PIANO MASTER SERVICES AGREEMENT
TERMS AND CONDITIONS

DEFINITIONS

“Affiliate” means any entity which directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control”, for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.

“Client Data” means all electronic data or information submitted by Client to the Services, whether that data or information is submitted by Client, Authorized Users, or general public users of the Network. Client shall be responsible for (a) Client’s and Users’ use of the Services, and (b) the appropriateness and legality of all Client Data.

“Network” means the network of websites or web services operated by Client, and Authorized Users, and used in connection with the Services, including but not limited to the Client’s own website, or web services, and third-party web sites or web services that directly or indirectly are using the Services.

1.      SERVICES. 

(a) Services.  Piano agrees to provide Client with content monetization services on a hosted basis, using Piano’s software as a service platform as it may be revised from time to time ("Software") including any customizations of the Software, reporting services, training, support, and/or consulting services (collectively, the “Services”) in accordance with this Agreement and as described in any executed software schedule (“Software Schedule”) or executed Statements of Work to this Agreement (“SOW”) in the form attached hereto. SOWs, Software Schedules, Order Forms, and any other attachments or exhibits to this Agreement are collectively referred to in this Agreement as “Schedules,” and are all hereby incorporated into this Agreement.  Each Schedule is subject to the terms and conditions of this Agreement, unless otherwise expressly stated therein, and shall include any terms and conditions that are specific to the Services identified therein.

(b) Schedules. To the extent applicable, each Schedule may include: (i) a description of the Software and Services; (ii) Client’s websites and/or mobile applications for which the Services will be provided (“Websites”): (iii) a description of the parties’ respective responsibilities; (iv) fees and payment terms; and (v) names and contact information of Piano and Client contacts. 

(c) Deliverables. The term “Deliverables” means all works of authorship, programs, code, processes, tools, reports, manuals, supporting materials, drawings, diagrams, flowcharts, and concepts which are created by Piano specifically for Client during the Term of this Agreement and described in a Schedule, along with any unique documentation created for Client related to any of the foregoing. During the course of Piano’s performance of Services under any Schedule, Client may request changes in the Software or Services (including the addition of other Websites). Piano will incorporate such changes, provided the parties mutually agree to the changes and execute a change order or new Schedule, signed by both parties, setting forth the amended scope of work and any changes in Websites, Software, Services, scheduled completion dates or applicable fees.

(d) Acceptance of Deliverables for Consulting Services. Services may be performed on either a time-and-materials basis or a fixed-cost basis, as specified in the applicable Software Schedule or SOW. Services performed on a time-and-materials basis shall be deemed accepted upon performance. If a Software Schedule or SOW specifies Deliverables provided on a fixed-cost basis, such Deliverables shall be subject to Client’s review and acceptance, which shall not be unreasonably withheld, delayed or conditioned and may only be withheld for material verifiable non-conformity to the specifications set forth in the applicable Software Schedule or SOW and this Agreement.

2.      CLIENT OBLIGATIONS. In addition to obligations set forth elsewhere in this Agreement, Client shall have the following obligations hereunder.

(a) General. Client agrees (i) to make available, at Client’s expense, any and all Client personnel reasonably necessary to provide information required by Piano to complete any of the Deliverables or provide the Services, and (ii) to the extent specified in a Schedule, to request and facilitate, at Client’s expense, the participation, as necessary, of any third-party vendors, solution providers, or other resources acceptable to Client, if any.  Client further agrees to allow Piano reasonable access to Client’s relevant information and materials as requested by Piano to enable Piano to provide the Deliverables and the Services, and access to Client’s systems, software and databases as reasonably requested to enable Piano to provide the Services and the Deliverables.  Client acknowledges and agrees that Piano’s ability to provide the Services and the Deliverables in accordance with the terms of this Agreement is dependent upon and subject to Client’s timely performance of its obligations under this Agreement and each Schedule. Client acknowledges further that Piano acts as a mere technological carrier and is not responsible for the content of Client Data or for evaluating the appropriateness of the Client Data in relation to the environment where such data are disclosed or published.

(b) Notification. Client shall immediately provide written notification to Piano of (i) any use of the Software or Services through any of Client's Websites or facilities by anyone other than Client’s employees, authorized agents, or other individuals Client has authorized to access and use the Software or Services on Client’s behalf (“Authorized Users”), or (ii) the actual or suspected disclosure, whether deliberate or accidental, of any usernames, passwords, URLs, or other access to information required for use of the Software or Services, to anyone other than Authorized Users who have a need to know such information.

(c) Translation. Client, at Client's sole discretion, may use Piano Software to present various email messages, alerts, interfaces and messages to Client’s online users. Piano provides translations of its administrative dashboard and End-User Communications for Client’s benefit in English, German, French, Spanish, and Portuguese, but makes no warranty regarding the accuracy or suitability of those translations. If deemed necessary by Client, Client shall be responsible for editing and/or translating any End-User Communications at Client’s sole expense.

(d) Legal Compliance. Client shall be responsible for ensuring that its use of the Software and Services is in compliance with all applicable laws, rules and regulations of the countries in which Client’s users are located (“Applicable Law”). In the event that, as part of this Agreement, either party collects personal data (as defined in EU Regulation No. 2016/679, the General Data Protection Regulation (the “GDPR”)) from data subjects located in the European Economic Area pursuant to this Agreement, the Data Processing Agreement (“DPA”) pursuant to GDPR Article 28 and attached hereto as Exhibit B shall apply. Client will also ensure that its use of the Service is in compliance with Applicable Laws, to the extent such laws differ from the laws of the U.S. or the GDPR.

(e) Taxes. If applicable, Client will collect applicable sales tax, VAT, or other tax ("Tax") from each subscriber making a purchase through the Service on Client's Websites where required by applicable laws and remit any Tax due to the appropriate tax jurisdiction(s), file all applicable documents, retain copies of any relevant documents in determining Tax calculations, and handle and address any inquiry by any jurisdiction regarding Tax on the purchase.

3.      FEES AND PAYMENT TERMS.

(a) Fees shall be as set forth in the applicable Schedule. Unless otherwise stated in a Schedule, Client will pay all undisputed amounts within thirty (30) days of the date of the applicable invoice. If Client disputes any invoiced amount in good faith, Client will notify Piano in detail in writing as to the nature of the disputed charges and the reason for Client’s disagreement prior to the due date of the applicable invoice or Client’s right to dispute such invoice shall be waived and Client will pay all undisputed charges on the applicable invoice by their due date. Piano will respond by providing documentation in reasonable detail for the disputed charges. The parties will make all reasonable attempts to resolve the dispute in good faith and as amicably as possible within thirty (30) days. 

(b) Client shall pay Piano all fees that are owed under this Agreement even if Client has not received payment from the transactions utilizing the Software and/or the Services. Except as otherwise specified in this Agreement or in any Schedule, (i) fees are payable based on Software or Services purchased and not actual usage, (ii) payment obligations are non-cancelable and, except as expressly provided herein, fees paid are non-refundable, and (iii) the agreed fee amount cannot be decreased during the relevant term stated in a Schedule.

(c) If fees owed to Piano are based on revenue share, Piano will issue to Client a report generated by Piano from Client’s traffic and click-through data that include total numbers for a given time period and any aggregated calculations on revenue or conversion data (a “Royalty Report”) on a monthly basis. Client shall have five (5) business days after receipt of such Royalty Report to dispute any amounts owed to Piano. If Client fails to dispute a Royalty Report within such time period, Client is deemed to have agreed to the amount owed to Piano and Client’s right to dispute that invoice shall be waived.

(d) All payments due to either party hereunder shall be net of any bank or wire fees, delivered or mailed to the address listed for notices herein or wired to an account specified in writing by the party to which payment is due. Except as expressly stated in a Schedule, there will be no other fees owed (including to any third parties for any third-party components that may be included within the Software) by Client hereunder. All fees shall be payable in USD.  Payments to Client, if applicable, shall be submitted to the address/account indicated in the Schedule. Payments to Piano shall be submitted to the account / address set forth on the relevant invoice.

(e) Client shall be deemed in default of this Agreement if any undisputed invoiced amounts remain unpaid thirty (30) days after the invoice due date.  Late payments by Client will be subject to late fees at the rate of one and one-half percent (1.5%) per month, or, if lower, the maximum rate allowed by law, determined and compounded daily from the invoice due date until such invoice is paid in full.  If Client is in default of this Agreement, Piano may, without limiting its other rights and remedies under this Agreement and/or applicable laws, accelerate Client’s unpaid fee obligations under this Agreement including all Schedules and suspend the provision of the Software and/or Services, without penalty or liability to Piano, upon notice to Client. Suspension of the Software and/or Services shall not release Client of its payment obligations under this Agreement. If Client is in default of its payment obligations, Client shall be liable for any and all reasonable costs incurred by Piano in order to collect the overdue amounts. 

(f) Fees charged to Client hereunder do not include any local, state, federal or foreign taxes, levies or duties of any nature, including value-added, sales use or withholding taxes ("Taxes"). Client is responsible for paying all Taxes, excluding only taxes based on Piano's income. If Piano has the legal obligation to pay or collect Taxes for which Client is responsible under this Section, the appropriate amount shall be invoiced to and paid by Client unless Client provides Piano with a valid tax exemption certificate authorized by the appropriate taxing authority. Client will pay any additional taxes as are necessary to ensure that the net amounts received by Piano, after all such taxes are paid, are equal to the amounts that Piano would have been entitled to in accordance with this Agreement as if the taxes did not exist.

(g) Piano reserves the right to increase the fee for a renewal of any Schedule (a “Renewal”) in accordance with industry standards, on an annual basis by giving Client ninety (90) days written notice prior to the expiration of such Schedule. If Client objects to the increase and Piano and Client, negotiating in good faith, cannot mutually agree on a fee amount for a Renewal, then Client may terminate such Schedule by giving Piano sixty (60) days written notice prior to the expiration of the term of such Schedule. Any such termination shall be effective on expiration of the then current Schedule term. Client acknowledges that expiration of any discount or incentive programs which Client has previously received does not constitute a fee increase.

4.      OWNERSHIP OF INTELLECTUAL PROPERTY.

(a) Piano Intellectual Property.

(i)      Pre-Existing Piano Intellectual Property. The parties agree that Piano shall exclusively own and retain all “Piano IP”, defined as follows: (A) the Software, and all modifications thereto and future versions thereof; (B) all works of authorship, programs, code, processes, tools, reports, manuals, supporting materials, drawings, diagrams, flowcharts, and concepts, any of which existed prior to the Effective Date of this Agreement, whether created by or for Piano (“Pre-Existing Materials”), including but not limited to the proprietary technology offered at Piano.io (and other sites operated by Piano) and other applications; (C) Piano’s business, templates, documents, materials, technology, software, source code, website(s), modifications, updates and enhancements; (D) any and all works of authorship, programs, code, processes, tools, reports, manuals, supporting materials, drawings, diagrams, flowcharts, and concepts that are developed by Piano (except Deliverables); and (E) all copyrights, trademarks, service marks, trade secrets, patents, patent applications, moral rights, contractual rights of non-disclosure or any other intellectual property or proprietary rights, however arising, throughout the world (collectively “Intellectual Property Rights”) with respect to any and all of the foregoing as set out in subsections (A) - (D).

