Impartner Terms of Use

This Impartner Terms of Use (“Terms of Use”) governs any and all Order Forms, Renewals, and Amendments to Order Forms by and between Impartner, Inc. (“Impartner”), including its affiliates and subsidiaries, and the Customer identified on page one of the Order Form and/or Amendment (“Customer”), unless expressly indicated otherwise. Capitalized terms not defined herein shall have the meaning assigned to them in the Order Form, Renewal. In the event of conflict, the order of precedence shall be: (i) Order Form, (ii) Data Processing Addendum (“DPA”), (iii) Impartner Terms of Use. Any Exhibits will be incorporated by reference and shall take the precedence to the Document to which it has been addended.

1. Definitions

“Admin Users” means Customer’s Portal Users who have the administrative rights to supply login credentials to other Portal Users. Customer shall not exceed twenty-five (25) Admin Users at any given time.

“Affiliate” means, with respect to any legally recognizable entity, any other such entity Controlling, Controlled by, or under common Control with such entity. “Control” means direct or indirect ownership of: (a) more than fifty percent (50%) of the outstanding equity interests representing the right to vote for members of the board of directors or other managing officers of such entity; or (b) for an entity that does not have outstanding equity interests that vote for members of the board of directors or other managing officers, more than fifty percent (50%) of the ownership interest representing the right to make decisions for such entity. An entity shall be deemed an Affiliate only for so long as such Control exists.

“Agreement” means the Order Form, Terms of Use, Data Processing Addendum, and any other exhibits or addenda attached thereto or hereto.

“Applicable Data Protection Law” shall mean: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or “GDPR”) and any data protection laws in any European Union Member State including laws implementing such Regulation, (ii) the GDPR as incorporated into United Kingdom (“UK”) law by the Data Protection Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments, etc.) (EU Exit) Regulations 2019 (“UK GDPR”), (iii) the California Consumer Privacy Act of 2018 (“CCPA”), including any regulations promulgated thereunder, as amended from time to time; and (iv) any other applicable data protection law.

“Clients” means all Customer’s clients and customers who are not Partners or Employees.

“Customer Data” means all electronic data or information submitted by Portal Users to Impartner via the Service.

“De-Identified” or “Anonymized” data means information that cannot identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to an identified or identifiable natural person.

“Documentation” means Impartner’s then-current standard solution documentation, and includes all documentation found in the Impartner customer success portal.

“Employees” means Customer’s employees, consultants, contractors and agents.

“Implementation Services” means work required by Impartner for initial installation and configuration of Services in accordance specific line items on an Order Form.

“Licensees” means the combination of Employee’s, Clients, Partner Accounts, and Recipients.

“Malicious Code” means viruses, worms, time bombs, Trojan horses and other harmful or malicious code, files, scripts, agents or programs.

“Order Form” means the invoice or order form, as applicable, agreed to by the Parties in which this Impartner Terms of Use is referenced. The Order Form will include some or all of the following information: the name of Customer, Customer’s address and billing information, the length of the Subscription Term, the fees due from Customer, the Use Limit, the applications and modules selected by Customer, and any professional services and support being purchased.

“Partners” means Customer’s resellers, channel partners or other members of Customer’s partner networks that provide services and/or sell products on behalf of Customer.

“Partner Accounts” means Partners who are listed as active within the Service.

“Portal Users” means individuals who are authorized by Impartner or Customer to access and use the Service, and who have been supplied user identifications and login credentials by Admin Users. Portal Users may include Customer’s employees, Partners’ employees, consultants, contractors and agents of Customer.

“Premier Support” means billable, professional services related to custom functionality, as outlined in an agreement between the Parties that delineates the specific scope of services.

“Price Quote” means the price quote included in the Order Form.

“Recipient” means an Employee, Partner or Client, as applicable, who, at Customer’s sole discretion, receives a digital communication from Customer as part of the Services.

“Sensitive Personal Information” means an individual’s financial information, sexual preferences, medical, or health information protected under any health data protection laws, biometric data (for purposes of uniquely identifying an individual), personal information of children protected under any child data protection laws (such as the personal information defined under the US Children’s Online Privacy Protection Act (“COPPA”)) and any additional types of information included within this term or any similar term (such as “sensitive personal data” or “special categories of personal information”) as used in applicable data protection or privacy laws.

“Service/s” means the online, cloud-based software applications, modules and content provided by Impartner to Customer via the Internet. The specific applications, modules and content that will be provided are outlined in the Order Form.

“Standard Support Services” means Impartner support provided in response to a ticket submitted by Customer via Impartner’s support ticking system related to the Services’ standard product capabilities.

“Subscription Term” means the period beginning on the Commencement Date (as defined in the Order Form) and continuing until the end of the Subscription Term specified in the Order Form, unless terminated earlier or renewed or extended as provided in the Agreement.

“Term” means the period beginning on the Effective Date (as defined in the Order Form) and continuing until the end of the Subscription Term specified in the Order Form, unless terminated earlier or renewed or extended as provided in the Agreement or any applicable Order Form.

“Use Limit” means the quantity of the Service that Customer is authorized to use or access as indicated in the applicable Order Form or pursuant to Section 3.1. Use Limit is based on the license use meter (which may include, but is not limited to, Partner Accounts, Employees, Recipients, Clients, or Licensees, as applicable) by which Impartner measures, prices and licenses the right to use the Service. For the avoidance of doubt, Customer may only use the Service for the use meter authorized, i.e. if the use meter is based on Partner Accounts, Customer may not use the Service for Employees and/or Clients.

