (including, without limitation, sales or use taxes, Value Added Taxes, employee-related taxes, intangible taxes, and property taxes, and only excluding taxes related to Pairzon’s income) resulting from using the Technology. To the extent that Pairzon shall be required to pay any such taxes then such taxes shall be billed to and paid by Customer. If any such taxes are required to be withheld, Customer shall pay an amount to Pairzon such that the net amount payable to Pairzon after withholding of taxes shall equal the amount that would have been otherwise payable under this Agreement
  • TERM AND TERMINATION
    1. Subject to earlier termination as provided below, this Agreement shall be in force and effect during the Initial Service Term as specified in the Order Form, and shall be automatically renewed for additional periods of the same duration as the Initial Service Term (collectively, the “Term”), unless either party requests termination at least sixty (60) days prior to the end of the then-current term.
    2. Notwithstanding the provisions of Section 10.1 above and without derogating from any right or remedy hereunder and/or any applicable law, each party may terminate this Agreement with an immediate effect, upon the occurrence of any of the following events:
      1.  the other party has breached a material term of this Agreement and such breach has not been cured within a period of fourteen (14) days; 
      2.  an appointment of a liquidator, trustee or receiver with respect to all or materially all the assets of the other party, or if a petition for the appointment of any of the above was submitted and has not been cancelled within sixty (60) days;
      3. a filing of a petition for creditors arrangement by the other party or in connection with such party, which has not been cancelled within sixty (60) days;
      4. the other party was declared insolvent or is in the process of a liquidation or initiated a voluntary liquidation proceeding.    

As promptly as possible after becoming aware of the occurrence of any of the events stated in sub-Sections 10.c (i)-(iv) above, the party wishing to terminate the Agreement will provide the other party with a written notice notifying the other party thereof. 