(ii)     Feedback.  In addition, the parties acknowledge that Piano may continue to modify its Software and Services, and that Client may make requests or suggestions to Piano for changes or additions to the Software or Services (“Feedback”).  The parties agree that any modifications or enhancements to the Software or Services, regardless of whether they are derived from or related to Feedback shall also be Piano IP unless stated otherwise in a separate SOW between the parties.

(iii)    Assignment of Intellectual Property Ownership. To the extent Piano is not automatically deemed to be the author, inventor or owner of any Piano IP, Client agrees to assign and hereby assigns, all right, title and interest it may have in any Piano IP to Piano and agrees to execute all documents necessary to effectuate Piano’s full ownership in and to all Piano IP.  Client appoints Piano its attorney in fact to execute such documents.  This appointment is coupled with an interest and is therefore irrevocable.

(b) Data Rights.  The following data rights shall be applicable to this Agreement:

(i)      “Personal Data” consists of any personal information relating to an identified or an identifiable end-user within the meaning of Article 4(1) of the GDPR, such as name, email address, phone number, financial data, the specific content accessed, time and duration of the visit, offer conversion and/or interaction data, referring site, or other information relating to such natural person collected through the Service whether via cookies or other tracking technologies, the Service’s functionality, or otherwise. Personal Data will be owned by Client.

(ii)     “Non-Personal Data” consists of information other than Personal Data, whether collected via cookies or other tracking technologies, the Service’s functionality, or otherwise, on an anonymous basis in cases without means reasonably likely used by the parties to identify a natural person to whom such data relates. Non-Personal Data will be owned by Client, subject to the exceptions described below.

For the purposes of enriching the Service, Client hereby grants Piano a royalty-free license during the Term to access, reproduce, display, and create reports or other derivative works including on the basis of the Personal Data and/or Non-Personal Data, in an anonymized format only (“Reports”) and to distribute such Reports during the Term to third parties only when the Reports contain aggregated anonymous data in accordance with Article 89 of the GDPR. Any such Reports created by Piano shall also be provided to Client.

(iii)    Piano shall adhere to the DPA attached as Exhibit B hereto and made a part hereof. If and to the extent of an express and direct conflict between the terms of this Section 4(b) and the DPA in Exhibit B, the terms of this Section 4(b) shall apply.

(c) Client Intellectual Property.  Client exclusively owns and retains all right, title, and interest in and to (i) its business, technology, trademarks, and websites and all other Intellectual Property Rights in materials that are developed and owned by Client; (ii) any and all works of authorship, programs, data, code, processes, tools, reports, manuals, supporting materials, drawings, diagrams, flowcharts, and concepts that Client develops independently of any collaboration with Piano, and that are not derived from or that do not directly relate to the Services, Pre-Existing Materials or any other Piano IP, and that relate to Client’s Websites, properties or data; and (iii) any and all content or data delivered into or stored into the Software by Client (or its users), subject to the data rights described in Section 4(b) above or in any Schedule (collectively, “Client Materials”).  Client exclusively owns and retains all Intellectual Property Rights, title, and interest in and to each of the Client Materials, subject to the rights and licenses granted in this Agreement or a Schedule.  Client grants to Piano a non-exclusive, fully-paid license to use, reproduce, and prepare derivative works of the Client Materials for purposes of performing the Services and creating Deliverables for the Term of this Agreement.

(d) Deliverables.  Client shall own the entire right, title and interest in any Deliverables. Piano agrees to assign and hereby assigns, all right, title and interest it may have in any Deliverables to Client. Piano agrees to execute all documents necessary to effect Client's full ownership in and to all Deliverables. For purposes of clarity, the Client Deliverables do not include Piano IP or any Open Source Software.

5.      CLIENT RIGHTS.

Piano grants Client a non-exclusive, non-transferable (except as set forth herein), limited license to use the Piano IP in accordance with the terms of this Agreement and each Schedule, and only for the purpose of utilizing the Services and any Deliverables. Except as otherwise expressly provided in this Agreement, no other license or right shall be deemed granted or implied with respect to the Piano IP.  Except as otherwise expressly allowed in this Agreement, Client shall not (i) use, distribute, sell, sublicense or disclose any of the Piano IP without written authorization of Piano; or (ii) reproduce, modify, prepare derivatives of, reverse assemble, reverse compile or otherwise reverse engineer the Piano IP.  Nothing herein will be construed as granting Client, by implication, estoppel or otherwise, any license or other right to any Intellectual Property Rights of Piano or its licensors except for the rights and license expressly granted herein. Piano and its licensors retain all rights not so granted.

6.      CONFIDENTIALITY.

(a) As used herein, the term “Confidential Information” shall mean all non-public information disclosed either before or after the execution of this Agreement, whether written or oral, that is designated as confidential or that, given the nature of the information or the circumstances surrounding its disclosure, reasonably should be considered as confidential. Confidential Information shall include Piano IP, Client Materials, Personal Data, the terms of this Agreement (including Schedules), and other information deemed proprietary or confidential by the party disclosing the Confidential Information (the “Disclosing Party”), and all record-bearing media containing or disclosing such information. For the avoidance of doubt, Piano’s Confidential Information shall include the Piano IP and Client’s Confidential Information shall include Client Materials, Personal Data and Non-Personal Data.

(b) A party receiving Confidential Information (the “Receiving Party”) shall not directly or indirectly, at any time, without the prior written consent of Disclosing Party, use or disclose Confidential Information or any part thereof other than necessary for the performance of that party’s obligations under this Agreement. Receiving Party agrees to and shall take all necessary steps to protect the confidentiality of Confidential Information.

(c) The term Confidential Information does not include information which: (i) has been or becomes published and publicly available or is now, or in the future, in the public domain without breach of this Agreement or breach of a similar agreement by a third party; (ii) prior to disclosure hereunder, is properly within the legitimate possession of Receiving Party which can be verified by independent evidence; (iii) subsequent to disclosure hereunder, is lawfully received from a third party having rights therein without restriction of third party’s or Receiving Party’s rights to disseminate the information and without notice of any restriction against its further disclosure; (iv) is independently developed by Receiving Party without use of or reference to such Confidential Information which can be verified by independent evidence; or (v) is disclosed pursuant to a requirement of a governmental entity or the disclosure of which is required by law, subject to Section 6(d) below.

(d) If Receiving Party is requested by a court, governmental entity or other third party to disclose any Confidential Information, it will promptly notify Disclosing Party (to the extent permitted) to permit Disclosing Party to seek a protective order or take other appropriate action.  Receiving Party will also reasonably cooperate (at Disclosing Party’s sole cost and expense) in Disclosing Party’s efforts to obtain a protective order or other reasonable assurance that confidential treatment will be afforded Confidential Information and shall only disclose the part of Confidential Information as is required by law to be disclosed and Receiving Party will use its reasonable efforts to obtain confidential treatment therefor.

(e) Confidential Information shall not, without the prior written consent of Disclosing Party, be disclosed to any person or entity other than employees or agents of Receiving Party who need to know Confidential Information and, in those instances, only to the extent justifiable by that need.  Receiving Party shall ensure that all such entities and personnel comply with the terms of this Agreement.  Receiving Party shall be responsible for any breach of this Agreement by its employees and/or agents and by any other person to whom Receiving Party has disclosed Confidential Information.  The foregoing will not be deemed to prevent Piano from disclosing anonymized Non-Personal Data when aggregated with similar information it has received from its other customers, such that the Non-Personal Data is not traceable to Client.

(f) Receiving Party shall notify Disclosing Party as soon as reasonably possible, and cooperate with Disclosing Party, upon Receiving Party’s discovery of any loss or compromise of Confidential Information.

(g) Except as otherwise expressly set forth herein, Receiving Party acknowledges that Confidential Information is the exclusive property of and belongs solely to Disclosing Party and shall not claim otherwise for any purpose.

(h) Receiving Party agrees to return to Disclosing Party, destroy and/or permanently delete, at Disclosing Party's discretion, and confirm in writing the destruction, permanent deletion and/or return, all written, tangible or otherwise accessible material in any form (including electronic media such as computer diskettes, CD-ROM, electronic copies or any material resident in the hard or external drive of any computer) containing or reflecting any Confidential Information (including all copies, summaries, excerpts, extracts or other reproductions) promptly following Disclosing Party’s request, provided, however, that subject to its ongoing obligation to maintain the confidentiality of such materials, Receiving Party may retain one copy of the Confidential Information for Receiving Party’s legal files for compliance and regulatory purposes and need not purge electronic archives and backups made in the ordinary course of business.

(i) In addition to any other rights and remedies available to Disclosing Party hereunder or at law, Receiving Party acknowledges and agrees that due to the nature of Confidential Information its confidentiality obligations to Disclosing Party hereunder are of a unique character and agrees that any breach of such obligations may result in irreparable and continuing damage to Disclosing Party for which there may be no adequate remedy in damages.  Notwithstanding anything to the contrary in this Agreement, Disclosing Party may seek injunctive relief, without the necessity of posting a bond or other security, even if otherwise normally required, and/or a decree for specific performance, and such further relief as may be proper from a court with competent jurisdiction.

7.      TERM AND TERMINATION.

(a) Term. Unless earlier terminated in accordance with the rights set forth in this Agreement, the term of each Schedule shall be as set forth in such Schedule (“Term”).  This Agreement shall commence as of the Effective Date and remain in effect until all Schedules containing a specific Term have been terminated. The termination of any Schedule shall not automatically cause the termination of any other Schedule or of this Agreement, except as otherwise set forth in Section 7.(b) nor shall it relieve either party of any claims which the other party may have against it relating to this Agreement or impact the obligations of the parties under any other Schedule not terminated.

(b) Termination. Either party may terminate this Agreement or any Schedule upon written notice of termination if the other party: (1) defaults in the performance of any material requirement or obligation created by this Agreement, or breaches any material provision of this Agreement, which default or breach is not cured within thirty (30) days following the defaulting party’s receipt of written notice of default or breach; (2) ceases doing business in the normal course; (3) is the subject of any state or federal proceeding (whether voluntary or involuntary) relating to its bankruptcy, insolvency or liquidation that is not dismissed within ninety (90) days; (4) makes an assignment for the benefit of creditors or a receiver is appointed for a substantial part of the other party’s assets or (5) for a period exceeding thirty (30) days, fails to fulfill its obligations under this Agreement by reason of a Force Majeure Event. 

Upon termination of this Agreement as set forth above, all Schedules to this Agreement shall also immediately terminate. However, termination of a Schedule shall not relieve Client of its obligation to pay to Piano (or allow Piano to retain from end-user payments it collects on Client’s behalf hereunder) fees and other sums that have accrued for Services rendered. For any termination of a Schedule or this Agreement, Client shall receive a refund from Piano of any prepaid and unused payments as of the effective date of termination.   