Exhibit A: Reward Payment Processing

This Reward Processing Exhibit (“Exhibit A”) is only applicable in the event Customer is buying Referral Automation Programs. If Customer is not buying Referral Automation Programs, this Exhibit A is hereby null and void.

This Exhibit A is hereby attached and made a part of the Impartner Impartner Terms of Use (“Agreement”) between Impartner, Inc., a Delaware Corporation (“Impartner”) and your company (“Customer”). By signing an Order Form, Customer agrees to be legally bound by this Exhibit A as of the Effective Date the Order Form. In the event of any conflict or inconsistency with the terms of the Agreement, this Exhibit A shall govern. Terms not defined herein shall have the meaning assigned to them in the Agreement. By signing an Order Form, Customer agrees to receive and Impartner agrees to provide management of Customer’s rewards processing (“Services”), including providing reward availability and tracking reward payments under the following terms and conditions:

1. Overview. Customer will be responsible for providing approval of all necessary information required by Impartner to perform the Services, whether such information is provided by Customer, its customers, consultants, end users, advocates or other agents of Customer (“Users”) or Recipients (as defined below), including, but not limited to, the reward amount(s) (“Reward”) or data necessary for Reward calculation, the party to receive the applicable Reward (“Recipient”), and method of issuing the Reward. To the extent Impartner does not have the necessary information to process a Reward, Impartner shall notify Customer and Customer shall be solely responsible for providing the information or obtaining the information from the applicable User. Impartner shall not be liable or responsible for failing to process a Reward if the Recipient Information has not been provided to Impartner. Upon execution of the Order Form, Impartner will implement Customer’s specifications into Impartner’s Application management interface (“Interface”). For purposes of this Exhibit A, “Application” means a database and software web services application offered to Customer over the Internet and accessible by a URL designated by Impartner. For the avoidance of doubt, this Exhibit A does not provide for the licensing of the Application, which is subject to the terms and conditions in the Agreement.
2. Recipient Information. Customer, or a User on Customer’s behalf, is responsible for providing Impartner with the name of each Recipient and sufficient information to enable delivery of a Reward, including email address, physical address and/or bank account information (“Recipient Information”). Customer represents and warrants that it has obtained or has required Users to obtain all necessary consents, rights and permissions to disseminate or otherwise transfer such information, in writing, orally and/or electronically to Impartner for purposes of Impartner performing the Services. Customer agrees to indemnify, defend, and hold Impartner and its Payment Processors harmless against any claim or action brought by any User, Recipient or third party for an actual or alleged violation of this Section and any other losses, liabilities, damages and claims arising from Customer’s failure to obtain the necessary consents, rights or permissions. This obligation of Customer shall not be subject to any limitation of liability set forth in the Agreement.
3. Use of Third-Party Payment Processors. In order to provide the Services, Impartner may, in its sole discretion, utilize the services of one or more third-party networks, payments processor or providers (each a “Payment Processor”), such as gift card vendors or cash payment vendors to facilitate the transfer of funds. Impartner may change Payment Processors at any time in its sole discretion with or without notice to Customer. In the event Impartner determines, in its sole discretion, that it is unable to provide the Service due to a Payment Processor, Impartner may temporarily discontinue the Service or provide the Service through an alternate Payment Processor. In the event Impartner temporarily discontinues the Service or provides the Service through an alternate Payment Processor, Impartner shall have no liability to Customer for the unavailability or delays in providing the Service.
4. Reward Calculation. Prior to implementation of the Services, Customer and Impartner will agree in writing upon the method of calculating the Reward (i.e. a fixed Reward amount, a percentage of revenue, or other method of calculation as the parties may agree to in the Statement of Work or through a ticket submitted via Task View). As part of the Services, Impartner will calculate the amount of the Reward to be paid to each Recipient based upon the calculation method agreed upon in the Statement of Work. By using the Interface, Customer may change any variable amounts in the calculation. However, a change to the method of calculation shall require a Change Order to the Statement of Work if additional implementation services are required to be performed by Impartner. For purposes of this Exhibit A, “Change Order” means a ticket submitted via Task View.
5. Payments Approval. Impartner will determine Reward amounts based upon data provided by Customer and Users on Customer’s behalf. Impartner will attribute Reward payments to Recipients based upon the data received from Customer and Users of the Program. Customer shall remain solely responsible for the accuracy of this data. In addition, Customer has the option to approve Reward payments by using the Interface and auditing capabilities provided by the Application. In the event that Customer elects not to use such capabilities, Customer agrees and authorizes Impartner to approve all Rewards automatically. Further, Impartner shall have no liability or responsibility to Customer or a Recipient for the timeliness, accuracy, completeness or appropriateness of any data and/or information received by Impartner from Customer, Customer’s systems, other financial institutions or any Payment Processor, including for undelivered Reward payments. If Customer believes or suspects that the Application has been compromised in any manner, or has become known or accessed by an unauthorized person (whether or not employed by Customer), Customer agrees to promptly notify the Impartner. Such compromise or unauthorized access will not affect any Reward payments Impartner instructed a Payment Processor or Customer to make in good faith prior to Impartner’s receipt of Customer’s notification and for a reasonable time period thereafter.
6. Funding of Reward Payments. Prior to Impartner or its Payment Processor issuing a Reward payment, Customer must approve and provide sufficient funds for the Reward payments. Impartner will invoice Customer for the amount of the Rewards plus any applicable transaction fees as set forth in the Order Form. To expedite Reward payments, Customer may elect to prefund the Rewards account with Impartner on a periodic basis to assure that sufficient funds are available to make Reward payments and pay the applicable fees at the time that the Recipient is eligible to receive the Reward. Impartner will retain an accounting of differences between accumulated funds and Reward payments so that Customer can make adjustments to future prefunding amounts. Upon termination of this agreement, all unused prefunded amounts will be returned to Customer within thirty (30) days of the effective termination date. CUSTOMER AND IMPARTNER AGREE THAT IMPARTNER’S SOLE OBLIGATIONS ARE MANAGING AND FACILITATING THE REWARDS PAYMENTS PROCESS FOR CUSTOMER. ALL REWARDS ISSUED WILL BE APPROVED BY CUSTOMER AND ISSUED TO RECIPIENTS AT THE DIRECTION OF AND ON BEHALF OF CUSTOMER. IMPARTNER SHALL NOT FUND OR PAY ANY RECIPIENTS ON ITS OWN BEHALF OR FOR ITS OWN BENEFIT.