  1. Notwithstanding the above, Customer may terminate the Agreement without cause within ten (10) days of the Effective Date, by providing Pairzon with a written notice thereof. For avoidance of doubt, once ten (10) days as of the Effective Date have passed, neither party may terminate this Agreement for reasons other than those set forth in Section 10.2 above. 
  2. It is hereby agreed that upon termination of this Agreement, for any reason whatsoever, Customer shall pay Pairzon the consideration it is entitled to up to the date of termination.
  3. Upon termination of this Agreement for any reason, Customer will immediately cease use of the Technology, and both parties shall promptly return any of the other party’s Confidential Information that they may then have in their possession.
  4. In the event this Agreement is terminated by Customer due to Pairzon’s material breach, then Pairzon shall refund to Customer a pro-rata portion of the prepaid but unused fees applicable to the portion of the Term remaining after the termination date.
  • LIABILITY AND INDEMNIFICATION
      1. IN NO EVENT SHALL EITHER PARTY BE LIABLE TO THE OTHER PARTY FOR SPECIAL, PUNITIVE OR CONSEQUENTIAL DAMAGES OR LOSS OF PROFITS, EITHER IN CONTRACT, TORT OR OTHERWISE, UNDER, ARISING OUT OF OR RELATING TO THIS AGREEMENT, INCLUDING A PARTY’S PERFORMANCE OR NON-PERFORMANCE HEREUNDER, WHETHER OR NOT THE POSSIBILITY OF SUCH DAMAGES HAD BEEN DISCLOSED TO THE OTHER PARTY IN ADVANCE OR COULD HAVE BEEN REASONABLY FORSEEN B YTHE OTHER PARTY.
      2. SUBJECT TO SECTION 11.3 BELOW, IN NO EVENT SHALL EITHER PARTY’S LIABILITY FOR DIRECT DAMAGES UNDER, ARISING OUT OF OR RELATING TO THIS AGREEMENT, EXCEED THE AMOUNT OF FEES ACTUALLY PAID TO PAIRZON BY CUSTOMER UNDER THIS AGREEMENT IN THE 12 MONTHS PERIOD PRECEDING THE EVENT THAT GAVE RISE TO THE CLAIM. 
      3. Notwithstanding Section 11.2 above and anything to the contrary, the liability cap set forth in Section 11.2 will not apply to infringement of intellectual property rights, breach of applicable privacy laws, breach of the party’s confidentiality undertakings hereunder, willful misconduct or gross negligence of a party or anyone on its behalf.
      4. Pairzon shall indemnify, hold harmless and defend or settle at its expense, any action, claim or proceeding, brought against Customer and anyone on its behalf, to the extent based upon a claim that the Technology infringes any third party intellectual property right. Pairzon’s obligation to indemnify Customer shall be limited to the following: Pairzon agrees to pay Customer reasonable attorneys’ fees and expenses, incurred in investigation or defense of such claims, and all damages and liabilities finally awarded against Customer or paid in settlements and arising out of such third party claims. Pairzon’s indemnity obligation shall not extend to claims based solely on (i) an unauthorized use of the Technology; (ii) the Customer’s use of the Technology after receipt of notice of alleged or actual infringement by Pairzon; and (iii) Customer’s sue of the Technology together with other products or software, where the use of the Technology alone would not consist infringement of a third-party’s intellectual property.
      5. Customer shall indemnify, hold harmless and defend any action, claim or proceeding brought against Pairzon or anyone on its behalf, to the extent claim is based upon (a) Customer’s violation or breach of applicable law or Customer’s representations hereunder, (b) Customer’s infringement of third parties’ intellectual property, or (c) Customer’s infringement of any provisions of relating to data protection or consumer protection, including inter alia, as applicable, Privacy Protection Law, 5741-1981 and the regulations promulgated thereunder, including the provisions relating to direct mailing of advertising material, as well as the provisions of the California Consumer Privacy Act of 2018, California Privacy Rights Act of 2020, CAN- SPAM Act of 2003, Regulation (EU) 2016/679 (General Data Protection Regulation), etc., all as amended or replaced from time to time.  
      6. As a condition to the indemnification set forth above, indemnified party shall give indemnifying party prompt notice of any such claim made against it, and grant indemnifying party sole control of the defense of any such claim, suit or proceeding, including appeals, negotiations and any settlement or compromise thereof. Notwithstanding, the indemnifying party shall not settle or compromise any indemnifiable claim or consent to entry of judgment in respect thereof without the indemnified party’s written consent, which shall not be unreasonably withheld.
      7. For the avoidance of any doubt, it is hereby clarified that indemnification for any third party’s claims will be due and payable on upon receipt of a final, un-appealable court order regarding such claim.
  • USE OF INFORMATION
      1. Customer hereby grants Pairzon a world- wide, non-exclusive, royalty-free license during the applicable term, to collect, use, reproduce and distribute the Customer Content for the purposes set forth in Section 12.3 below. Pairzon will not be liable for any non-conformance of the Technology when such non-conformance is caused by Customer’s delay in or failure to provide the required Customer Content or an interface to it. Customer represents and warrants that it owns all right, title and interest in and to the Customer Content or has acquired the right to use it, and that it has the right to allow Pairzon to use the Customer Content as set forth in this Agreement. 
      2. Pairzon undertakes to manage the Customer Content collected as a result of the Technology’s useand/or as a consequence of the performance of this Agreement(the “Collected Information”), in accordance with provisions of this Agreement, Customer’s Privacy Policy (https://www.pairzon.com/privacy.pdf), and the data processing and protection appendix attached hereto as Exhibit E (hereby incorporated as an integral part of this Agreement), and undertakes to keep copies of the invoices or digital receipts generated by Customer for its customers for as long as legally required. Pairzon further undertakes that the Collected Information will be maintained in accordance with the provisions of applicable law. Customer will be entitled to access the Collected Information during the Term and/or for the Retention Period, whichever is longer.
      3. Notwithstanding the foregoing, Pairzon shall be entitled to use the Collected Information, solely: (a) to comply with its obligations in accordance with the terms set forth herein, or; (b) to enable Customer to effectively use the Technology, or; (c) upon receipt of Customer’s prior written consent, or;  (d) as long as the Collected Information is disseminated on an anonymous and aggregated basis (i.e.: the information will not contain any identifiers of Customer or any of its customers) and: (i) for statistical purposes, or (ii) for conducting market research, or (iii) to improve and upgrade the Technology and/or improve its effectiveness; provided, that; or (e) pursuant to a requirement or request of a governmental agency or pursuant to a court or administrative subpoena, order or other such legal process or as may be required by applicable law or regulation.
  • MISCELLANEOUS
    1. The parties’ addresses are as specified in the preamble of this Agreement. Any notice sent to any of the parties by registered mail shall be deemed to have been duly accepted by the other party after 72 hours from its delivery or on the day of transmission if sent by e-mail or fax subject to receipt of an automatic electronic written confirmation of delivery.
    2. Pairzon may use Customer’s name and/or Customer’s logo, as applicable, in referring to Customer as its customer. Customer may, at any time, require Pairzon to discontinue the use of its name and Pairzon undertakes to promptly cease such use.
    3. The parties hereby represent and agree that Pairzon is an independent contractor and nothing contained in this Agreement shall be construed to create or imply an employee-employer relationship, joint venture, partnership or agency or fiduciary relationship between the parties.
    4. Neither party may assign or transfer any right or obligation under this Agreement without the other party’s written consent, provided, however, that either Party may transfer or assign this Agreement, or any rights or obligations hereunder, to a successor to its business by merger or acquisition without the consent of the other Party. Subject to the above, this Agreement shall be binding upon and inure to the benefit of the respective successors and assignees of both parties.
    5. This Agreement includes and incorporates the above Order Form, as well as the attached Terms and Conditions and its Exhibits and any document specifically referenced and defined herein as an integral part of the Agreement. There shall be no force or effect to any different terms of any related purchase orders, documents or similar forms even if signed by the parties after the date hereof, except for contractual amendments which are specifically intended to supersede this Agreement and explicitly stipulate so.
    6. This Agreement represents the entire agreement between the parties with respect to its subject matter and supersedes all prior communications, understandings, or agreements, whether oral or written. No modification of this Agreement shall be binding on the parties unless in writing and signed by an authorized representative of each party.
    7. In the event that any covenant, condition or other provision contained in this Agreement is held to be invalid, void or illegal by any court of competent jurisdiction, the same, to the extent commercially reasonable, shall be deemed severable from the remainder thereof, and shall in no way affect, impair or invalidate any other covenant, condition or other provision therein contained.
    8. This Agreement shall be governed exclusively by the laws of the State of New York, without regard to its conflict of laws provisions, and the competent courts in New York, NY shall have exclusive jurisdiction over any claim arising out of, or in connection with, this Agreement.
    9. Except for Customer’s obligation to pay fees due under this Agreement, neither party hereto shall be liable for any loss, damage, or penalty resulting from such party’s failure to perform its obligations hereunder when such failure is due to events beyond its control, including, without limitation, flood, earthquake, fire, disease, pandemic, epidemic, acts of God, military insurrection, civil riot, or labor strikes.
    10. Terms which by nature survive termination or expiration shall survive any termination or expiration of this Agreement. Notwithstanding, the following Sections shall survive any termination or expiration of this Agreement: 3, 8, 10.5, 11, 13.3, 13.8 and 13.10. Termination shall not affect any rights and obligations accrued as of the effective date of termination.
    11. Each party declares and agrees that in connection with the activities under this Agreement it has not performed, nor will it perform, any act which would constitute a violation of any applicable anti-Corruption or anti-Bribery laws or regulations.
    12. Customer agrees to comply fully with all applicable export laws and regulations to ensure that neither the Technology nor any technical data related thereto are exported or re-exported directly or indirectly in violation of, or used for any purposes prohibited by, such laws and regulations.
    13. This Agreement may be executed in any number of counterparts, each of which shall be deemed an original and enforceable against the party actually executing such counterpart, and all of which together shall constitute one and the same instrument. The exchange of an executed Agreement (in counterparts or otherwise) by facsimile or by electronic delivery in PDF format or similar format shall be sufficient to bind the parties to the terms and conditions of this Agreement as an original. 