(c) Effects of Termination; Survival.  Upon termination of this Agreement, all rights and licenses granted hereunder shall cease, except as otherwise provided in this Agreement. Those provisions of this Agreement which, by their nature, are meant to survive termination shall so survive, and include without limitation provisions related to ownership of intellectual property, confidentiality, indemnification, limitation of liability, warranties and representations, governing law and venue, and payment (to the extent such payments were earned during the Term of this Agreement).  Notwithstanding the termination of this Agreement for any reason, neither party shall be relieved of any duty, obligation, debt or liability that arose or accrued prior to the termination of the Agreement or Schedule. Except in the event Client terminates the Agreement under Section 7 (b), Client will pay any unpaid fees payable under any applicable Schedule in effect prior to the termination date for the remainder of the relevant term of such Schedule.

(d) Return of Client Data:  Upon Client’s request made within thirty (30) days after the effective date of termination of this Agreement or any Schedule, Piano will make available to Client for download a file of Client Data. After such thirty (30) day period, Piano shall have no obligation to maintain or provide any of Client’s Data and may thereafter, unless legally prohibited, delete all of Client’s Data in Piano’s systems or otherwise in Piano’s possession or under Piano’s control.

8.      REPRESENTATIONS AND WARRANTIES.

(a) Each party warrants and represents at all times during the Term of this Agreement that: (i) it has the right and full power and authority to enter into this Agreement and each Schedule; (ii) it is duly organized and validly existing and in good standing under the laws of the state and country of its incorporation or formation; (iii) it is under no contractual or other legal obligation which shall in any way interfere with its full, prompt and complete performance hereunder; (iv) it will comply with all applicable laws in its performance of this Agreement. 

(b) Piano further represents and warrants that, (i) to the best of its knowledge the Services and Deliverables, do not infringe on any valid and enforceable Intellectual Property Right of any third party (provided that any indemnity related to a breach or alleged breach of this warranty will not be limited by a knowledge qualifier); (ii) all the Services performed hereunder will be rendered in a competent and professional manner; (iii) all Services shall materially conform to the specifications set forth in the applicable Schedule; (iv) neither the Software nor the Deliverables contain any Harmful Code; (v) Piano complies with all Open Source Software licenses embedded in its Software or otherwise used or incorporated in its Software and shall not cause Contamination of Client’s or Client licensor technology in performing its Services; and (vi) except as expressly stated in the Agreement or in a Schedule, there will be no additional third-party licenses or permissions necessary to obtain in connection with Client’s use of the Services under this Agreement.  For purposes of this Agreement, “Harmful Code” means any software or other materials that are intentionally designed to (a) disrupt, disable, harm or impede operation, or (b) impair operation based on the lapse of time, including but not limited to viruses, worms, time bombs, time locks, access codes or trap door devices. “Contamination” means that proprietary technology has become subject to the terms of an Open Source Software license under which downstream recipients or other third parties may claim the right to (a) copy, create derivative works of, or redistribute the proprietary technology, or (b) receive the source code of the proprietary technology.

(c) Client further represents and warrants that, (i) to the best of its knowledge, Client Materials do not infringe on, violate or misappropriate any valid and enforceable Intellectual Property Rights of any third party (provided that any indemnity related to a breach or alleged breach of this warranty will not be limited by a knowledge qualifier); (ii) to the best of its knowledge, it has secured any and all necessary intellectual property rights associated with the Client Data and the content that is made available to consumers through its Websites, (provided that any indemnity related to a breach or alleged breach of this warranty will not be limited by a knowledge qualifier); (iii) it has secured the requisite permission or consent to use the Client Data and provide it to Piano for processing, (iv) has secured that the Client Data does not contain any messages or images that are in violation of Applicable Laws, (v) it will use the Services in accordance with the terms and conditions hereof and Applicable Law; and (vi) it will not use the Services for purposes of segmenting, re-targeting, creating or supplementing user profiles or inventory profiles, creating, supplementing or amending interest categories, or syndication or other distribution to third parties, unless such data collection and usage are authorized by or on behalf of the data owner.

(d) Client acknowledges that from time to time, Client may be required to provide Piano with materials that may have been developed by third parties (collectively, “Third-Party Materials”).  Client represents that at the time it delivers any Third-Party Materials to Piano, Client has obtained the right to use the Third-Party Materials, and that Piano’s use of such Third-Party Materials will not infringe the Intellectual Property Rights of any third party.

(e) Except as otherwise expressly set out in this Agreement, Software is provided on an as-is basis. Piano will service the Software and/or the Services in accordance with the Service Level Agreement set forth in Exhibit A.  

9.      INDEMNIFICATION

(a) “Losses” means losses, liabilities, damages, fines, penalties, settlements, judgments, costs and expenses, including reasonable attorneys’ fees and expert fees, and interest (including taxes) arising out of a third-party claim. 

(b) Indemnity by Piano. Piano will indemnify, defend and hold harmless Client and Client’s officers, directors, employees, successors and assigns (the “Client Indemnified Parties”) from and against, any Losses suffered, incurred or sustained by a Client Indemnified Party or to which a Client Indemnified Party becomes subject, resulting from, arising out of, or relating to: (i) any breach or alleged breach by Piano of this Agreement (including Schedules) and/or any of its obligations and representations and warranties hereunder, or (ii) injury or death, or damage to any property caused by or arising from the negligent acts or omissions of Piano in connection with performance of the Agreement.

(c) Indemnity by Client. Client will indemnify, defend and hold harmless Piano, its subsidiaries, and the officers, directors, employees, shareholders, successors and assigns of each of them (the “Piano Indemnified Parties”) from and against, any Losses suffered, incurred or sustained by a Piano Indemnified Party or to which a Piano Indemnified Party becomes subject, resulting from, arising out of, or relating to: (i) any breach or alleged breach by Client of this Agreement (including Schedules) and/or any of its obligations and representations hereunder, or (ii) Client’s failure to pay and discharge any taxes (including interest and penalties) for which Client is responsible pursuant to the provisions of this Agreement.

(d) Remedies for Infringement. Should any Piano IP become or, in Piano’s opinion, be likely to become the subject of any infringement claim, Piano shall have the right, at its sole discretion and at its expense, to either procure for Client the right to continue using or receiving the Piano IP, replace or modify the Piano IP so it becomes non-infringing, or remove the questionable Piano IP. This Section 9 states Piano’s entire liability, and Client’s sole and exclusive remedy for Intellectual Property Rights claims relating to or arising out of any Piano IP, other than the indemnification obligations set forth herein should Piano forego this right. Piano shall have no obligation to Client for indemnification with regard to any claim of infringement to the extent that the Piano IP infringement claim or allegation is based on: (1) a modification made by an entity other than Piano or its designee; (2) a violation by Client of this Agreement; (3) the inclusion by Client of any Client Materials or Third-Party Materials in any Piano IP if the claim would not have arisen but for such modification, violation or inclusion of Client Materials or Third-Party Materials respectively.

(e) Indemnification Procedures. If any third-party claim is commenced against a person or entity entitled to indemnification under this Section (the “Indemnified Party”), notice thereof shall be given to the party that is obligated to provide indemnification (the “Indemnifying Party”) as promptly as practicable. The Indemnified Party will cooperate, at the cost of the Indemnifying Party, in all reasonable respects with the Indemnifying Party and its attorneys in the investigation, trial and defense of such claim and any appeal arising therefrom; provided, however, that the Indemnified Party may, at its own cost and expense, participate, through its attorneys or otherwise, in such investigation, trial and defense of such claim and any appeal arising therefrom. No settlement of a claim that involves a remedy other than the payment of money by the Indemnifying Party will be entered into without the consent of the Indemnified Party.

10.    WARRANTY DISCLAIMERS AND LIABILITY LIMITATIONS.

EXCEPT AS EXPRESSLY PROVIDED HEREIN, NEITHER PARTY MAKES ANY WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS OF THE SERVICES OR PIANO IP FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT.  

TO THE EXTENT BEYOND PIANO OR ITS LICENSORS’ CONTROL, WHETHER THE FOLLOWING IMPACT PIANO OR ANY OF ITS THIRD-PARTY SERVICE PROVIDERS, INCLUDING WITHOUT LIMITATION AMAZON WEB SERVICES, GOOGLE, PAYPAL, OR ANY OTHER THIRD-PARTY SERVICE PROVIDER NAMED IN THE SCHEDULES ATTACHED HERETO, PIANO AND ITS LICENSORS SHALL NOT BE LIABLE TO CLIENT OR ANY THIRD PARTY FOR ANY TECHNICAL MALFUNCTION, TELECOMMUNICATION OR INTERNET OUTAGES OR PROBLEMS, COMPUTER ERROR, CORRUPTION, INEFFECTIVENESS, LOSS OF INFORMATION, LOSS OF BUSINESS, LOSS OF DATA, LOSS OF COMMERCIAL REPUTATION, LOSS OF PROFITS OR OTHER ECONOMIC LOSS.

IN NO EVENT SHALL (A) EITHER PARTY BE LIABLE TO THE OTHER PARTY FOR INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, EVEN IF SUCH PARTY IS MADE AWARE OF THE POSSIBILITY OF SUCH DAMAGES, AND (B) NEITHER PARTY’S AGGREGATE LIABILITY FOR DAMAGES UNDER THIS AGREEMENT SHALL EXCEED AN AMOUNT EQUAL TO THE TOTAL SUM OWED OR PAYABLE BY CLIENT TO PIANO DURING THE TWELVE (12) MONTH PERIOD PRIOR TO THE DATE ON WHICH THE LIABILITY AROSE.

11.    DATA SECURITY AND TECHNICAL MEASURES. 

(a) Piano will provide the Services in compliance with all Applicable Laws (including without limitation those regarding data privacy and security and consumer protection) and the GDPR.

(b) If Client or its third-party service provider processes any credit card information using the Software and Services, Client (and/or such service provider, as applicable) shall: (i) comply with their responsibilities under the Payment Card Industry Data Security Standard (“PCI DSS”); (ii) implement and maintain reasonable security measures to protect all cardholder data in their possession or control; and (iii) not take any action in connection with using the Software and Services that places Piano in non-compliance with the PCI DSS (for example, storing any cardholder data in any custom fields of the Software and Services).

12.    MISCELLANEOUS.

(a) Notices. Notices, demands, requests, consents, or other communications required or permitted under this Agreement or any Schedule will be in writing and deemed duly served on or delivered (i) when delivered personally, (ii) when sent to the other party by certified mail, return receipt requested, (iii) when delivered by hand or sent by recognized overnight courier (with acknowledgment received by the courier), or (iv) sent by email (provided that email shall not be sufficient for notices of Termination or Indemnification), if the receipt is confirmed by the recipient.  Notices shall be delivered or sent to the parties at the respective addresses shown below or such other address as either party shall designate. 