7. Reward Management and Payment Timing. Impartner will communicate to the Customer, as specified in the Order Form, the amount of Rewards to be paid, the names of the Recipients and the Recipient Information to issue Reward payments. If Impartner is using a Payment Processor to issue Reward payments, Impartner will use commercially reasonable efforts to initiate Reward payments at the mutually agreed intervals. If Rewards are to be issued in cash-equivalents, including checks, ACH (Automated Clearing House), or wire transfers, Impartner will accrue and issue the Reward payments on a monthly basis, unless otherwise agreed upon in the Order Form. Notwithstanding the foregoing, Customer understands that circumstances beyond Impartner’s reasonable control may cause delays in payment, including, but not limited to, acts of god, utility or telecommunications failures, electrical outages, storms or other elements. For certain payment types, actual payment delivery date is dependent upon activities such as Payment Processor schedules, banking system transfer times, or postal service delivery times. For any Reward payment that requires the use of an account name and account number, if the account name and account number do not match, any financial institution involved in the Reward payment may, in its sole discretion, reject the Reward payment or rely solely upon the account number or other identifying number provided by Customer.
8. Payments Compliance. Customer is solely responsible for determining if a Reward payment or designated Recipient receiving a Reward would violate any provision of any present or future risk control program of the Federal Reserve, Office of Foreign Assets Control (OFAC) policy, Presidential Order, Financial Industry Regulatory Authority (FINRA) policy, any anti-money laundering (AML), anti-terror regulations or other applicable Law. For the purposes of this Exhibit A, “Law” means all federal, state and local laws, statutes, rules, codes, directives, regulations, orders and ordinances, as enacted and/or amended from time to time and any rule, regulation, order, directive or decision of any governing trade association, as enacted and/or amended from time to time, including, as applicable, NACHA, Electronic Check Clearing House Organization, card associations, clearinghouses, networks and/or other associations involved in transactions under this Exhibit A. In addition to the foregoing, Impartner may suspend the Services if: (a) the Reward payment violates, in Impartner’s sole reasonable opinion, any of the foregoing, (b) Customer is in beach of the Agreement or this Exhibit A, (c) Customer has not provided sufficient funds to complete the Reward payment (including applicable fees), (d) Customer has provided insufficient Recipient Information, or (e) Impartner, in its sole discretion, determines that there is or may be compromise of or unauthorized access to the Service.
9. Currency Exchange Rates. If Customer requests that Impartner calculate Reward amounts in non-US currency, Impartner will calculate estimated amounts that Customer can expect to fund using currency exchange rates publicly available on the date that the Reward to be paid is submitted to Impartner or approved for payment. Notwithstanding the foregoing, if a Recipient is receiving a Reward payment outside of the U.S. in a foreign currency, such Reward payment will be subject to the then-prevailing currency exchange rates at the time a Reward payment is made regardless of any prior estimated amounts provided by Impartner. Customer acknowledges that Reward amounts provided prior to the Reward payment are solely estimates and may not reflect the actual amount that Customer is required to fund. In addition, before releasing foreign Reward payments, Impartner will invoice Customer for expected costs based upon the then-prevailing currency exchange rate plus an additional percentage, up to five percent (5%) (“Float”) to set off any differences between the currency conversion rate at the time of invoice and the rate at the time of expected funding by the Customer and the currency conversion rate at the time of actual release of the foreign Reward payment. Impartner, will retain an accounting of the Float so that subsequent invoices may be adjusted to keep the accumulated Float amount within a reasonable amount. Upon termination of this Exhibit A, any unused Float amounts will be returned to Customer.
10. Limitation of Liability. Unless as otherwise agreed upon in this Exhibit A, each party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to this Exhibit A, whether in contract, tort or under any other theory of liability, is subject to the ‘Limitation of Liability’ section of the Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and this Exhibit A. For the avoidance of doubt, Impartner’s and its Affiliates’ total liability for all claims from the Customer and all of its Authorized Affiliates arising out of or related to the Agreement and this Exhibit A shall apply in the aggregate for all claims under both the Agreement and this Exhibit A, including by Customer and all Authorized Affiliates, and, in particular, shall not be understood to apply individually and severally to Customer and/or to any Authorized Affiliate that is a contractual party to any such Exhibit A. Also, for the avoidance of doubt, each reference to the Exhibit A in this Exhibit A means this Exhibit A including its Schedules and Exhibits.
11. Reporting and Forms. Customer acknowledges that it is not possible for the Services to be free of operator, program or equipment error and that errors in processing and compiling Reward related data may occasionally occur, requiring adjustments. As such, Customer agrees to review and verify all results and to maintain adequate controls for ensuring both the accuracy of data transmissions and the detection of errors. If the Services require Impartner to provide Customer or Recipients, on Customer’s behalf, with reports, forms or other tax documentation, including Form 1099 (“Documentation”) and Customer notifies Impartner within thirty (30) days of receiving the Documentation that such Documentation is not accurate, Impartner may, when Impartner, in its sole discretion, determines it feasible to do so, correct such Documentation and provide the corrected Documentation to Customer. For clarification, any Documentation provided to Recipients by Impartner is on behalf of Customer, and Customer shall be designated as the Payer for the purposes of such Documentation. Customer agrees to pay all fees and amounts incurred by Impartner in providing such Documentation to Recipients. Customer agrees to indemnify, defend, and hold Impartner and its Payment Processors harmless against all claims or actions for an actual or alleged violation of this Section, obligation to report income or payments, and any other losses, liabilities, damages and claims arising from Customer’s failure to properly report taxes under this Exhibit A. This obligation of Customer shall not be subject to any limitation of liability set forth in the Agreement.
12. Term and Termination. This Exhibit A shall have the same term as the Agreement. This Exhibit A may only be terminated as described in the Agreement.
13. Effect of Termination or Breach on Reward Payments. In the event of termination or breach of this Exhibit A, Customer shall remain responsible for the funding of any approved Reward payments to Recipients through the effective date of such termination and for all fees and charges for the Services for the processing of Reward payments through and after the effective date of such termination.