 

 

EXHIBIT A

 

Pairzon will provide Customer with the Technology, in compliance with the Order Form and the terms and conditions of the Agreement. 

 

The Technology will enable Customer to:

  1. Generate secured digital receipts/invoices to its clients, through the interfacing of the Customer’s databases with the Technology.
  2. Perform formative changes to Customer’s digital receipt/invoice in accordance with Customer’s requirements, within no more than five (5) working hours.
  3. Generate the following reports:
    1. basic structured reports;
    2. repetition and effectiveness reports regarding the Customer’s marketing efforts in digital media (Offline Conversion).
  4. Manage on-line audiences:
    1. audience creation according to the Customer’s marketing requirements;
    2. generating comparison reports between advertising networks and media;
    3. using machine learning to classify on-line’s users and creating similar audiences;
    4. manage and share audiences among diverse accounts/platforms.
  5. Analyze audiences according to their on-line activities/usage.
  6. Create interfaces with the Customer’s CRM/CD/Marketing Automation systems.
  7. Subject to additional payment in accordance with the hourly rate set forth in the Order Form, implement adjustments to the existing management interface according to the Customer’s requirements.

 

 

  

EXHIBIT B

TECHNICAL SPECIFICATIONS

 

In order to enable the proper use the Technology, as set forth in the Agreement, Customer undertakes towards Pairzon as follows:

 

  1. To provide Pairzon with access to its databases and systems pursuant to the technical specifications provided by Pairzon, in order to: (a) enable the Technology’s interface with said databases and systems, and (b) allow Pairzon to install the Technology in Customer’s branches/POS’ and/or on-line e-commerce routes, as shall be agreed upon by the parties. 
  2. To ensure that Customer’s servers will have secured Internet communication;
  3. To include at the branches/points of sales that will interface with the Technology, a pop-up that will: (a) enable the collection of the customer’s phone number, and (b), transmit said customer’s phone number to Pairzon in an encrypted format, as shall be agreed by the parties.
  4. [In the event the Technology is provided via SAAS] To ensure and enable communication between Customer’s branches/POS systems and Pairzon’s servers on which the Technology is be installed.

 

EXHIBIT C

SUPPORT AND MAINTENANCE TERMS

 

  1. Support and maintenance services provided to Customer will include resolution of failures in the operation of the Technology (i.e.: non-conformity to the provisions of the Agreement).

 

  1. Pairzon will promptly notify Customer of any problem and/or failure that may directly or indirectly affect the Technology’s ongoing and proper operation.

 

  1. Customer will promptly notify Pairzon of any problem and/or failure that is affecting its use of the Technology or its ongoing and proper operation. 

 

  1. Support will be provided by Pairzon’s via remote support. Pairzon will make available to Customer one contact person who will respond to Customer’s support requests during the business hours of the Customer’s branches in which the Technology is installed. Pairzon’s support team contact will be contacted at support@pairzon.com .

 

  1. Customer will cooperate with Pairzon in investigating and resolving failures/problems, by:  
    1. Taking all reasonable measures requested by Pairzon to detect and provide further information with respect to the failures/problems;
    2. Investigating failures/problems that may be related to Customer’s interfaces connected to the Technology;
    3. Investigating failures/problems that may be related to the hardware or 3rd party’s software on which the Technology is installed, including contacting vendors of said hardware and 3rd Party software; 
    4. Providing Pairzon with access to its systems and data bases, as applicable to resolving the failure/problem;
    5. Allowing Pairzon access to Customer’s staff that has sufficient knowledge of Technology. 

 

  1. Customer will allow the Technology to interface with Customer’s data base and system and will enable a remote connection for purposes of initial diagnosis and the handling of failures/errors via remote access. Such interface will be installed while ensuring the protection of the data and the prevention of unauthorized access thereto.

 

  1. Pairzon will take commercially reasonable measures to ensure that the performance of support and maintenance services will not interfere with Customer’s ongoing operations, except in the event of a Severe failure (as defined below), which might require interference with Customer’s ongoing operations and/or systems. In any event, no disruption of Customer’s ongoing operations or systems will be performed without Customer’s prior consent. 

 

  1. Failures/problems will be classified as follows:
    1. “Severe Failure” – a technical failure that causes the technology to be disabled (including in a manner that digital invoices are not been generated and/or sent to Customer’s customers in accordance with the provisions of this Agreement), but does not disable the operation of Customer’s POS systems.
    2. “Other Failure” – a technical failure that is not a Severe Failure  
  2. Failure/problem severity shall be categorized by the Parties according to the definitions set forth in Section 7 herewith. 

 

  1. Pairzon undertakes to meet the following response times:
    1. Severe Failure –Response to such a failure will commence immediately upon receipt by Pairzon of Customer’s support request. Pairzon will take all reasonable commercial measures to temporarily resolve such a failure within no more than three (3) hours as of the response, and fully resolve it as soon as reasonably possible.
    2. Other Failure – the response to such a failure will commence during Pairzon’s business hours, within four (4) hours of receipt by Pairzon of Customer’s support request.  Pairzon will take all reasonable commercial measures to temporarily resolve such a failure within no more than twenty-four (24) hours as of the response, and fully resolve it as soon as reasonably possible.