TO PIANO: 
Piano Software, Inc.
Attn:          Chief Financial Officer
Address:  111 S. Independence Mall E, Suite 950, Philadelphia, PA 19106
Email:       cfo@piano.io

WITH A COPY TO: 
Piano Software, Inc.
Attn:          General Counsel
Address:  111 S. Independence Mall E, Suite 950, Philadelphia, PA 19106
Email:       legal@piano.io

TO CLIENT:

Notices to Client shall be addressed to the business contact designated by Client, and in the case of billing-related notices, to the relevant billing contact designated by Client. 

Notices of termination or indemnification claims shall be addressed as follows: Address of registered seat of Client, Attn.: CEO.

(b) Entire Agreement; Severability; Modification. This Agreement, including any Schedules, is the entire agreement of the parties, and supersedes all prior agreements and communications between the parties with respect to the subject matter of this Agreement, and represents the complete integration of the parties’ agreement.  In interpreting and construing this Agreement, the fact that one or the other of Piano or Client may have drafted this Agreement or any provision hereof shall not be given any weight or relevance, both parties having had an opportunity to review and negotiate the terms hereof.  If any provision of this Agreement shall be held invalid, illegal or unenforceable, the remaining provisions shall not be affected or impaired.  This Agreement may be modified only by a written agreement executed by an authorized representative of the party against whom the modification is asserted. 

(c) No Waiver. The failure of a party in any one or more instances to exercise any right or privilege arising out of this Agreement shall not constitute a waiver and shall not preclude it from requiring that the other party fully perform its obligations or preclude it from exercising such a right or privilege at any time.

(d) Independent Contractors.  Piano and the Client shall each act as independent contractors.  Nothing in this Agreement shall be deemed to create or construed as creating a joint venture or other relationship between the parties. Neither party shall have the authority, express or implied, to commit or obligate the other party in any manner whatsoever, except as specifically authorized from time to time in writing by an authorized representative of the party.

(e) Non-Exclusivity. Piano and Client each acknowledge that this Agreement is non-exclusive and that each of them reserves the right to engage in business with other persons. Each party acknowledges and agrees that the other party may, without limitation, accept agreements from or grant licenses to other persons, firms, corporations, or other entities, including entities that compete with the other party, for Services and products, on any terms that party deems appropriate.

(f) Assignment. This Agreement shall not be assigned or transferred in whole or in part by either party without the prior written consent of the other, provided that either party may assign this Agreement without prior written consent in connection with a public offering of its securities or in a sale or transfer of all or substantially all of its assets or equity to which this Agreement relates or by way of merger, consolidation, or similar transaction. Any purported assignment or transfer in violation of this Section shall be void.  Nothing in this Agreement shall be construed as permitting a trustee or purchaser in bankruptcy to assume this Agreement without the written consent of the other party.  Subject to the foregoing restrictions, this Agreement will bind and benefit the parties and their successors and permitted assigns.

(g) Force Majeure. Neither party shall be responsible for delays or failures in performance of this Agreement resulting from a Force Majeure Event.  Termination under this Section will not relieve Client of its obligation to pay for Services rendered prior to the date of the Force Majeure Event.  Piano will make commercially reasonable efforts to re-establish Services as soon as possible in the event of a Force Majeure Event. If any Force Majeure Event prevents a party from performing its material obligations hereunder for more than thirty (30) consecutive days, the other party may elect to terminate this Agreement or any Schedule upon written notice, with no further obligation to the other party other than payment for accrued but unpaid fees for Services rendered prior to the date of such Force Majeure Event.  “Force Majeure Event” means an event or circumstance which is beyond the control and without the fault or negligence of either party and which by the exercise of reasonable diligence neither party was able to prevent.  Such events include, but are not limited to, (a) riot, war, invasion, act of foreign enemies, hostilities (whether war be declared or not) acts of terrorism, civil war, rebellion, revolution, insurrection of military or usurped power, requisition or compulsory acquisition by any governmental or competent authority; (b) ionizing radiation or contamination, radioactivity from any nuclear fuel or from any nuclear waste from the combustion of nuclear fuel, radioactive toxic explosive or other hazardous properties of any explosive assembly or nuclear component; (c) earthquakes, flood, fire or other physical natural disaster, but excluding weather conditions regardless of severity; and (d) strikes at national level or industrial disputes at a national level.

(h) Marketing. Provided that at least three (3) clients are named, Piano shall have the right to use Client's name and logo in customer lists and other marketing materials.  Subject to Client's approval, which shall not be unreasonably withheld, Piano shall also have the right to issue a press release, case study and/or a testimonial, and develop marketing material related to any speaking engagements that the Client agrees to participate in on Piano’s behalf at industry events (live events, webinars, or video).

(i) Access to Client Websites. During the term of this Agreement or any Schedule, Piano staff shall have access to content on Client Websites.

(j) Compliance with Policies. Client will provide to Piano in advance, and Piano will use commercially reasonable efforts to ensure that its personnel or subcontractors comply with, Client’s written security and other regulations in any activities at Client sites or in connection with Client’s systems.

(k) Counterparts. This Agreement may be executed in several counterparts, each of which will be deemed to be an original, all of which, when taken together, shall constitute one and the same instrument. All signed facsimile or electronic (e.g. PDF document) copies of this Agreement shall be deemed valid as an original.

(l) Non-Solicitation. During the term of this Agreement and for twelve (12) months thereafter, neither party shall, directly or indirectly, on behalf of itself, a subsidiary, third-party or otherwise affiliated entity, knowingly hire or engage to hire any person who was an employee or sub-contractor of the other party at any time during the above-referenced period or knowingly solicit any such person to terminate or reduce the scope of their employment or business relationship with the other party. This clause does not prevent either party from employing any employee or sub-contractor of the other who responds to a published general advert not specifically targeted at such person.

(m) Merchant of Record: If applicable, Client shall act as the Merchant of Record for purposes of the Agreement and will comply with all applicable PCI and legal requirements.

(n) Insurance. Piano and Client will each maintain insurance protection covering each of their respective activities contemplated hereunder throughout the Term of the Agreement.  Piano currently maintains the following insurance coverage, in addition to other coverage: 

1. Commercial General Liability: $2,000,000 per claim, $4,000,000 aggregate
2. Errors & Omissions: $5,000,000 per claim and aggregate
3. Cyber Liability: $5,000,000 aggregate
4. Privacy Liability: $5,000,000 aggregate
5. Privacy Breach Notification: $1,000,000 aggregate
6. System Damage: $3,000,000 aggregate
7. System Business Interruption: $5,000,000 per occurrence and aggregate
8. Multimedia/Advertising Injury: $5,000,000 per claim and aggregate.

(o) Disputes and Governing Law. This Agreement will be governed and interpreted in accordance with the laws of the State of New York without reference to conflicts of laws principles. Disputes between the parties concerning this Agreement, or any amendment, Software Schedule, or SOW shall be resolved as follows:

1. The senior executives of Piano and Client shall have thirty (30) days in which to meet and attempt to resolve the dispute.

2. In the event that a business resolution cannot be reached, the parties agree to submit the dispute to formal mediation.

3. In the event that formal mediation fails to resolve the dispute, the parties agree to submit the dispute to binding arbitration, to be performed under the rules of the American Arbitration Association, where the venue for such arbitration shall be in New York, NY.

4. Exclusive jurisdiction and venue for actions or disputes arising out of or relating to this Agreement, or any amendment, Software Schedule, or SOW, that require immediate injunctive relief shall be in the state or federal courts located in New York, NY, and the parties hereby consent to the exclusive jurisdiction and venue of such courts for matters involving immediate injunctive relief.

5. In the event that either party brings an action to enforce or exercise its rights under this Agreement, or any amendment, Software Schedule, or SOW, including binding arbitration, the prevailing party in such action (meaning a party in whose favor judgment is rendered, regardless of the amount of damages awarded or whether the party receives less relief than was sought or even nominal relief, but limited to those circumstances where the fact-finder declares a winner and the court enters judgment in that party’s favor) shall be entitled to reimbursement for its reasonable attorneys’ fees and expenses incurred in connection with such action.

(p) Cumulative Remedies. Other than as expressly stated herein, the remedies provided herein are in addition to, and not exclusive of, any other remedies of a party under applicable laws.

13.    RULES OF INTERPRETATION.

(a) The term “including” (in all of its forms) means “including, without limitations” unless expressly stated otherwise.

(b) Any headings set forth in this Agreement are solely for convenience or reference and do not constitute a part of this Agreement, nor do they affect the meaning, construction or effect of this Agreement.

(c) All references to a number of days mean calendar days, unless expressly stated otherwise.

(d) The recitals and Schedules to this Agreement shall be deemed to be a part of this Agreement and are incorporated by reference herein.

(e) No documents exchanged or course of dealings by the parties shall be deemed to modify or amend any of the terms of this Agreement unless in writing and signed by an authorized representative of both parties.

(f) In the event of an inconsistency, ambiguity, contradiction or conflict between the terms of this Agreement, its Schedules, and any amendments to any of the foregoing, such documents shall be interpreted in the following order of precedence:  (i) the terms of any amendment to this Agreement shall take precedence, unless a Schedule expressly states that it overrides, (ii) followed by the terms of this Agreement, unless a Schedule expressly states that it overrides a specific provision of this Agreement, with reference to the provision of this Agreement that is to be overridden; (iii) followed by the terms of the Schedules to this Agreement.

                 

EXHIBIT A
Service Level Agreement

Piano will use commercially reasonable efforts to furnish support as follows:

1. As long as Client is current in payment of the fees set forth in any given Schedule, Piano will provide email support during the Term to Client for questions or problems with the use of the Services. The support will be available during the hours of 2:00 A.M. to 6:00 P.M. Eastern Standard Time on business days. After-hour emergency support is available (24/7 for Severity 1 as defined below) via email and the severity level response set forth below still applies.
2. Piano will make the Services available each calendar quarter, excluding periods of Maintenance Downtime, Third-Party Downtime, and Force Majeure Events at an uptime of 99.7% (the "Uptime Guarantee"). If the Services fail to be available for the amount of time set forth in the Uptime Guarantee, then Piano will issue a credit (the “Credit") equal to 1% of the quarterly License Fee for each one-tenth of one percent decrease in availability in the affected quarter. The total Credit will be capped at 100% of the License Fee for the quarter in which service is so affected. If the parties have a performance-based or revenue sharing agreement in place, any consideration due Piano as a result of that agreement shall not be considered as License Fees for the purposes of computing the Credit.
3. Client acknowledges and agrees that Piano may, from time to time, need to perform routine maintenance or repair of the Services or update the Software and that during such times of maintenance or repair ("Maintenance Downtime"), the Services may not be available for the Client's use. Piano shall endeavor to inform Client of such maintenance at least two (2) business days in advance and will perform maintenance on weekends between the hours of 12:00 A.M. Eastern Standard Time on Saturday and 5:00 P.M. Eastern Standard Time on Sunday for no more than ninety (90) minutes per month.
4. Client acknowledges that Piano relies on third parties, including but not limited to Amazon Web Services, Cloudflare, Google, Spreedly and several payment providers (a full list can be found at http://docs.piano.io/payment-providers), for providing its services. Client agrees that unavailability of third-party systems ("Third-Party Downtime"), (i) may affect the availability of the Software and/or the Services, (ii) is beyond the control of Piano, (iii) will not be part of computations regarding the Uptime Guarantee, and (iv) will result in no refunds or credits to Client.
5. Problem Response
   1. Definition and Classification of Problems.
      1. “Severity" is the assessed possible risk or effect of a problem with the Services. All notifications, escalations and standards for responding to problems are set by Severity.
      2. As used below, the term "Problem" shall mean any problem, inquiry or request. Problems shall be initially classified by Piano in accordance with the following Severity level classifications:
         1. Severity 1:
            1. The Services are causing the availability of the Client website or applications to be significantly affected;
            2. There is a complete outage of a critical service or a recurring temporary outage of a critical service;
            3. There is a security breach that exposes the personally identifiable information of Client customers; or
         2. Severity 2:
            1. Due to a problem with the Services, users are not able to properly purchase access for, or gain access to, Client content;
            2. The Services administrative applications (e.g. reporting, authoring, etc.) are unavailable;
            3. There is an error, bug, or issue with the experience of a subset of Client customers (e.g. transactional emails are not being delivered properly / some but not all Client customers are viewing unintended media, content, or messages); or
         3. Severity 3:
            1. Client is experiencing operational inconvenience caused by the Services;
            2. Client needs or expects different functionality or presentation of information than Piano currently provides;
            3. An individual user has reported a problem that has not been evidenced to be prevalent among Client customers.
      3. Upon becoming aware of any Problem (whether by notification or self-discovery), Piano shall promptly verify the problem and, if necessary, open a Trouble Ticket for such Problem. Upon verification, Piano shall promptly respond to Client and advise Client of the severity level classification assigned to such Problem by Client.

Severity Level Classification	Problem Response Time
Severity 1	Within 2 hours
Severity 2	Within 1 business day
Severity 3	Within 5 business days

6. Problem Escalation and Resolution

For Composer, VX, ID and ESP, Piano Support Team representatives are available to attend to Severity 1 and Severity 2 issues by email during Working Days/Hours at: support@piano.io

If Client requires support during non-Working Day/Hours they may use the following contact: support@piano.io

If Client requires escalation of a problem because:

• The Piano Support Team did not respond within the expected time; or
• The Problem is not being handled properly; or
• The Piano Support Team representative was communicating unprofessionally in any way, Client may use the Piano client services representative as escalation contact.

Client should then expect a response within a maximum of two (2) hours.

If Client experiences a Severity 1 disruption to its business which is believed to be related to the Piano platform, contact the on-call urgent response team by sending an email to urgent@piano.io, and cc the client services representative.  Include name and contact information and the Piano application ID for the affected property, along with any screen grabs or error message details describing the issue.  The operational lead of the on-call urgent response team will get back to Client within 30 minutes of the initial outreach.  If the issue has not already been resolved before that initial response, Client will receive periodic updates as they are available until the issue is resolved.

Piano recommends that Client subscribe to Piano’s status page to receive real-time system updates and status at http://status.piano.io.

For support on all other products, visit: the support website at http://support.cxense.com.

 

EXHIBIT B 
DATA PROCESSING AGREEMENT

 WHEREAS:

1. The Parties concluded the Agreement;
2. By provision of the Services pursuant to the Agreement, Piano will process personal data about the Users on behalf of the Client;
3. GDPR applies directly to the Client but also to Piano by virtue of having an establishment in the EU pursuant to the Article 3 of the GDPR;
4. The Agreement and this DPA foresee and allow Piano to use Piano Affiliates and Sub-Processors for the processing of personal data about the Users in accordance with conditions laid down in this DPA;
5. The Agreement and this DPA foresee and allow Piano to process personal data about the Users on a cross-border basis and/or outside the European Economic Area in accordance with conditions laid down in this DPA;
6. The Client shall only use data processors providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that processing will meet the requirements of GDPR while this DPA documents why the Client is satisfied with the guarantees provided by Piano;
7. Parties wish to explicitly agree on the scope and distribution of the obligations stemming from the GDPR mainly towards the Users as data subjects;

THEREFORE, PARTIES AGREED AS FOLLOWS:

1. Definitions. The terms used in this DPA shall be interpreted and construed in accordance with GDPR. Any terms defined in the Agreement shall have the same meaning if used in this DPA. As used in this DPA, the following terms shall have the following meanings:
   “Agreement” means the Piano Master Services Agreement Terms and Conditions concluded between the Parties;
   “Clauses” means standard contractual clauses approved by the Commission (Commission Decision C(2010)593) to safeguard the cross-border transfer of Personal Data between parties. The Clauses refer to the previous data protection regime under the Directive EU 95/46/EC;
   “Commission” means the Commission of the EU;
   “Conditions” means the following conditions: (i) Piano concludes a data processing agreement with Piano Affiliates and Sub-Processors ensuring that any processing of Personal Data is compliant with the terms and level of protection of Personal Data required under this DPA; (ii) the current list of all Piano Affiliates and Sub-Processors is made available and kept updated by Piano via https://piano.io/gdpr and Exhibit 1 to the DPA; (iii) the Personal Data will be only transferred to and processed only by Piano Affiliates and Sub-Processors located in the EEA, the United Kingdom (after the Brexit), the United States or third countries ensuring adequate level of protection according to the Commission’s decision or where applicable according to the equivalent decision under the UK law (after the Brexit); (iv) in case Piano Affiliates or Sub-Processors are located in the United Kingdom (after the Brexit) or the United States, cross-border transfer is made by Piano on the basis of EU standard contractual clauses or Commission’s adequacy decisions such as the EU-US Privacy Shield mechanism; (v) Client shall be entitled, upon written request, to receive copies of the relevant terms of internal Piano data processing agreement concluded between Piano and Piano Affiliates; (vi) Client may request that Piano audit Piano Affiliate or Sub-Processor or provide confirmation that such an audit has occurred (or, where available, obtain or assist Client in obtaining a third-party audit report concerning Piano Affiliate's or Sub-Processor's operations) to ensure compliance with such obligations, provided however that section 16.19 of this DPA applies mutatis mutandis; and (vii) Piano shall be liable for the acts and omissions of Piano Affiliates and its Sub-Processors to the same extent Piano would be liable if performing the services of each Piano Affiliate and Sub-Processor directly under the terms of this DPA, except as otherwise set forth in this DPA and/or in Privacy and Data Protection Requirements;
   “Client Data” means any and all data and information delivered by or on behalf of, or collected directly or indirectly from, Client, its affiliates, or their respective clients, customers and Users, including without limitation any such data or information collected via the Software and/or Service, which may include, without limitation, Credit Card Data (as defined in Section 17 below), Non-Personal Data or the Personal Data. For clarity, all Personal Data is Client Data but not all Client Data is Personal Data (Non-Personal data are not Personal Data);
   “EEA” means European Economic Area;
   “EU” means European Union;
   “European Economic Area” means all EU member states plus Iceland, Norway and Lichtenstein; 
   “Non-Registered Users” means non-registered users of Websites;
   “Piano Affiliates” means companies which are controlled by Piano where control refers to possession, directly or indirectly, of the power to direct or cause the direction of the management of an entity whether through ownership, voting rights, by contract or otherwise, a list of which is published at https://piano.io/gdpr and Exhibit 1 to this DPA and regularly updated therein;
   “Privacy and Data Protection Requirements” means the GDPR, ePrivacy Directive (2002/58/EC) and all applicable national laws and regulations relating to the processing of the personal data and privacy notified to Piano by Client;
   “Purposes” means purposes of processing of Personal Data determined by Client while such purposes are derived from the functionality of the Software, in particular: (i) audience experiences, i.e. the core processing activities undertaken for Client (i.e. Services) such as analysis of subscription performance, user trends, preferences, and segmentation and other processing which typically occurs in the course of Client’s use of the Software; (ii) billing and accounting purposes, i.e. service of processing payments and financial information in accordance with the applicable billing, accounting and tax laws; and (iii) other purpose of processing foreseen by the functionality of the Software; 
   “Registered Users” means registered users of Websites; 
   “Security Regulations” means reasonable security measures as requested by Client with respect to Piano’s physical access to Client’s facilities for performing Services and with respect to remote or virtual access, if applicable, to Client software, systems, data, information and materials;
   “Sub-Processors” means sub-processors that Piano uses to process the Personal Data, a list of which is published at https://piano.io/gdpr and Exhibit 1 to this DPA and regularly updated therein;
   “Users” means collectively Registered Users and Non-Registered Users;

As used herein, references to the “Services” shall mean the Software and/or the Services.