Exhibit B: Acceptable Use Policy

This Impartner Acceptable Use Policy sets out a list of acceptable and unacceptable conduct for our Services. Customer is responsible for compliance with this policy. Any violation of this policy is a breach of the Impartner Terms of Use. Capitalized terms used herein shall have the definition assigned to them in the Terms of Use.

Portal Users must do each of the following:

• Keep passwords and all other login information confidential;
• Monitor and control all activity conducted through Customer’s account in connection with the Services;
• Promptly notify Impartner if Customer becomes aware of or reasonably suspect any illegal or unauthorized activity or a security breach involving Customer’s accounts or teams, including any loss, theft, or unauthorized disclosure or use of a username, password, or account;
• Comply in all respects with all applicable terms of the third party applications, including any that Customer elects to integrate with the Services that you access or subscribe to in connection with the Services. Comply with all third-party terms of use applicable to Customer’s use of the Services, including the terms of this Acceptable Use Policy;
• Comply with all applicable statutes, ordinances, regulations, rules, orders, treaties, and other laws, including, but not limited to, all intellectual property, security, privacy, and export control laws, and regulations promulgated by any government agencies, including, but not limited to, the U.S. Securities and Exchange Commission, and any rules of any national and other securities exchanges;
• Upload and disseminate only Customer Data to which Customer owns all required rights under law and under contractual and fiduciary relationships (such as proprietary and confidential information learned or disclosed as part of employment relationships or under nondisclosure agreements) and do so only consistent with applicable law;
• Use the Services only for the benefit of Customer and only for the purposes requested by the Customer;
• Use commercially reasonable efforts to prevent unauthorized access to or use of the Services; and

Portal Users may not do any of the following:

• Upload to, or transmit from, the Services any data, file, software, or link that contains or redirects to a virus, Trojan horse, worm, or other harmful component or a technology that unlawfully accesses or downloads content or information stored within the Services or on the hardware of Impartner or any third party or otherwise may compromise the security of the Services or Impartner’s systems;
• Attempt to reverse engineer, decompile, hack, disable, interfere with, disassemble, modify, copy, translate, or disrupt the features, functionality, integrity, or performance of the Services (including any mechanism used to restrict or control the functionality of the Services) and any source code associated with the Services, any third party use of the Services, or any third party data contained therein (except to the extent such restrictions are prohibited by applicable law);
• Interfere with or disrupt the integrity or performance of the Service or any content contained therein;
• Use the Services to store, upload, or transmit any harassing, offensive, abusive, pornographic, or illegal content or for the purposes of engaging in any harassment, abuse or unethical or illegal activity;
• Permit any third party that is not an Portal User to access or use a username or password for the Services;
• Share, transfer or otherwise provide access to an account designated for Customer to another person;
• Use the Services to store, upload, or transmit any data or other information or content that infringes upon or misappropriates someone else’s trademark, copyright, or other intellectual property right, or any privacy or publicity right, or that otherwise may be tortious or unlawful;
• Attempt to gain unauthorized access to the Services or related systems or networks or to defeat, avoid, bypass, remove, deactivate, or otherwise circumvent any software protection or monitoring mechanisms of the Services;
• Access the Services in order to build a similar or competitive product or service or copy any ideas, features, functions, or graphics of the Services;
• Use the Services in any manner that may harm minors or that interacts with or targets people under the age of thirteen;
• Impersonate any person or entity, including, but not limited to, an employee of Impartner’s, an Admin User, any Partner, any Impartner customer, or any other portal user, or falsely state or otherwise misrepresent your affiliation with a person, organization or entity;
• Use the Services to provide material support or resources (or to conceal or disguise the nature, location, source, or ownership of material support or resources) to any organization(s) designated by the United States government as a foreign terrorist organization pursuant to section 219 of the Immigration and Nationality Act or other statutes, regulations, or other laws concerning national security, defense or terrorism;
• Use the Services to export any information or content to foreign nationals or countries in violation of any export controls, embargoes, or other statutes, regulations, or other laws;
• Access, search, or create accounts for the Services by any means other than Impartner’s supported interfaces (for example, by “scraping” or creating accounts in bulk);
• If individual consents are required to collect, use, transfer or otherwise process any data processed by the Services, including data subject to data privacy laws and regulations, Customer shall be solely responsible for obtaining all such consents.
• Use the Services to send unsolicited communications, promotions, advertisements, or spam unless done so in compliance with applicable data privacy laws and regulations (e.g., CAN-SPAM, CCPA, GDPR);
• Send altered, deceptive or false source-identifying information, including “spoofing” or “phishing”;
• Abuse referrals or promotions to get more credits than deserved;
• Sublicense, resell, or similarly exploit the Services;
• Use the Services for consumer, personal, or household purposes, as Impartner is solely intended for use by business entities and organizations;
• Use contact or other user information obtained from the Services (including email addresses) to contact portal users outside of the Services without their express permission or authority, or to create or distribute mailing lists or other collections of contact or user profile information of portal users for use outside of the Services; or
• Authorize, permit, enable, induce or encourage any third party to do any of the above.