 

Response and resolution times may vary due to Customer’s response times and responsiveness and the type of environment the Technology is installed on (i.e.: cloud or on-prem).

 

  1. Notwithstanding anything to the contrary, Pairzon will have no obligation to act on issues arising from the following:
    1. requests for Platform enhancements or upgrades; 
    2. requests for updates of external interfaces; 
    3. relate to errors that Pairzon is unable to verify based on the data and information provided by the Customer; 
    4. involves errors resulting from alterations, modifications or any other unauthorized contact (physical or otherwise) with the equipment not performed or provided by Pairzon; 
    5. involves errors resulting from housing at Customer’s site, contrary to Pairzon’s guidelines;
    6. results from a malfunction of Customer and/or third-party components not provided by Pairzon (for example, hardware, software and networks); 
    7. results from malicious code or virus originating from the Customer network or due to Customer personnel activity; 
    8. are caused by a force majeure event including power and air-conditioning problems and natural catastrophes such as lightning, fire, earthquake, or floods;
    9. results from Customer’s installation of 3rd-party software on the Technology, without Pairzon’s prior written consent.

 

Should Pairzon, at its sole discretion, provide support or maintenance services for malfunctions caused by any of the events described in this paragraph, then Pairzon shall be entitled to charge Customer for the services provided at Company’s standard rate for such services. Pairzon shall have no responsibility whatsoever for any damage and/or derogation in availability and/or Technology’s performances caused due to the events described above.

  1. As permanent solutions or fixes for known Software problems are developed, these solutions will be incorporated without charge into planned software maintenance releases that will periodically be installed on the Technology. A software maintenance release note will be distributed describing the features and fixes contained in each software maintenance release. Customer shall perform its best efforts to have the most recent software maintenance release offered by Pairzon for the Technology. Customer’s technical point of contact shall be notified prior to installation of software maintenance releases regarding the planned activities and expected time frames.


EXHIBIT D

CONFIDENTIALITY UNDERTAKING 

This Confidentiality Undertaking (this “Undertaking“) is entered into by Customer and Pairzon. Each of the parties shall be referred to as a disclosing Party (“Disclosing Party“) and a receiving Party (“Receiving Party“), as applicable.

WHEREAS, each of the parties possesses Confidential Information (as defined below), and may disclose certain Confidential Information to the other party and the parties now wish to set forth the conditions of disclosure and the rules governing the use and protection thereof.

  1. For purposes of this Undertaking, “Confidential Information” shall mean and all information disclosed by the Disclosing Party, either directly or indirectly, to the Receiving Party in writing, orally or otherwise, in either tangible or intangible form, including, but not limited to, any agreement, documentation, business plans, trade secrets, products, instruments, machines, prototypes, examples, models, diagrams, drawings, schemes, configurations, technologies, techniques, knowledge, specifications, analysis, data, methods, processes, forecasts, plans, marketing and pricing information, materials, financial information, information regarding suppliers, customers or products, existing or potential, memos, lists, records, computer software, any amendments, updates, developments, improvements, new versions of the above, any report, research and information developed, derived from or created by or for the Receiving Party  in connection with such disclosed information.
  2. Notwithstanding the foregoing, Confidential Information shall not include information which: (a) is or becomes generally available to the public other than as a result of a breach of this Undertaking by Receiving Party; (b) was lawfully received by Receiving Party from a third-party having rights to disclose, and under no confidentiality obligations by an agreement or other legal obligation of such third party with respect to such Confidential Information, (c) is technical, statistical, aggregate and/or anonymous data used by Pairzon Ltd. for its own purposes and (d) is expressly approved in writing by the Disclosing Party for release by the Receiving Party.
  3. Receiving Party hereby agrees, covenants and undertakes that Receiving Party shall (i) protect and keep all Confidential Information of the Disclosing Party in strict confidence, employing the same degree of care it uses to protect its own Confidential Information of similar nature or sensitivity, and in any event not less than reasonable standard of care; (ii) use Confidential Information solely and exclusively for the purpose agreed-to between the parties, and shall not exploit or make use, directly or indirectly, of such 

Confidential Information of the Disclosing Party without the express written consent of the Disclosing Party; (iii) not analyze, reverse engineer, disassemble, decompile or create any derivative work based upon any Confidential Information (or any part thereof), and shall not copy or otherwise reproduce or duplicate such Confidential Information, in whole or in part; (iv) not remove, overprint, alter or deface any notice of patent, copyright, trademark or other notices of ownership or of confidentiality from any originals or copies of Confidential Information of the Disclosing Party; and (v) shall not disclose or permit the Confidential Information (in whole or in part) to be disclosed to any third party without the Disclosing Party’s prior written consent except as expressly permitted by this Undertaking. Notwithstanding the foregoing, it is clarified that the Pairzon may use the information received from Company’s customers without the need to obtain the Company’s consent, as long as the Collected Information is disseminated on an anonymous and aggregated basis and/or for statistical purposes or for conducting market research, or if the Collected Information is used to improve and upgrade the Technology and/or improve the effectiveness of the Services; provided, the information will not contain any identifiers of the Company or any of its customers.