2. Subject-Matter. Piano shall provide the Services in accordance with the provisions of this DPA. Piano is entrusted and entitled to process Client Data in accordance with the provisions of the Agreement including this DPA. Parties wish to make any processing of Client Data that is subject to the GDPR compliant with the GDPR. For clarity, this DPA does not relate to any processing of personal data by the Parties, but only to the processing of the Personal Data in respect to the Agreement.
3. Duration and Termination. This DPA forms an inseparable part of the Agreement. It is impossible to provide Services in accordance with the Agreement without processing Client Data pursuant to this DPA. Therefore, this DPA can only be terminated by termination of the Agreement as its inseparable part. Upon termination or expiration of the Agreement, Piano shall at the choice of the Client either return or securely delete all Client Data, unless there is a requirement to store such data under the EU or the EU member state law that applies to Piano or Piano Affiliates.
4. Nature of Personal Data Processing. The nature of Personal Data processing under this DPA is determined by the nature of Services provided by Piano and the functionality of the Software. The Software is designed to help digital content companies to drive page views, engagement, and registrations, decrease ad blocking, and sell or otherwise grant access to premium content. The nature of Personal Data processing by Piano is also determined by the fact that Piano does not have a direct relationship with data subjects and by Piano’s Software as a Service business model that does not include data monetization techniques like brokerage of data or databases or selling of data to third parties.
5. Purpose of Personal Data Processing. As the Client’s data processor, Piano is entitled to process the Personal Data for the Purposes. Piano will process Personal Data solely for the provision of the Services, and will not otherwise (i) process or use Personal Data for purposes other than those set forth in this DPA and/or the Agreement or as instructed by Client, or (ii) disclose such Personal Data to third parties other than Piano Affiliates or Sub-Processors in accordance with Section 8 below or as required by law.
6. Types of Personal Data. Types of the Personal Data processed by Piano on the basis of this DPA include, as the case may be, name, email address, phone number, financial data, the specific content accessed, time and duration of the visit, IP address, geographical location of the end-user device, offer conversion and/or interaction data, referring site, or other information or other information relating to such natural person collected through the Service whether collected via cookies or other tracking technologies, the Service’s functionality, or otherwise. Parties do not foresee processing of special categories of Personal Data pursuant to the Article 9 of the GDPR.
7. Categories of Data Subjects. The Personal Data processed by Piano will relate to Users of the Client’s Websites and persons using the Software/Services.
8. Sub-Processors & Transfers. Through this DPA Client provides Piano with a specific documented instruction/authorization to use Piano Affiliates and Sub-Processors for processing of Personal Data pursuant to the Conditions including to transfer personal data to them. Provided that the Conditions are met, Piano is authorized to use and change Piano Affiliates and Sub-Processors without additional instructions or approvals by the Client. Piano shall specifically notify to the Client any change of Piano Affiliates and/or Sub-Processors where the Conditions would not be fulfilled and shall provide Client the opportunity to object to such changes. If Client does not respond within fifteen (15) days, Piano is authorized to undertake the change and transfer. At any time, Piano shall provide a current list of Piano Affiliates and/or Sub-Processors upon request of Client.
9. EU Standard Contractual Clauses. If applicable, the Parties hereby conclude the Clauses (attached as Exhibit 2 hereto) and agree to update or replace such Clauses if and when such Clauses will be updated or replaced by new Clauses in line with the GDPR. The Parties agree to interpret such Clauses in line with the GDPR regime.
10. Documented Instructions. Piano shall process the Personal Data for the Purposes only in accordance with documented instructions from Client including with regard to transfers of Personal Data to a third country or an international organization, unless required to do so by the EU or the Member State law to which Piano is subject; in such a case, Piano shall inform Client of that legal requirement before processing, unless such law prohibits such information on important grounds of public interest. Certain general authorizations and documented specific instructions/authorizations are already contained in this DPA, mainly in Section 8 above, which are hereby given by Client to Piano and which can only be altered if mutually agreed by the Parties. Any other general authorizations or documented specific instructions/authorizations of Client must be given to Piano in accordance with Section 12(a) of the Agreement (Notices). Piano is obliged to inform Client if it believes that Client’s instruction would infringe the GDPR. Piano shall not be liable for breaching any contractual obligations under the Agreement and/or this DPA if such breach is caused by compliance with documented instruction of Client under this DPA. For the avoidance of doubt, Client’s instructions for the processing of Personal Data shall comply with Privacy and Data Protection Requirements. Client shall have sole responsibility for the accuracy, quality and legality of Personal Data and the means by which Client acquired Personal Data.
11. Data Subject Rights. According to Article 28(3)(e) of the GDPR, Piano acting as a data processor shall insofar as this is possible and taking into account the nature of the processing, assist Client as a data controller, with the fulfillment of the controller’s obligation to respond to requests for exercising the data subject’s rights under the GDPR. Piano will comply with this obligation by providing supporting information available to it upon request of Client. Such supporting information may include an updated list of Sub-Processors, Piano Affiliates, recipients and respective third countries. Upon request from Client, Piano shall delete, release, correct, provide a copy of or block access to specific Personal Data or, if the foregoing is not practicable and only to the extent permitted by applicable law, follow Client’s detailed written instructions to delete, release, correct or block access to Personal Data held in Client’s Services environment. However, Piano is not entitled to handle or respond to the data subject request if it relates to the Purposes. Such requests should be handled and responded to by Client. Should Piano receive a data subject request that is of general nature and might be or is related to the Purposes, Piano will forward such request to Client without undue delay.
12. Transparent Information. Every data controller has a general obligation to provide certain information to data subjects mainly pursuant to the Article 13 or Article 14 of the GDPR. Client remains fully responsible for providing this information to data subjects via its own privacy policy. Client is entitled but not obliged to refer to or to use information from Piano’s privacy policy and information about GDPR published and updated at https://piano.io/privacy-policy and https://piano.io/gdpr.
13. Legal Grounds for Processing of Personal Data. The legal grounds for processing Personal Data are determined solely by Client. Such legal grounds must always be compliant with the Article 6 of the GDPR. By concluding this DPA, the Client warrants and guarantees to Piano, that it has sufficient legal grounds for processing the Personal Data including a consent of data subject where required by the GDPR.
14. Confidentiality. Piano shall implement such organizational measures that ensure that access to the Personal Data by Piano staff is limited to what is necessary to achieve the Purposes. Piano shall also implement such organizational measures that ensure all Piano staff are committed to the confidentiality in respect to the Personal Data. These obligations may be complied by adopting an appropriate internal policy at Piano group.
15. General Client Data Obligations. Client shall own and retain all rights in and to the Client Data. All Client Data must be stored only on servers located in the EU unless otherwise expressly authorized in this DPA or by Client in writing. Piano may only use Client Data to the extent necessary to perform its obligations hereunder. In the course of providing the Services, Piano shall not access and shall not permit its personnel and/or third-party service providers to access, Client Data except as necessary to perform the Services and only in accordance with the requirements of the Agreement and this DPA. Piano shall not be liable to Client for any damages incurred by Client in connection with any unauthorized access resulting from the actions of Client. Piano shall have the appropriate knowledge of Client’s business to perform its duties under this DPA.
    1. Global Approach. Piano treats all Personal Data in a manner consistent with the requirements of this DPA in all locations globally. Piano's information policies, standards and governance practices are managed on a global basis.
    2. Security Piano will enforce physical and logical security procedures with respect to its access and maintenance of the Service and any Client Data contained therein. Piano will take appropriate organizational and technological measures to protect the security of the Client Data and defend its location and equipment against “hackers” and any person or entity who may seek to modify or access Piano systems or the information found therein without authorization. Piano will also use its best commercial efforts to take all reasonable measures to secure and defend Client Data and use of the Service from other third-party users.
    3. Monitoring & Security Breaches. Piano will monitor its networks, connectivity and systems on a continual basis and will perform penetration testing on its systems for potential security breaches not less than once per year; Piano will meet with Client once per year to review the results of such security test(s). Piano will report to Client immediately, but no less than within 24 hours of becoming aware of, any breaches of security or unauthorized access affecting Client Data that Piano detects or becomes aware of. Piano will remedy such breach of security or unauthorized access as soon as possible and deliver to Client a root cause assessment and future incident mitigation plan. Client or its third-party designee may, but is not obligated to, at Client’s expense, perform audits of Piano’s environment during the Term, including coordinated penetration and security tests, as it relates to the receipt, maintenance, use or retention of personally identifiable information or other Client Data. Piano is entitled to claim remuneration for the Client’s audits or inspections. Such audits shall be conducted in accordance with Section 16.19 below. Subject to the foregoing, any of Client’s regulators shall have the same right upon request. Piano agrees to consider all reasonable recommendations that result from such inspections, tests, and audits within reasonable timeframes and will inform Client of its plans and timeline for addressing and/or implementing any such recommendations.
    4. If at any time Client or Piano determines that any Piano Personnel: (i) has sought to circumvent or has circumvented the Security Regulations; (ii) has accessed or may access the Client Network without authorization; or (iii) has engaged in activities that may lead to the unauthorized access, destruction, alteration, or loss of data, information or software, Piano will immediately terminate any such Piano Personnel’s access and will immediately, in any event within 24 hours of becoming aware of such breach, notify Client of the events warranting such termination. If Client reasonably determines that any Piano Personnel has attempted to circumvent or has circumvented the Security Regulations, Client may immediately terminate such Piano Personnel’s access to the Client Network and will advise Piano of such termination. Notwithstanding anything to the contrary in this DPA, any failure by Piano, any Piano Personnel or other agents or representatives to comply with the Security Regulations will constitute a breach of this DPA entitling Client to terminate the Agreement immediately upon written notice to Piano for cause. At any time during the Term, Client may audit Piano’s use of the Client Network. Piano agrees that Client may review any information, electronic mail communications, and other data stored on or contained in any computer hard drive, disk, or any other storage medium to determine whether there has been any breach of security or violation of this DPA. In the event that Client concludes, in its reasonable judgment, that there has been any breach of security or violation of this DPA by Piano or any Piano Personnel, agent or representative, Client reserves the right to disclose any computer files or electronic mail messages to third parties, including (but not limited to) law enforcement officials, as Client deems appropriate, without any prior notice to any individuals who may have written, sent or received such files or messages.
16. Appropriate Security Measures. Piano acknowledges and agrees that from time to time during the term of this DPA, Piano, Piano Affiliates, its employees, agents and Sub-Processors or assigns may be exposed to or have access to Client Data, some of which may be Personal Data. Piano will process or disclose Personal Data only for the Purposes, or other purposes of processing required by a court of competent jurisdiction or by any competent national or EU governmental authority. Piano acknowledges that due to certain mandatory data protection laws, the processing of Personal Data is subject to certain legal requirements. Piano shall assist Client in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR taking into account the nature of processing and the information available to Piano. To the extent applicable to the Services and related activities of Piano, Piano shall comply with all provisions of any applicable privacy policies, including Client’s applicable privacy policy, if reasonably required by the Client and provided in advance to Piano. Piano will not view, de-encrypt, or otherwise access Personal Data unless such access is necessary for the performance of Piano’s obligations under this DPA. Piano will maintain, implement and enforce safety and security procedures in performing the Services that are: (a) equal to or better than industry standards for such Services and networks (if any), but in any case, in accordance with a reasonable standard of care; (b) are compliant with the requirements of the Privacy and Data Protection Requirements; and (c) compliant with the security requirements set forth in this Section Such measures shall include, by way of example and not limitation, firewalls, intrusion detection systems, locking file cabinets, and other appropriate physical and electronic security mechanisms, including current revisions of all software releases and all software patches. Piano shall have adequate security audits in place, and Piano shall submit evidence of passing an annual security audit in conformance with industry standard security standards acceptable to Client, in Client’s sole discretion. Upon request, Piano will complete Client’s Security Assessment Questionnaire. Piano shall comply with an implemented written information security program (“Information Security Program”) that includes administrative, technical, and physical safeguards that ensure the confidentiality, integrity, and availability of Personal Data, protect against any reasonably anticipated threats or hazards to the confidentiality, integrity, and availability of the Personal Data, and protect against unauthorized access, use, disclosure, alteration, or destruction of the Personal Data. In addition to any specific and or supplemental security safeguards established in any agreement between the parties, Piano’s Information Security Program shall include, but not be limited to, the following safeguards where appropriate or necessary to ensure the protection of Personal Data:
    1. Where appropriate Piano shall implement security measures comprising of pseudonymization of the Personal Data.
    2. Access Controls. Policies, procedures, and physical and technical controls: (i) to limit physical access to its information systems and the facility or facilities in which they are housed to properly authorized persons, including, but not limited to; limiting access to physical servers at the production data center to authorized individuals, logging and monitoring of unauthorized access attempts to the data center by the data center security personnel, controlling ingress/egress to the facility using control access points (e.g. guards and electronic badge reader), and maintaining physical access to logs for entry/exit points; (ii) to ensure that all members of its workforce who require access to Personal Data have appropriately controlled access, and to prevent all other workforce members and others who should not have access from obtaining access; (iii) to authenticate and permit access only to authorized individuals and to prevent members of its workforce from providing Personal Data or information relating thereto to unauthorized individuals; and (iv) to encrypt and decrypt Personal Data where
    3. Security Awareness and Training. A security awareness and training program for all members of Piano’s workforce (including management), which includes training on how to implement and comply with its Information Security Program and the Privacy and Data Protection
    4. Security Incident Policies and procedures to detect, respond to, and otherwise address security incidents, which shall mean, but not be limited to, unauthorized access, acquisition, disclosure or use of Personal Data (“Security Incident”), including procedures to monitor systems and to detect actual and attempted attacks on or intrusions into Personal Data or information systems relating thereto, and procedures to identify and respond to suspected or known Security Incidents, mitigate harmful effects of Security Incidents, and document Security Incidents and their outcomes.
    5. Contingency Policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages Personal Data or systems that contain Personal Data, including a data backup plan and a disaster recovery plan.
    6. Device and Media Controls. Policies and procedures that govern the receipt and removal of hardware and electronic media that contain Personal Data into and out of a Piano facility, and the movement of these items within a Piano facility, including policies and procedures to address the final disposition of Personal Data, and/or the hardware or electronic media on which it is stored, and procedures for removal of Personal Data from electronic media before the media are made available for re-use.
    7. Audit Controls/Logging. Hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic information, including appropriate logs and reports concerning these security requirements and applicable laws and regulations and compliance
    8. Data Policies and procedures to ensure the confidentiality, integrity, and availability of Personal Data and protect it from disclosure, improper alteration, or destruction.
    9. Storage and Transmission All Personal Data that is stored or transmitted has to be encrypted. Stored Personal Data will be encrypted with then current industry standards, such as, if applicable, AES-128 or better, or Triple-DES (3-DES) or better. All Personal Data in transmission will be protected by at least industry standard encryption such as SSLv3/TLS.
    10. Secure Disposal. Policies and procedures regarding the disposal of Personal Data, and tangible property containing Personal Data, taking into account available technology so that Personal Data cannot be practicably read or
    11. Assigned Security Piano shall designate a security official responsible for the development, implementation, and maintenance of its Information Security Program. Piano shall inform Client as to the person responsible for security.
    12. Piano shall regularly and no less than one time per year test the key controls, systems and procedures of its Information Security Program to ensure that they are properly implemented and effective in addressing the threats and risks identified. Tests should be conducted or reviewed by independent third parties or staff independent of those that develop or maintain the security programs.
    13. Program Adjustment. Piano shall monitor, evaluate, and adjust, as appropriate, the Information Security Program in light of any relevant changes in technology or industry security standards, the sensitivity of the Personal Data, internal or external threats to Piano or the Personal Data, requirements of applicable work orders, and Piano’s own changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to information
    14. Environmental Establish and maintain environmental controls to detect, prevent and control disruption and/or destruction to information systems containing or storing Personal Data as a result of environmental extremes.
    15. Security Patch Management. Maintain system upgrades, patches and configurations with at least industry standard and commercially reasonable frequency
    16. Piano shall regularly and no less than one time per year test the key controls, systems and procedures of its Information Security Program to ensure that they are properly implemented and effective in addressing the threats and risks identified, including but not limited to vulnerability scans and penetration testing. Penetration tests should be conducted or reviewed by independent third parties or staff.
    17. Application Security Testing. Utilize at least industry standard testing and security assessments (e.g. Veracode)
    18. Consultant/Vendor Background Checks. Implement and maintain verifiable and at least industry standard processes (based on, among other factors, the circumstances and level of access) for performing background checks on personnel with access to Client Personal Data. Upon reasonable request from Client, Client may request more specific requirements for such background
    19. Client may, at its own cost, request, upon within (3) weeks written notice to Piano, access to facilities, systems, records and supporting documentation in order to audit Piano’s compliance with its obligations under or related to the Information Security Program. Client may audit Piano’s compliance with the terms of this DPA and Privacy and Data Protection Requirements not more than once per year. Client may perform more frequent audits of the Service computer systems that process Personal Data to the extent required by laws applicable to Client. If a third party is to conduct the audit, the third party must be mutually agreed to by Client and Piano and must execute a confidentiality agreement acceptable to Piano before conducting the audit. As part of the audit request, Client shall submit a detailed audit plan at least three (3) weeks in advance of the proposed audit date to Piano describing the proposed scope, duration, and start date of the audit.  Piano will review the audit plan and provide Client with any concerns or questions (for example, any request for information that could compromise Piano security, privacy, employment or other relevant policies).  Piano will cooperate with Client in good faith to agree on a final audit plan. Audits shall be subject to all applicable confidentiality obligations agreed to by Client and Piano and shall be conducted in a manner that minimizes any disruption of Piano’s performance of services and other normal operations, i.e. outside regular business hours. Such audits may at Client's option and request, include penetration and security tests, of any and all Piano systems and their housing facilities and operating environments. Client may use the audit reports only for the purposes of meeting its regulatory audit requirements and/or confirming compliance with the requirements of this DPA and/or Privacy and Data Protection Requirements.  The audit reports are Confidential Information of the Parties under the terms of the Agreement. Should the audit reveal confidential information or intellectual property of a third party, any audit must be done in compliance with such ^third party’s applicable confidentiality or license terms.
    20. The Parties will notify each other without undue delay about any potential or actual regulatory or court action or request in respect to the Personal Data processed in connection with this DPA. Piano will notify Client and obtain Client’s consent before sharing any Personal Data with any government authorities unless sharing of such Personal Data is required by applicable law.
    21. When and as required by Client from time to time, Piano shall execute and/or shall cause its Piano Affiliates to execute supplemental privacy and security terms, with Client or Client’s affiliates that receive Services under the Agreement as required in Client’s sole judgment for the processing and/or transfer of Personal Data in accordance with applicable law. At the time of the signing of this DPA the application of the ePrivacy Regulation has not been fully set out by either European authorities or the local supervisory authority of Client. Consequently, the Parties agree to amend this DPA where necessary to ensure the Services compliance with the ePrivacy Regulation.
    22. If any country outside of the EU where Services are to be rendered under the Agreement has or enacts a data protection-related law that Client concludes, in its sole judgment, requires the execution of any supplemental privacy and security terms, then Piano shall execute and/or cause any Piano Affiliates to execute such supplemental terms promptly with Client and/or Client’s affiliates, subject to the same terms and conditions as set forth above; provided, however, that the parties shall make reasonable efforts to leverage existing supplemental privacy and security terms that have been executed with respect to the EU data protection-related law to fulfill any such requirement, so as to minimize the cost and effort involved in achieving compliance with such
    23. Notwithstanding any provisions in the Agreement to the contrary, in the event that any Party becomes aware of any personal data breach pursuant to the Article 4(12) of the GDPR (e.g. breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed) (the “Personal Data Breach”) that might have impact on the other Party’s obligations under the Article 32 and 33 of the GDPR, each Party shall notify the other Party immediately of any such Personal Data Breach (i.e., within 24 hours). Parties will then co-operate to evaluate the potential risk to rights and freedoms of natural persons stemming from such Personal Data Breach, mitigate such risk and will agree on notification or communication of the Personal Data Breach pursuant to the Article 32 and 33 of the GDPR.
    24. Piano shall ensure procedures are put in place to ensure that Personal Data is portable, in a machine-readable format, and that Piano will be in a position to provide Client with any Personal Data within three working In addition, Piano shall be in a position to delete all of the Client Data, if requested by Client.
17. Payment Card Industry Data Security Standard (PCI DSS). If and to the extent Piano will have access to any Credit Card Data, then this paragraph shall apply. For purposes, hereof, (a) “PCI DSS” means the Payment Card Industry Data Security Standard; and (b) “Credit Card Data” means any and all data designated as “Cardholder Data” or “Sensitive Authentication Data” in PCI DSS. Piano shall comply with industry standards and practices, including without limitation, PCI DSS. If and when applicable, Piano shall only use Cardholder Data only for assisting in completing a card transaction, for fraud control services, or as specifically agreed to by Visa, MasterCard, American Express, and/or Discover (collectively, the “Issuers”), or as required by applicable In the event of unauthorized use, modification, destruction or disclosure of, or access to, Cardholder Data (any of the foregoing events or circumstances, a “Security Incident”) stored by or for Piano (or otherwise within Piano’s control), Piano shall immediately notify Client and provide Client or its designee, the Issuers, and the acquiring financial institution and their respective designees access to Piano’s facilities and all pertinent records to conduct a review of Piano’s compliance with these requirements. Piano shall maintain appropriate business continuity procedures and systems to ensure security of Cardholder Data in event of a disruption, disaster or failure of Piano’s primary data systems which involve a risk to Cardholder Data. Piano shall provide access to its security systems and procedures, as reasonably requested by Client or its designee. Piano shall cooperate fully with any reviews of its facilities and records provided for in this paragraph. Piano is and will continue to be, in compliance with the PCI DSS security standards as they may be amended from time to time. Piano is responsible for the security of all data obtained, stored, viewed, or accessed in connection with this DPA whether provided by Client or its customers, Piano will maintain records that demonstrate its PCI compliance and provide them to Client upon request. Piano will immediately contact Client if a security breach or serious threat arises that relates to Client Data and will fully cooperate with Client in investigating and prosecuting any security breaches.
18. Disaster Recovery. The parties agree that Piano has previously supplied Client with a copy of its written disaster and recover plan (the “Disaster Avoidance and Recovery Plan”) and that Piano has implemented and is maintaining such Plan. Piano’s Disaster Avoidance and Recovery Plan shall be actively reviewed on a quarterly basis and updated during the Term using American Institute of Certified Public Accountants standards as guidance. Piano shall notify Client of the completion of any such audit and make the audit available to Client or its designee for review. Piano’s Disaster Avoidance and Recovery Plan shall contain procedures designed to safeguard Client’s data and the availability of the Telemarketing Services, throughout the Term. Such Disaster Avoidance and Recovery Plan shall include, without limitation, the following:
    1. Fire Protection. Piano represents that the fire protection system at the Piano site(s) consists of the appropriate type and quality of equipment required to provide effective fire protection and that it is regularly reviewed and updated, and that the system currently consists of smoke detectors (with remote enunciators and zone indicators), automatic sprinkler systems, and a two-part halon system in any computer areas. Piano further represents that each room at the Piano site(s) has its own supply of halon and all Piano Service Location(s) computer rooms have a second halon system to provide backup. Piano represents that water detection devices and drains are installed under all raised floor
    2. Power Piano shall maintain multiple levels of power backup designed to provide uninterrupted operation of the Piano equipment in the event of a loss of power. Piano shall maintain multiple feeds to the Piano site(s) from different processing stations of the local power company which furnishes the main power to the Piano site(s). Piano shall maintain two (2) levels of uninterrupted power systems to provide smooth transition to the use of Piano’s alternative energy sources (e.g., diesel generators) in the event of an extended power company outage.
    3. Equipment/Air Conditioning. Piano shall maintain multiple levels of protection against loss of cooling, including a primary backup system which shall provide adequate backup cooling capacity, and a secondary backup system, which shall be capable of providing continuous cooling during a power outage so as to maintain equipment at all times within the tolerances specified by the appropriate
    4. Computer Equipment. Piano agrees that the Piano site(s) shall maintain the appropriate backup equipment that is capable of maintaining operations in the event of hardware failures at the Piano site(s). In addition, Piano agrees that it will maintain at the Piano site(s) detailed, written recovery procedures which its personnel are familiar with and which enable Piano personnel to switch to backup hardware
    5. Hardware and Software Changes. Piano shall maintain a strict change control process, which Piano personnel are familiar with, and which is used for both hardware and software
    6. Piano agrees that its disaster recovery testing will be performed at the Piano site(s) twice per year. The testing shall include, but not be limited to, testing of hardware, installation and operation of all Systems, processing of data and generation of reports, and testing of telecommunications facilities.
    7. Recovery Procedures. Piano shall maintain appropriate recovery procedures and automated recovery tools for a call center operations
    8. Off-Site Data Vaulting. Piano shall store daily a current copy of data and system files on magnetic media in damage resistant, fire proof vaults at an off-site facility. The off-site facility shall be guarded twenty-four (24) hours a day, seven (7) days a week. Piano shall also maintain a tape management system, manual or otherwise, which controls the daily process of vaulting files.
    9. Operations In the event of any unplanned or unscheduled interruptions of the operations of, or accessibility to, the Piano site(s), Piano shall use its commercially reasonable best efforts to restore service to Client as expeditiously as possible. Piano shall notify Client at least ten (10) minutes prior to any unscheduled interruptions. Piano shall notify Client at least within two (2) minutes of occurrence of any unplanned interruptions.
    10. Time Frames for Recovery. The time frames for restoration of Client’s service will vary according to the nature and magnitude of the disaster event, the availability of replacement equipment for drop-shipment and the speed with which alternate telecommunication circuits can be made available. Piano shall use commercially reasonable best efforts to work with telecommunications carriers and equipment vendors to restore service as expeditiously as
    11. Maintenance of Safeguards. In addition to those requirements specifically set forth in this DPA, Piano agrees that it shall maintain safeguards throughout the Term against destruction, loss, or alteration of Client’s data, which are no less rigorous than those in effect at other similar Vendor site(s) as of the Effective Date of this