If we believe a violation of this Acceptable Use Policy has occurred, upon providing you with a commercially reasonable opportunity to cure, such cure period to be directly commensurate with the severity of the violation, we may suspend your access to the Services upon providing you with notice and opportunity to cure, or in the event of imminent harm, without providing notice to you.

Exhibit C: Data Processing Addendum

This Data Processing Addendum (“DPA”), is made pursuant to the order form to which it is attached (the “Order Form”), by and between Impartner, Inc. (“Impartner”) and the customer indicated on page 1 of the Order Form (“Customer,” or “Data Controller”). This DPA will govern the Order Form as well as any subsequent order forms, amendments, and/or renewals, unless otherwise expressly agreed in writing between the parties. The Order Form and any exhibits attached thereto, including this DPA, shall be referred to collectively herein as the “Agreement.”

This DPA reflects the parties’ agreement with regard to the Processing of Personal Data. All capitalized terms in this DPA have the meaning assigned to them in the Order Form, Subscription Agreement / Terms of Use, and any other exhibits attached thereto, unless expressly defined otherwise in this DPA. In the event of any conflict/s between the Order Form, Subscription Agreement / Terms of Use, and Data Processing Addendum, unless expressly indicated otherwise, the order of precedence shall be: (i) Data Processing Addendum, (ii) Order Form, (iii) Subscription Agreement. Any exhibits will be incorporated by reference and shall take the precedence of the document to which it has been addended.

In the course of providing the Service to Customer pursuant to the Agreement, Impartner may Process Personal Data on behalf of Customer and the parties agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.

Introduction

A. Customer is a Controller or Processor of certain Personal Data and wishes to appoint Impartner as a Processor or sub- processor to Process this Personal Data on Customer’s behalf.

B. The parties have entered into this DPA to ensure that Impartner conducts such data Processing in accordance with Customer’s instructions and Applicable Data Protection Law requirements, and with full respect for the fundamental data protection rights of the Data Subjects whose Personal Data will be Processed.

Definitions

In this DPA, the following terms shall have the following meanings. Other capitalized terms used in this DPA are defined in the context in which they are used or shall have the meanings given such terms in the Order Form or Subscription Agreement.

“Applicable Data Protection Law” shall mean: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or “GDPR”) and any data protection laws in any European Union Member State including laws implementing such Regulation, (ii) the California Consumer Privacy Act of 2018 (“CCPA”), including any regulations promulgated thereunder, as amended from time to time; (iii) the UK GDPR, and (iv) any other applicable data protection law.

“Controller” means the entity which determines the purposes and means of the Processing of Personal Data.

“Data Subject” means the identified or identifiable person to whom Personal Data relates.

“EU Standard Contractual Clauses” / “EU SCCs” means Module Two of the standard contractual clauses for the transfer of Personal Data, in accordance with Applicable Data Protection Law, to Controllers and Processors established in Third Countries, the approved version of which is in force at the date of signature of this Agreement that are in the European Commission’s Decision 2021/914 of 4 June 2021, as such standard contractual clauses are available at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en, and as may be amended or replaced by the European Commission from time to time, and as further defined in clause 4 of this DPA.

“Personal Data” means any information relating to (i) an identified or identifiable natural person and, (ii) an identified or identifiable legal entity (where such information is protected similarly as personal data or personally identifiable information under applicable Data Protection Laws and Regulations), where for each (i) or (ii), such data is Customer Data.

“Processing” (and “Process“) means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Processor” means the entity which Processes Personal Data on behalf of the Controller.

“Supervisory Authority(ies)” shall carry the meaning of that term in the GDPR.