  1. The Receiving Party may disclose the Confidential Information to its employees, officers, directors, consultants, legal and financial representatives or anyone on its behalf (“Representatives“) who have a legitimate need to know such Confidential Information, provided that, prior to disclosing any Confidential Information to such Representatives, Receiving Party shall ensure that such Representatives are aware of the confidential nature of the Confidential Information and of the terms of this Undertaking, and have signed or are otherwise bound by obligations no less restrictive than those contained in this Undertaking. Receiving Party shall be responsible for enforcing the terms of this Undertaking vis-à-vis any of its Representatives, and shall be liable for any breach of the terms of this Undertaking by any of its Representatives, as if such breach was a breach of the Receiving Party of this Undertaking.
  2. In the event that Receiving Party becomes legally compelled to disclose any of the Confidential Information of the Disclosing Party, Receiving Party will provide the Disclosing Party with prompt written notice thereof (to the extent legally feasible) so that the latter may seek to obtain a protective order affording confidential treatment to such Confidential Information or such other appropriate remedy which may be available under applicable law. If the Disclosing Party fails to obtain a protective order or other appropriate remedy, the Receiving Party will furnish only that portion of the Confidential Information that, according to the advice of the Receiving Party’s legal counsel, is legally compelled to be disclosed, and, upon the Disclosing Party’s request, shall use commercially reasonable efforts to obtain assurances from the applicable court or agency that such Confidential Information will be afforded confidential treatment. Any Confidential Information disclosed pursuant to this section shall maintain its confidentiality protection for all purposes other than such legally compelled disclosure.
  3. Confidential information is provided “as is” and the Disclosing Party makes no warranties, implied or explicit, of any nature whatsoever with respect to any information furnished by that Disclosing Party, including, without limitation, warranties regarding the accuracy, completeness, fitness or merchantability or of Confidential Information, or against infringement. In no event shall the Disclosing Party be liable to the Receiving Party for damages of any kind, including, but not limited to any direct, indirect, special, exemplary, punitive, incidental or consequential damages in connection with or arising out of the reliance upon or use by the Receiving Party of any portion of the Confidential Information.
  4. Disclosure of the Confidential Information, if any, shall be made at the sole discretion of the Disclosing Party. Neither this Undertaking, nor any disclosure or receipt of Confidential Information hereunder, shall be construed as conferring upon the Receiving Party any intellectual or industrial property rights, including but not limited to any licenses and/or rights to use such Confidential Information. The ownership of all Confidential Information is and shall remain with the Disclosing Party.
  5. Neither this Undertaking nor any disclosure or receipt of any Confidential Information hereunder shall be construed as compelling either party hereto to enter into any additional discussions or contractual relationship with the other party, nor shall it be deemed to construct, create or evidence a partnership, joint venture or other form of business association comprising the Parties. 
  6. This Undertaking shall govern the communications relating to Confidential Information between Disclosing Party and Receiving Party, until such time as the present Undertaking is expressly superseded by a subsequent agreement between the parties hereto, or the Undertaking has been terminated by either party upon provision of thirty (30) days prior written notice thereof, whichever is earlier. Notwithstanding, the obligations set forth in this Undertaking regarding confidentiality and use of Confidential Information shall survive any expiration or termination of this Undertaking for a period of 5 years thereafter
  7. Upon termination of this Undertaking, or immediately upon first request from the Disclosing Party, if earlier, Receiving Party shall return to the Disclosing Party (or if not practical, destroy) all Confidential Information of the Disclosing Party, and any copies thereof, and shall provide to the Disclosing Party a written certificate signed by an officer of the Receiving Party confirming such delivery (or destruction, as applicable).
  8. No change, modification or addition of or to any provision of this Undertaking shall be binding unless set forth in writing and signed by both parties. Failure or delay of either party to exercise any right, power or privilege given to it hereunder shall not be deemed to constitute a waiver of the right to demand exact compliance with the terms hereof, and any single or partial exercise of any right, power or privilege given to it hereunder shall not preclude any other or further exercise thereof. 
  9. Receiving Party agrees that monetary damages may not be a sufficient remedy for any breach of this Undertaking, and the Disclosing Party shall be entitled, in addition to monetary damages, to seek specific performance and/or injunctive relief and/or any other appropriate equitable remedies for any such breach, and, to the maximum extent permitted by law, in any competent court, without the obligation to post bond. Such remedies shall be available to the Disclosing Party in addition to any other remedies available to it at law or in equity.
  10. This Undertaking shall be exclusively governed by and construed under the laws of the State of New York, without reference to principles and laws relating to the conflict of laws. Any dispute, controversy or claim arising out of or in connection with this Undertaking shall be submitted exclusively to the competent courts in New York City, NY, USA, provided however that nothing in this Section shall prevent or restrict either party from seeking interim relief in any competent jurisdiction as it may deem fit, as set forth in Section 12 to this Agreement..
  11. If any provision of this Undertaking is determined to be invalid or unenforceable, in whole or in part, such provision will be enforced to the maximum extent permissible so as to affect the intent of the parties hereunder, and the remaining provisions will continue in full force and effect as if this Undertaking had been executed without the invalid provision.
  12. This Agreement shall not be transferred or assigned by either Party without the written consent of the other Party, and any purported assignment or transfer not permitted hereunder shall be construed null and void, provided, however, that either Party may assign or transfer this Agreement, or any rights or obligations hereunder, to a successor to its business by merger or acquisition without the consent of the other Party. Subject to the above, this Agreement shall be binding upon and inure to the benefit of the respective successors and assignees of both parties.


EXHIBIT E

DATA PROCESSING AGREEMENT 

 

This Data Processing Agreement (“DPA“) is an integral part of the Agreement between Pairzon and the Customer. Customer shall be referred to herein as the “Company” or “Controller“, and Pairzon shall be referred to herein as the “Contractor” or “Processor“; the Company and the Contractor shall each be referred to as the “Party” and together the “Parties“.