19. Data Protection Impact Assessment. Each Party remains solely responsible for conducting the data protection impact assessment pursuant to the Article 35 of the GDPR and prior consultation pursuant to the Article 36 of the GDPR with respect to the Purposes. Nevertheless, if any Party conducts such data protection impact assessment which relates to this DPA, the other Party agrees to reasonably assist such Party by providing reasonable assistance or information. In good faith, Piano may provide Client with its own data protection impact assessment with respect to the Purposes on the basis of the available information prior to concluding this DPA in order to help the Client to make its own data protection impact assessment. 
20. Acceptable Use. Piano shall have an Acceptable Use Policy acceptable to Client. Among other things, such policy shall prohibit use by Piano employees and agents of non-business applications that could affect network and/or tool performance and shall mandate that under no circumstances shall any peer to peer applications/use be permitted on the Piano’s Acceptable Use Policies are subject to review and approval by Client. The Acceptable Use Policy shall have adequate, reasonable and at least industry standard access controls.
21. Liability. Pursuant to the Article 82 of the GDPR, Piano shall be liable for the damage caused by processing only where it has not complied with obligations of GDPR specifically directed to processors or where it has acted outside or contrary to lawful instructions of the Client. Piano shall be exempt from liability if Piano proves that it is not in any way responsible for the event giving rise to the damage.
22. Brexit. Any reference to GDPR shall be interpreted as a reference to the UK law that is equivalent to the GDPR or that implements the GDPR not affecting validity and effectiveness of this DPA. The Parties wish to interpret this DPA in line with applicable UK legislation after the UK ceases to be a member of the EU. Client is obliged to inform Piano about any requirements stemming from the UK law beyond the requirements stemming from the GDPR.
23. Service Analysis. As part of the Services and foreseen processing of Personal Data, Piano may (i) compile statistical and other information related to the performance, operation and use of the Services, and (ii) use Client Data from the Services environment in aggregated form for security and operations management, to create statistical analyses, and for research and development purposes (clauses (i) and (ii) are collectively referred to as “Service Analyses”). Piano may make Service Analyses publicly available; however, the resulting Service Analyses will not incorporate Client Data or Confidential Information in a form that could identify or serve to identify Client or any data subject. Piano shall retain all intellectual property rights in said Service Analyses as its own confidential information. 
24. Data Protection Officer. Piano has appointed Stuart Ashford (privacy@piano.io) as its Data Protection Officer.