“UK Standard Contractual Clauses” / “UK SCCs” means the standard contractual clauses for controllers to processors approved by the European Commission by way of Commission Decision C(2010)593, as amended by the UK Information Commissioner’s Office for use in a UK context, available on the date of this Agreement at https://ico.org.uk/media/for-organisations/documents/2618973/uk-sccs-c-p-202012.docx, and as may be amended or replaced by the Information Commissioner’s Office or/and Secretary of State from time to time.

Data Protection

1. Relationship of the parties. Customer appoints Impartner as a Processor, or service provider, to Process the Personal Data that is the subject matter of the Agreement (the “Data“). Accordingly, the parties acknowledge and agree that with regard to the Processing of Personal Data, Customer is the Controller and Impartner is the Processor. Each party shall comply with the obligations that apply to it under Applicable Data Protection Law. Customer hereby represents and warrants that Customer complies with the requirements in the Applicable Data Protection Law in collecting and transferring the data to Impartner and permitting Impartner to act as a processor of the Data. Customer agrees that it will not disclose any special categories of personal information to Impartner and Customer will indemnify Impartner from any third-party claims against Impartner as a result of such disclosure.
2. Purpose limitation. Customer hereby instructs Impartner to Process Personal Data and to transfer Personal Data to any country or territory as necessary for the provision of the Service and consistent with the Agreement. Customer’s instructions for the Processing of Personal Data shall comply with Applicable Data Protection Law. Customer shall have sole responsibility for the accuracy, quality, and legality of the Data and the means by which Customer acquires the Data. Impartner shall Process the Data as a Processor only as necessary to perform its obligations under the Agreement, and in accordance with the documented instructions of Customer (the “Permitted Purpose“), except where otherwise required by any EU (or any EU Member State) law applicable to Impartner, in which case Impartner shall to the extent permitted by Applicable Data Protection Law inform Customer of that legal requirement before the relevant Processing of that Data. In no event shall Impartner Process the Data for its own purposes or those of any third party except as set forth in the Agreement. Impartner shall also inform Customer if in its opinion an instruction of Customer infringes or violates Applicable Data Protection Law. Impartner shall not sell the Data, nor process, retain, use, or disclose the Data (i) for any purposes other than the Permitted Purpose, or (ii) outside of the direct business relationship between Impartner and Customer.
3. Details of the Processing. Annex 1 to this DPA sets out certain information regarding Impartner’s Processing of the Data as required by Article 28(3) of the GDPR. Either party may make reasonable amendments to Annex 1 by written notice to the other party from time to time as such party reasonably considers necessary to meet those requirements. Nothing in Annex 1 (including as amended pursuant to this Section 3) confers any right or imposes any obligation on any party to this DPA.
4. International transfers. Impartner shall not transfer any Personal Data of European Economic Area (“EEA“) / UK Data Subjects (nor permit such Personal Data to be transferred) outside of the EEA / UK unless (i) it has first obtained Customer’s prior written consent; and (ii) it takes such measures as are necessary to ensure the transfer is in compliance with Applicable Data Protection Law. Such measures may include (without limitation) transferring the Personal Data to a recipient in a country that the European Commission / UK authorities have decided provides adequate protection for Personal Data, or to a recipient that has achieved binding corporate rules authorization in accordance with Applicable Data Protection Law, or to a recipient that has executed the Standard Contractual Clauses adopted or approved by the European Commission / UK Secretary of State or the UK Information Commissioner (and approved by the UK Parliament). Partner hereby consents to the transfer of Personal Data to Impartner in the United States and the parties agree that the EU / UK Standard Contractual Clauses will apply to any such transfer, as appropriate.

A. The EU SCCs shall be deemed incorporated in this Agreement as follows:

• • Clause 7 of the EU SCCs, the “Docking Clause (Optional)”, shall be deemed incorporated;
  • in Clause 9 of the EU SCCs, the Parties choose Option 2, ‘General Written Authorisation’, with a time period of 10 days;
  • the optional wording in Clause 11 of the EU SCCs shall be deemed not incorporated;
  • in Clause 17 of the EU SCCs, the Data Exporter and Data Importer agree that the EU SCCs shall be governed by the laws of the Netherlands and choose Option 1 to this effect;
  • in Clause 18 of the EU SCCs, the Data Exporter and Data Importer agree that any disputes shall be resolved by the courts of the Netherlands;
  • Annexes I.A, I.B, I.C, II and III of the EU SCCs shall be deemed completed with the information set out in Annex 1, Annex 2 and Annex 3 to this DPA.

B. Where the UK SCCs apply (i.e., for transfers from UK to countries, which were not recognized as providing adequate protections by UK authorities), they will be deemed incorporated in this Agreement as follows:

• • in Clause 9 of the UK SCCs, the Parties agree that UK SCCs shall be governed by the laws of the United Kingdom.
  • in Clause 12 of the UK SCCs, the Optional “Indemnification” and “Priority of standard contractual clauses” Clauses are deemed not incorporated;
  • Annex 1 and 2 of the UK SCCs shall be deemed completed with the information set out in Annex 1 and Annex 2 of this DPA; and
  • in light of the obligations of the parties under UK SCCs, read in light of the Schrems II judgment issued by the Court of Justice of the European Union on July 16, 2020 (“Schrems II”), in regard to the transfer of personal data by Data Exporter from the UK to Data Importer located outside the UK in countries, which were not granted an adequacy decision by the UK Secretary of State (“Third Country”), parties hereby warrant to honour the supplementary safe-guards, as outlined in Annex 4 to UK SCCs, which forms its integral part. For the avoidance of doubt, this clause shal be referred to as the Supplementary Safeguards clause. In case of conflict between this Supplementary Safeguards Clause, and the UK SCCs, the UK SCCs shall prevail.