 

The DPA supersedes and replaces any current data protection agreements or provisions contained in the SAAS Agreement. The DPA shall define the duties applicable to the Contractor with compliance to the relevant Data Protection Law (as defined hereinafter). 

  • BACKGROUND
    1. Controller and the Processor have entered or are entering into an Agreement pursuant to which the Processor has agreed to provide the Services (as defined in the Agreement) to Controller.
    2. The Services may currently or in the future involve processing by the Processor of Personal Data or the transfer of said data, for which Company is its data Controller, and for which the Processor is a data Processor.
    3. Data Protection Laws require the Controller and Contractor to include certain principles in their contractual Agreement, regarding processing and/or transferring of personal data.

  • DEFINITIONS
    1. The following expressions and definitions shall apply to the entire DPA with accordance to the applicable Data Protection Law – as defined below.

 

Affiliate – with respect to any party, an entity that is controlled by, controlling, or in common or joint control with that party, from time to time.

 

Agreement – the SAAS Agreement and/or other agreements (including but not limited to statements of work, etc.) under which the Processor has agreed to provide Products and/or Services to Controller.

 

Data Protection Laws – as applicable to the Processing – Directive 95/46/EC and Directive 2002/58/EC, in each case as transposed into domestic legislation of each member state of the European economic area (“EEA“) and in each case as amended, replaced or superseded from time to time, including without limitation by the EU General Data Protection Law (“GDPR” and collectively with the foregoing “EU Data Protection Laws“) and the applicable data protection or privacy Laws of any other country including without limitation the State of Israel and/or the State of California or any other state in the United States.

 

Law – means any applicable treaty, legislation, statute, directive, regulation, judgment, decision, decree, order, ordinances, rules, codes, decrees, instrument, by – law, binding guidance from a Regulator or any other law of, or having effect in, any jurisdiction from time to time.

 

The Services – the products and/or services as described and agreed in the Agreement that are to be provided by the Processor to the Controller.

 

The terms “Controller”, “Processor”, “Sub-Processor”, “Data Subject”, “Personal Data”, ‘Processing” “Special Categories of Personal Data’ and “Personal Data Breach” – all shall have the meaning given to those terms under the applicable Data Protection Laws or the GDPR (related terms shall have the corresponding meaning). For example, Controller – may also mean “Business”, and Processor – may also mean “Service Provider”, as those two terms are defined under the California Consumer Privacy Act, or the California Privacy Rights Act or subsequent California state legislation. 

  • GENERAL PROVISIONS
    1. In any case of inconsistency or conflict between the DPA and the Agreement, the relevant provisions of the DPA will prevail. 
    2. Certain third-party applications and/or services and/or products are subject to independent terms, directly between Controller and the third party.
    3. Controller may excess and/or amend the terms set forth in the DPA, on written notice to the Processor: (1) to comply with applicable Law; (2) under instructions of a supervisory authority; (3) to implement standard contractual clauses, where required for the purposes of international Personal Data transfers, as approved by applicable law or supervisory authority. 
    4. Governing law and dispute resolution are as set in the Agreement.