EXHIBIT 1
Piano Software Norway Affiliates and Subprocessors

1. Enreach Solutions Oy, Aleksanterinkatu 17, 00100 Helsinki, Finland (data segmentation provider), adequacy;
2. SoftLayer Technologies, Inc., 14001 Dallas Pkwy, Suite M100, Dallas TX 75240 (data center owner), adequacy;
3. Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (data center owner), adequacy;
4. Google Ireland, Ltd., Gordon House, Barrow St, Dublin 4, Ireland (data backup storage), adequacy;
5. Packet Host, Inc., 30 Vesey St, Floor 9, New York, NY 10007 (data center owner), adequacy;
6. Maxifier Development, Novo-Sadovaya, 349a, 443125 Samara, Russia (software development team and data center operations team), Model Clauses on behalf of Client;
7. Creative Software, #29 Deal Place, Colombo 03, Sri Lanka (global technical support team), Model Clauses on behalf of Client.

EXHIBIT 2 
Standard Contractual Clauses

EUROPEAN COMMISSION DIRECTORATE-GENERAL JUSTICE  Directorate C: Fundamental rights and Union citizenship Unit C.3: Data protection

Commission Decision C(2010)593
Standard Contractual Clauses (processors)

For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection each a “party”; together “the parties”, HAVE AGREED on the following Contractual Clauses (the Clauses) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.

Clause 1
Definitions

For the purposes of the Clauses:

1.    'personal data', 'special categories of data', 'process/processing', 'controller', 'processor', 'data subject' and 'supervisory authority' shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data[2];
2.    'the data exporter' means the controller who transfers the personal data;
3.    'the data importer' means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country's system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;
4.    'the subprocessor' means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;
5.    'the applicable data protection law' means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established;
6.    'technical and organisational security measures' means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

Clause 2
Details of the transfer

The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 which forms an integral part of the Clauses.

Clause 3
Third-party beneficiary clause

1. The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.
2. The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.
3. The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
4. The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.

Clause 4
Obligations of the data exporter

The data exporter agrees and warrants:

1.     that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;
2.    that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter's behalf and in accordance with the applicable data protection law and the Clauses;
3.    that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this contract;
4.    that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;
5.    that it will ensure compliance with the security measures;
6.    that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;
7.    to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;
8.    to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;
9.    that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and
10.    that it will ensure compliance with Clause 4(a) to (i).

---

[2]        Parties may reproduce definitions and meanings contained in Directive 95/46/EC within this Clause if they considered it better for the contract to stand alone.

Clause 5
Obligations of the data importer[3]

The data importer agrees and warrants:

1.    to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
2.    that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract; 
3.    that it has implemented the technical and organizational security measures specified in Appendix 2 before processing the personal data transferred;
4.    that it will promptly notify the data exporter about:
   1.    any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation,
   2.    any accidental or unauthorized access, and
   3.    any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;
5.    to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;
6.    at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;
7.    to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;
8.    that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent;
9.    that the processing services by the subprocessor will be carried out in accordance with Clause 11;
10.    to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data exporter.

---

[3]     Mandatory requirements of the national legislation applicable to the data importer which do not go beyond what is necessary in a democratic society on the basis of one of the interests listed in Article 13(1) of Directive 95/46/EC, that is, if they constitute a necessary measure to safeguard national security, defense, public security, the prevention, investigation, detection and prosecution of criminal offences or of breaches of ethics for the regulated professions, an important economic or financial interest of the State or the protection of the data subject or the rights and freedoms of others, are not in contradiction with the standard contractual clauses. Some examples of such mandatory requirements which do not go beyond what is necessary in a democratic society are, inter alia, internationally recognized sanctions, tax-reporting requirements or anti-money-laundering reporting requirements.

Clause 6
Liability

1.    The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensation from the data exporter for the damage suffered.
2.    If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity.
   The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities.

3.    If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the subprocessor agrees that the data subject may issue a claim against the data subprocessor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the subprocessor shall be limited to its own processing operations under the Clauses.

Clause 7
Mediation and jurisdiction

1.    The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject:
   1.    to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;
   2.    to refer the dispute to the courts in the Member State in which the data exporter is established.

2.    The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.

Clause 8
Cooperation with supervisory authorities

1.    The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.
2.    The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.
3.    The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any subprocessor preventing the conduct of an audit of the data importer, or any subprocessor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5 (b).

Clause 9
Governing Law

The Clauses shall be governed by the law of the Member State in which the data exporter is established.

Clause 10
Variation of the contract

The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.

Clause 11
Subprocessing

1.    The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on the data importer under the Clauses[4]. Where the subprocessor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the subprocessor's obligations under such agreement.
2.    The prior written contract between the data importer and the subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
3.    The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established.
4.    The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5 (j), which shall be updated at least once a year. The list shall be available to the data exporter's data protection supervisory authority.

---

[4]     This requirement may be satisfied by the subprocessor co-signing the contract entered into between the data exporter and the data importer under this Decision.

Clause 12
Obligation after the termination of personal data processing services

1.    The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.
2.    The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1.

 

Appendix 1 to the Standard Contractual Clauses

This Appendix forms part of the Clauses and must be completed and signed by the parties.

The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix.

 Data exporter

The data exporter is (please specify briefly your activities relevant to the transfer):

Operator of Websites which chose to use the Data importer to assist in providing certain web audience measuring services that necessarily involves processing of personal data.

Data importer

The data importer is (please specify briefly activities relevant to the transfer):

Provider of certain web audience measuring services to the Data exporter that necessarily involves processing of personal data.

Data subjects

The personal data transferred concern the following categories of data subjects (please specify):

Mainly Users of the Client’s Websites, as is explained in more detail in the above Data Processing Agreement concluded between the Parties.

Categories of data

The personal data transferred concern the following categories of data (please specify):

Name, email address, phone number, financial data, the specific content accessed, time and duration of the visit, offer conversion and/or interaction data, referring site, or other information or other information relating to such natural person collected through the Service whether collected via cookies or other tracking technologies, the Service’s functionality, or otherwise

Special categories of data (if appropriate)

The personal data transferred concern the following special categories of data (please specify):

No special categories of personal data are transferred to the best of the knowledge of both Parties.

  Processing operations

The personal data transferred will be subject to the following basic processing activities (please specify):

Collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, cross-border transfer, erasure or destruction.

Appendix 2 to the Standard Contractual Clauses

This Appendix forms part of the Clauses and must be completed and signed by the parties.
Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached):

These technical and organisational measures are described in detail in the above Data Processing Agreement concluded between the Parties.

Last updated: December 29, 2020