1. Confidentiality of Processing. Impartner shall ensure that any person that it authorizes to Process the Data (including Impartner’s staff, agents and subcontractors) (an “Authorized Person“) shall be subject to a strict duty of confidentiality (whether a contractual duty or a statutory duty) and shall not permit any person to Process the Data who is not under such a duty of confidentiality. Impartner shall ensure that all Authorized Persons Process the Data only as necessary for the Permitted Purpose.
2. Security. Impartner shall implement appropriate technical and organizational measures to protect the Data (i) from accidental or unlawful destruction, and (ii) loss, alteration, unauthorized disclosure of, or access to the Data (a “Security Incident”). Such measures shall take into account the state of the art, the costs of implementation and the nature, scope, context and purpose of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. Such measures may include those listed in Appendix 2.
3. Sub-processing. Impartner may subcontract any processing of the Data to a third-party subcontractor (“sub-processor“) in accordance with the Applicable Data Protection Law. Customer hereby specifically authorizes the engagement of Impartner’s current sub-processors as identified on Annex 3. Impartner will impose data protection terms on its sub-processors to the same standard as provided for by this DPA. In the event that Impartner desires to add or replace any sub-processor, Impartner will provide at least 10 days’ prior notice of the addition or replacement of any sub-processor (including details of the processing it performs or will perform). Customer may object to Impartner’s addition or replacement of a sub-processor prior to its appointment or replacement, provided such objection is based on reasonable grounds relating to data protection. Customer consents to Impartner engaging other third party sub-processors to Process the Data provided that: (i) Impartner obtains Customer’s written consent; (ii) Impartner imposes data protection terms on any sub-processor it appoints that protect the Data to the same standard provided for by this DPA; and (iii) Impartner remains fully liable for any breach of this DPA that is caused by an act, error or omission of its sub-processor. Customer may object to Impartner’s appointment or replacement of a third- party sub-processor, provided such objection is on reasonable grounds relating to the protection of the Data. In such event, Impartner will either not appoint or replace the sub-processor or, if this is not possible, Customer may suspend or terminate this DPA and the Agreement (without prejudice to any fees incurred by Customer prior to suspension or termination). Customer will not directly communicate with Impartner’s sub-processors about the Service unless agreed to by Impartner.
4. Cooperation and Data Subjects’ rights. Impartner shall provide all reasonable and timely assistance (including by appropriate technical and organizational measures) to Customer to enable Customer to respond to: (i) any request from a Data Subject to exercise any of its rights under Applicable Data Protection Law (including its rights of access, correction, objection, erasure and data portability, as applicable); and (ii) any other correspondence, inquiry or complaint received from a Data Subject, regulator or other third party in connection with the Processing of the Data. In the event that any such request, correspondence, inquiry or complaint is made directly to Impartner, Impartner shall promptly inform Customer. To the extent legally permitted, Customer shall be responsible for any costs arising from Impartner’s provision of the assistance described in this paragraph. Communications pertaining to the foregoing shall be sent to dataprocessing@impartner.com.
5. Data Protection Impact Assessment. If Impartner believes or becomes aware that its Processing of the Data is likely to result in a high risk to the data protection rights and freedoms of Data Subjects, it shall promptly inform Customer and provide Customer with all such reasonable and timely assistance as Customer may require in order to conduct a data protection impact assessment and, if necessary, consult with its relevant data protection authority.
6. Security incidents. Upon becoming aware of a Security Incident, Impartner shall inform Customer without undue delay after becoming aware of the Security Incident, and shall provide all such timely information and cooperation as Customer may require in order for Customer to fulfill its data breach reporting obligations under (and in accordance with the timescales required by) Applicable Data Protection Law. Impartner shall further take all such measures and actions as are necessary to remedy or mitigate the effects of the Security Incident and shall keep Customer apprised of all developments in connection with the Security Incident.
7. Deletion or return of Data. Upon termination or expiry of the Agreement, Impartner shall (at Customer’s election) destroy or return to Customer all Data (including all copies of the Data) in its possession or control (including any Data subcontracted to a third party for Processing). This requirement shall not apply to the extent that Impartner is required by any EU (or any EU Member State) law to retain some or all of the Data.
8. Audit. Impartner will submit to audits and inspections in relation to the Processing of Data, at Customer’s sole cost and expense, and will provide Customer with whatever information it needs to ensure that they are both meeting their obligations under Article 28 of GDPR. Customer agrees that its requests to audit Impartner may be satisfied by Impartner presenting up- to-date attestations, reports or extracts from independent bodies, including without limitation external or internal auditors, Impartner’s data protection officer, data protection or quality auditors or other mutually agreed to third parties) or certification by a regulatory body by way of an IT security or data protection audit. Customer shall not exercise its audit rights under this DPA more than once per year, and no such audit may be exercised in a manner that (i) disrupts Impartner’s normal business operations, or (ii) causes Impartner to breach any obligation of confidentiality to another customer or to any other third party, whether imposed by regulation or contract.
9. Sub-processor Audits. Customer may not audit Impartner’s sub-processors without Impartner’s and Impartner’s sub- processor’s prior agreement. Customer agrees that its requests to audit sub-processors may be satisfied by Impartner or Impartner’s sub-processors presenting up-to-date attestations, reports or extracts from independent bodies, including without limitation external or internal auditors, Impartner’s data protection officer, the IT security department, data protection or quality auditors or other mutually agreed to third parties) or certification by way of an IT security or data protection audit. Onsite audits at sub-processors premises may be performed by Impartner or a mutually agreed to auditor under a confidentiality agreement acting on behalf of Customer.
10. Limitation of Liability. Each party’s liability arising out of or related to this DPA, whether in contract, tort or under any other theory of liability, is subject to the ‘Limitation of Liability’ section of the Agreement.
11. Processing for Statistical Purposes. Impartner may Process Data for statistical purposes following the termination or expiration of the Agreement. Any such Processing shall be subject to appropriate safeguards, as provided in Article 89 of the GDPR, for the rights and freedoms of the Data Subject. Those safeguards will ensure that technical and organizational measures are in place in particular in order to ensure respect for the principal of data minimization. Those measures may include pseudonymization or that the Processing does not permit the identification of Data Subjects.
12. Miscellaneous:

A. Headings. Headings in this DPA are for convenience of reference only and will not constitute a part of or otherwise affect the meaning or interpretation of this DPA.

B. Entire Agreement. This DPA (including all schedules and appendices thereto) and the Agreement constitute the entire agreement between the parties relating to the subject matter of this DPA and supersede all prior agreements, understandings, negotiations and discussions of the parties in relation to the subject matter of this DPA.

C. Severability. The provisions of this DPA are severable. If any phrase, clause or provision is invalid or unenforceable in whole or in part, such invalidity or unenforceability will affect only such phrase, clause or provision, and the rest of this DPA will remain in full force and effect.

D. Notices. Any notice or other communication under this DPA given by either party to the other will be deemed to be properly given if given in writing and delivered (i) in person, (ii) by electronic mail to the email addresses agreed to between the parties, or (iii) in accordance with the Notice provision of the Agreement. Either party may from time to time change its address for notices under this Section by giving the other party notice of the change in accordance with this Section.

E. Third-party Rights. The provisions of this DPA will endure to the benefit of and will be binding upon the parties and their respective successors and assigns.

F. Counterparts. This DPA may be executed in counterparts, each of which will be deemed an original, but all of which together will constitute one and the same instrument. Execution of an Agreement incorporating the terms of this DPA shall be deemed to be execution of this DPA including all attachments.

G. Governing Law. This Addendum will be governed by and construed in accordance with the governing law of the Agreement, without regard to its conflict of laws principles, except to the extent that Applicable Data Protection Law(s) require otherwise, in which event this DPA will be governed in accordance with Applicable Data Protection Law.

H. Signatures. This DPA has been signed on behalf of each of the parties by a duly authorized signatory.

Exhibit D: Types of Support

Impartner Standard Support (Included with every purchase)

What qualifies as “Customer Support” and as free or included support?

• General Guidelines
  • Related to standard / core functionality
  • Will resolve bugs, outages, standard capability not functioning as intended
  • Support is provided based upon items included in your current contract
  • Support team will provide direction on where to find videos and documentation for questions related to self-service items.
• If the ticket is related Impartner outages, bugs or core capabilities not functioning properly there is no charge related to these types of items.
• Client may request that Impartner support team perform work that the client could do themselves, but this will be a chargeable item. IE Professional Services
  • Please note that delivery timeline will be based on best efforts of resource availability. 

Impartner Premier Support (Specific Line Item on Order Form or Billed Hourly)

Professional Services (Billable Service)

• Any support services requested related to custom functionality is considered professional services and billable to the client.
• Break/Fix issue related to configuration that is broken due to configuration changes made.
  • CRM Sync is a good example. If the client makes a change in SFDC or CRM Sync and breaks the integration properly working as an example; Impartner support can diagnose and fix that issue as it relates to the Impartner solution as a billable charge.
  • Please note that Impartner is not support for your CRM instance.
• Customer training after implementation can be purchased to further educate your team or assist new team member in the event of new employees or changes to staff.
• Any support or modifications related to non-standard features, including the customer’s CPQ Integration support
• Custom functionality is not done through support. SOW and contracts need to be done to complete custom work.
• Examples:
  • Portal design / look & feel –This is unique design and customization work unless using an Impartner standard template.
• Having Impartner staff build any of the following for you are considered billable events:
  • Workflows
  • Partner Journeys
  • T&C tests, quizzes, certs etc.
  • Email campaigns

Impartner Platinum Support (TAM, Annual Billing)

A Technical Account Manager is one of the best ways to anticipate the needs of your evolving company for an extended period of time. If your company has a lot of changes and moving parts for an ongoing basis or has elected to utilize a significant amount of custom work a TAM is a great solution. The TAM will be a dedicated resource for your company that understands your business model, process and solution configuration. You will work with the same resource for everything related to your solution and they become an extension of your company and resource pool. Please note that a TAM is available for no less than ¼ time with a minimum of one year commitment given the level of dedicated solution expertise. For clarity, all services related to Custom/Non-standard Developed Functionality shall be treated as professional services engagements. Creating new functionality is not the role of a TAM.

Exhibit E: Service Level Agreement

Production Commitment

Development & Stage Commitment