  • THE PROCESSOR UNDERTAKES AND WARRANTS: 
      1. That it has the skills, knowledge, means and ability to provide the Services under the Agreement and that it shall comply with all relevant Data Protection Laws when processing Personal Data under the Agreement.
      2. To process the Personal Data only by documented instructions from the Controller, unless required to do so by governing law; in which case the Processor shall inform the Company of such legal requirement prior to the processing and/or transfer. For the avoidance of doubt, the Agreement and this DPA shall constitute as instructions for that matter.
      3. To process the Personal Data to provide the Services for the duration of providing the Services as set in the Agreement. Without derogating from the aforementioned, Contractor may use technical/statistical/aggregate/anonymous data for its own purposes without a limited duration (“service information“).  
      4. That it and anyone else on its behalf shall process the Personal Data received from the Company in a lawful manner according to the applicable Data Protection Laws. The Processor shall be solely responsible for any processing of the Personal Data performed by it or by anyone on its behalf.
      5. Confidentiality. It is hereby agreed that, subject to the Data Protection Laws, during the term of the Agreement and for an unlimited period time thereafter the parties shall maintain as confidential, and shall not use, disclose, transfer and/or make available, directly or indirectly, whether verbally or in writing, to any third party any Confidential Information (as defined in Exhibit D of the SAAS Agreement), that has come to their knowledge or attention from the other party and/or anyone acting on the other party’s behalf or in connection with/ as the result of the Agreement,  without obtaining the other party’s prior written consent. 
      6. Security. To implement all appropriate organizational and technical industry standard security measures, including as detailed under Schedule B to this DPA, and as needed to fully comply with applicable Data Protection Laws; Where applicable – implement appropriate technical and organizational measures, for the fulfillment of the Company’s obligations as described in articles 32-34 of the GDPR.
      7. To ensure that personnel authorized to process the Personal Data shall process it on a ‘need to know’ basis and ensure they have committed themselves to confidentiality under written and signed documents at least of the same standard as those signed by the Contractor vis-à-vis the Company. 
      8. To keep records of all processing of Personal Data under the Agreement, including records of authorized users who have processed and/or accessed Personal Data.
      9. To provide the Company, upon Company’s reasonable demand, reports concerning the security measures implemented by it. The Processor will report to the Company in writing, annually and upon reasonable demand, regarding the fulfillment of the Processor’s obligations under this DPA.
      10. Sub-processors. To fully respect applicable Data Protection Laws in reference to engaging sub-processors, including, where applicable, the conditions referred to in article 28(2) and 28(4) to the GDPR for engaging another Processor. The Processor will provide the Company with a list of sub-processors it currently uses (“current sub-processors“) and will note, if necessary, where there exists the implementation of appropriate safeguards, including, but not limited to the use of Standard Contractual Clauses and/or other applicable measures, to ensure sufficient safeguards for compliance with such requirements and any applicable Data Protection Laws. The Processor shall not engage new sub-processors without informing the Company prior to commencement of engagement. In any case, the Processor shall remain fully liable for any negligence and/or damages caused to the Company’s personal data resulting from any violation of Data Protection Laws or Data Subjects’ Rights, by its sub-processors.
      11. That it will not transfer the Confidential Information to any third party, including to its sub-processors, without the Company’s prior written consent, except if required under applicable Law or if ordered or demanded by a competent authority, which in that case the Processor shall notify the Company in advance of any such transfer, if possible. 
      12. Data Transfers. Without derogating from the aforementioned – if the GDPR is applicable and the Processor intends to process Personal Data outside the EEA territory including through the use of sub-processors or otherwise transfer personal data to any Third Country or international organization without a decision pursuant to Article 45(3) GDPR, or any other similar legal requirement/limitation exists in applicable Data Protection Laws with regards to personal data transfers applies – Processor shall only do so subject to prior written approval by the Company and subject to the implementation of appropriate safeguards, including but not limited to the use of Standard Contractual Clauses (“SCCs“) and/or other applicable measures, to ensure sufficient safeguards for compliance with such requirements and any applicable Data Protection Laws, as instructed by the Company. If this provision requires the implementation of SCCs between the Company and the Processor according to the GDPR, the most up-dated version of the SCC’s (as approved by the European commission), between Controller to Processor, will automatically apply and come into enforcement.   
      13. Upon the termination of the DPA and/or the Agreement for any reason whatsoever or upon the Company’s first written request, by the earliest, the Processor and anyone on its behalf, including Processor’s sub-processors shall immediately cease all processing of the Personal Data and return to the Company and/or destroy all the Personal Data of any kind whatsoever that is in their possession, as well as all copies thereof, unless (i) applicable law or competent authority requires Contractor to retain it or (ii) for proof of action, compliance and legal purposes.
      14. Without derogating from the Company’s liability to provide with lawful instruction under applicable law, Processor shall inform the Company if in its opinion, a request or instruction made by them infringes applicable law.
      15. Data Subject Requests. The Processor undertakes to notify the Company as soon as possible and no longer than 24 hours after receiving any request by a Data Subject or any other request regarding the Company’s obligations under Data Protection Laws and/or its Personal Data processed by the Processor. The Processor will provide reasonable cooperation and assistance to the Company to ensure an appropriate and lawful response to any complaint, communication, or request from a Data Subject or other, including responding and fulfilling the request subject to written authorization and instructions from the Company, if the Personal Data involved is processed by the Processor. 
      16. Data Breach. The Processor will notify the Company as soon as it becomes aware of a data breach which may involve the Confidential Information, including a Personal Data Breach. The Processor shall provide the Company with required support and cooperation to assist it in complying with its legal obligations in case of any type of data breach.
  • The Parties agree that they will not inform any third party that the Company and/or the Contractor have been involved in a data breach without the other party’s prior consent, unless obligated to do so by applicable Law.
  • The Processor warrants and represents that it has a security incident response plan which includes procedures for actual or suspected security breach, loss, damage, or any other incident which may compromise the Company’s Personal Data.
  • The Company’s information systems to which the Processor and anyone on its behalf may have access, the data subject categories and types of Personal Data that the Processor may process and the types of processing or operations that the Processor is entitled to perform are detailed under Schedule A to this DPA.
  • Audit. The Company shall be entitled to inspect and audit the activity of the Processor, under a prior written notice unless the audit is required by a competent authority or following a data breach, in connection with such events and/or Processor’s compliance with the terms of the DPA, the Agreement and Data Protection Laws. The Contractor shall assist in good faith and fully cooperate with such audits.
  • Insurance. The Processor shall purchase and maintain throughout the term of the Agreement or for as long as it retains Confidential Information professional liability insurance policy, with provisions to cover the liability of the Processor for breaches of its obligations and duties hereunder.
  • Liability. The Contractor shall be liable for losses or damages caused to the Company, to the extent that such loss, damage, or expense are caused by any breach by the Contractor, or any other person acting on Contractor’s behalf, of any of its obligations under this DPA. The Contractor will indemnify and keep the Company harmless from all losses, claims (including third party claims), demands, actions, suits, proceedings, or judgments, including costs, expenses and reasonable legal fees assessed against the Company arising, in whole, from a breach of the terms of this DPA. In no event shall the Contractor’s total aggregate liability, in contract, tort (including negligence or breach of statutory duty), misrepresentation, restitution or otherwise, arising out of or in any way connected with the use of, misuse, inability to use, or the reliance upon, the services and/or otherwise in connection with this DPA, exceed the total services fees paid by the Company for the services during the 12 months period preceding the date on which the claim leading to liability arose. The foregoing liability and indemnification obligations shall survive the termination of the Agreement.
  • Company will indemnify, defend, and hold Contractor harmless against any claim, demand, suit or proceeding (including any damages, costs, reasonable attorney’s fees, and settlement amounts) made or brought against Contractor by a third party alleging that Company’s Personal Data received by Contractor from Company or processed by Contractor in accordance with Company’s instructions, is in breach or violation of applicable Law. The foregoing liability and indemnification obligations shall survive the termination of the Agreement.
  • Notice. Any notice or other communication to be provided by the Processor or the Company to the other, under this DPA, shall be provided in accordance with the notices provision of the Agreement under which the Processing of Personal Data is carried out. 

Schedule A

  1. Data subject categories:
    The Contractor is entitled to process the following data subject categories (or as otherwise set in accordance with the Agreement):

 

  1. Types of personal data:
    The Contractor is entitled to process the following types of Personal Data or as otherwise set in accordance with the Agreement):

 

  1. Purpose of processing and processing operations: 

The nature and purposes of the processing is as set in the Agreement, and in accordance with the Law, and may include:

 

  1. Information Systems:

In the event that processing of Controller’s personal data will be performed by Contractor (or its authorized persons) by remote access, the Contractor shall be entitled to access the Company systems set forth in the Order Form.

 

Schedule B

 

  1. Security measures 
    1. The Processor undertakes to maintain appropriate security measures, in accordance with the level of sensitivity, scale and scope of the Personal Data and its processing activities, which will aim to prevent Security Incidents and for protection against unauthorized access and/or penetration to the Personal Data and against software which is capable of corrupting or damaging the Personal Data. Such measures will be implemented while considering the state of art, the costs of implementation and the nature, scope, context, and purpose of the processing as well as the risk of varying likelihood and severity for the rights and freedoms of the applicable data subjects, and at the minimum as required under Data Protection Law and the common relevant practice.
    2. Access to the Personal Data by Processor’s personnel shall be by means of a sufficiently strong password, which the permitted user shall change at least once every six (6) months or otherwise use a multi-factor authentication (MFA). Each such user shall hold a username and password which are exclusively for him and shall not make use of another party’s username. 
    3. The Processor shall conduct, internal and external audits to examine the security of Personal Data, by a body or person with the appropriate training and knowledge in this subject. 
    4. The Processor shall make a list and map all the components of the computer systems used and related to the operation of the information system containing Company’s Personal Data, including, but not limited to – computer equipment and communication equipment (the hardware components) if relevant and including the applicable computer software (the software components). 
    5. The Processor undertakes to assure that all and any Personal Data transfers, via web or other, shall be secured and encrypted at all times. 
  2. Procedures 
    1. The Processor undertakes to assess and define its processing operations of the Personal Data, the nature scope and context of the Personal Data, the level of sensitivity of the Personal Data, the risks associated with processing of the Personal Data and the damages which may be caused to data subjects due to a Security Incident. The Processor therefore undertakes to prepare a binding internal document containing, with respect to the Personal Data, the following:
      1. Description of the various types of Personal Data included; 
      2. The permitted purposes of use of the Personal Data; 
      3. Details regarding the transferring of the Personal Data or the use of the Personal Data, the purpose of transfer, country of destination, manner of transfer and the identity of the transferee;
      4. The main risks of damage to the integrity of the Personal Data and manner of dealing with them, including cancellation of the access permissions, procedures for reporting to the Company and other immediate steps;
      5. Instructions regarding the use of portable devices in connection with computer systems holding the Personal Data, in accordance with the provisions below.  
    2. Processor shall record events raising a suspicion of Security Incidents, damage to the integrity of the Personal Data, or of unauthorized use thereof. 
    3. The Processor shall determine the manner of giving access permission to the Personal Data, on a need to know basis. In addition, an up-to-date record must be kept of users permitted to access the Personal Data, in accordance with this DPA and the Agreement. 
    4. The Processor shall keep an up-to-date document of the structure it has connecting with the Company’s Personal Data, which will enable it to identify weak points and risks. The document shall contain the following details:
      1. Full details of the infrastructures and hardware systems which the Processor uses and type of communication and Personal Data security components, all as used in connection with the Company’s Personal Data;  
      2. The software used by the Processor for performing the Services, managing the Personal Data transferred to it, monitoring it and securing it.  
      3. Software and interfaces used for communication to the Processor’s computer systems relevant to the Personal Data and from such systems outwards. 
      4. A diagram of the network in which the Personal Data access is operating, including a description of the connections between the different system components and the physical location of these components;  
      5. The date of the last update of said document. 
    5. The aforesaid document shall be kept in such a manner that details from it shall be given to authorized persons only and only to the extent necessary, including but not limited to the purpose of audits. 
  3. Separation of databases 

The Processor shall establish rules for separation between the systems which enable access to the Personal Data and other systems used by the Processor in the course of its business. 

  1. Access permissions
    1. Before the Processor grants access permissions to the Personal Data or changes the scope of the permission given to its personnel, it shall make sure that the holder of the permission is suitable for receiving access to the Personal Data. The examination shall be carried out by the customary means in employee recruitment procedures.  
    2. The Processor shall give its personnel training about the applicable provisions of the Data Protection Law and provide them information regarding their duties according to the Data Protection Law before it grants access permissions.
    3. Ensure that personnel authorized to process the Personal Data have committed themselves to confidentiality under written and signed documents The access permission shall be given in accordance with the definitions of each personnel’s function, to the extent required for performance of that function and according to the Agreement and the DPA. 
    4. Access permissions to Personal Data, for personnel who is no longer employed by the Processor, shall be cancelled immediately. 
    5. The Processor undertakes to continuously document connection of portable devices to the systems containing the Personal Data, in such a manner that it will only be possible to connect and use these devices when authorized in advance, and not to allow downloading of the Personal Data, belonging to Company or arising from the Agreement, to portable devices.  
  2. Transfer of Personal Data 

Transfer of the Personal Data to portable devices shall be carried out by use of commonly used encryption and protection methods so that copying of the Personal Data to/on portable devices shall be done in a manner which serves as a reasonable measure to prevent misuse of stolen or lost devices.  

  1. Supervision and training 

The Processor shall give its personnel engaged in the processing of the Personal Data, periodic training (at least once every 12 months) about the security procedures and the obligations imposed on them by the Data Protection Law. 

 

Request a Demo