VENUETWIN VIEWER - PARIS 2024 - TERMS OF USE (“TERMS”)

VENUETWIN VIEWER – PARIS 2024 – TERMS OF USE (“TERMS”)

Defined/capitalised terms have the meaning given in the body of these Terms or in clause 14 of these Terms.

Terms of Service last updated 28 November 2023.

1. Introduction

VenueTwin Viewer – Paris 2024 is a digital platform that allows users such as National Olympic Committees, National Paralympic Committees, International and National Federations, IOC and Paris 2024’s partners and other organisations (“Customer”, “you”, “your”), which have been approved by the Paris 2024 Organising Committee for the Olympic and Paralympic Games (“Paris 2024”) to conduct virtual site visits of certain competition venues to be used at the Paris 2024 Olympic and Paralympic Games (the “Games”) subject to the provision of this Terms.  The Service is provided by OnePlan on behalf of Paris 2024 and allows users to ‘walkthrough’ virtual 3D models of the Games venues (“3D Models”). Due to rights restrictions, some authorised Users will not have access to all Games venues, and where access is granted such access can either be free of charge or subject to an entry fee (as provided on the Rate Card Ordering Platform).

Access to the Service will be provided to Customers that have been previously approved by Paris 2024. These Terms confirm the terms and conditions under which Customers: (a) may access and use the Service; and (b) where applicable, agree to purchase a subscription to the Service.  Clauses in these Terms that refer to Charges or purchasing of subscriptions do not apply to Customers that have access to one User Account free of charge. 

If you are an individual accessing or using the Service on behalf of Customer, you represent that you are authorised to accept these Terms on behalf of Customer, and all references to “you” are deemedreferences to “Customer”. OnePlan may modify these Terms from time to time as permitted in clause 13.4 (Modifications to Terms).

2. About us and our contract with you

2.1 Company details. One Plan Limited (company number 11695518) (“OnePlan”, “we”, “us” and “our”) is a company registered in England and Wales and our registered office is at 124 City Road, London, England, EC1V 2NX. OnePlan operates the Service on behalf of Paris 2024.

2.2 Official Supporter of Paris 2024. We are Official Supporter of GIS Mapping and Digital Twin Software for the Paris 2024 Olympic Games and Paralympic Games.

2.3 Contacting us. To contact us with regard to any problem related to the VenueTwin Viewer – Paris 2024 digital platform please contact your Paris 2024 point of contact for support.

2.4 Our contract. These Terms apply to your use of the Service, whether paid or unpaid. They apply to the exclusion of any other terms that you seek to impose or incorporate, or which are implied by law, trade custom, practice or course of dealing. Each Order shall form a separate contract,incorporating these Terms to the exclusion of all other terms.

3. Right to use the Service

3.1 Grant of right.  Subject to your compliance with these Terms, OnePlan grants to Customer a limited, non-exclusive, non-transferable right during the Service Term to access and use the Service, solely for use by Customer and its Users, and always in accordance with the Terms, the Order,and the User Guides. Customer acknowledges that to access the Service it must meet the Recommended System Requirements.

3.2 Compliance with Applicable Law.  Paris 2024 and OnePlan will provide the Service in accordance with their obligations under applicable law.

3.3 Updates to the Service.  Customer acknowledges that OnePlan will be entitled to change, improve,and update the Service, using reasonable endeavours to ensure that any such modification does not materially adversely affect Customer’s use of the Service. 

4. Your obligations

4.1 Restrictions on use of the Service.  The Service and its content, in particular the 3D Models, are protected by several applicable laws. Any use of the Service not in accordance with these Termsmay constitute infringement of such laws.  The Service and its content should be used only for the purpose of organizing your involvement with the Games. Any use of the Service or the 3D Models for any communication, promotional, or marketing purposes is prohibited unless expressly authorized in advance and in writing by OnePlan and Paris 2024. Except as expressly granted in these Terms, Customer shall not (and will procure that Users will not): (a) copy, reproduce, republish, duplicate publish, distribute, broadcast, transmit, transfer, modify, adapt, edit, abstract, store, archive, display publicly or to a third party, sell, license, lease, rent, assign, transfer, disclose (in each case whether or not for charge) or in any way commercially exploit any part of the Service (including the 3D Models); (b) permit any use of the Service in any manner by any third party (including permitting use in connection with any timesharing or service bureau, outsourced or similar software to third parties or making the Service (or any part) available to any third party, or allow or permit a third party to do any of the foregoing); (c) combine, merge or otherwise permit the Service to become incorporated in any other program or similar software, or arrange or create derivative works based on it (in whole or in part); (d) attempt to scrape, data mine, reverse engineer, observe, study, or test the functioning of or decompile the Service (or any part of it) or otherwise seek to obtain the source code or non-public APIs to the Service, except to the extent expressly permitted by applicable law (and then only with prior notice to OnePlan); (e) remove or obscure any proprietary or other notices contained in the Service; (f) use the Service to develop a similar or competing product or service; (g) use the Service to store or transmit viruses or material which contains illegal content; or (h) allow Users to share User Accounts. Customer is expressly prohibited from reselling the Service without OnePlan’s express written consent.

5. Charges

5.1 Free User Account. Each Customer is entitled to one User Account free of charge. 

5.2 Payment of Charges. For additional User Accounts, Customer must pay the Charges to Paris 2024, as detailed in the Order. 

6. Users

6.1 Permitted Users. Only an authorised User may access and use the Service. Users may only access the Service with an email address that contains a domain name that has been previously approved by Paris 2024. OnePlan will manage Customer’s User accounts, unless we allow anadministrator from Customer to do so. 

6.2 Responsibility for Users.  Customer is responsible and liable for its Users’ actions through the Service and for their compliance with the Terms. Customer will ensure that Users keep the access credentials and their passwords confidential and will promptly notify OnePlan upon learning of any compromise of User accounts or credentials. Any login/access, forbidden use or data transmission made using your credentials will be deemed to have been made by you.  Customer shall procure that each User is aware of, and complies with, the obligations and restrictions imposed on Customer under these Terms.  

6.3 User Account.  In relation to the Users, Customer undertakes that: (a) the maximum number of Users who concurrently use the Service at any given time will not exceed the number of User Accounts purchased by Customer; and (b) it will not allow any User Account to be used by more than one User unless it has been reassigned in its entirety to another individual User, in which case the prior user shall no longer have any right to access or use the Service.  

6.4 Additional User Accounts.  Customer may from time to time during the Service Term, purchase additional User Accounts by making an additional Order. Where Paris 2024 has approved the Users (or Users’ email domain), OnePlan will activate the additional User Accounts. The applicable Charges for such additional User Accounts will form part of the Charges invoiced toand payable by Customer.

6.5 Unauthorised use.  Customer will use all reasonable endeavours to prevent any unauthorised access to, or use of, the Service and/or the User Guides and, in the event of any such unauthorised access or use, promptly notify OnePlan. The Service is not intended for, and may not be used by, anyone under the age of 18. Customer is responsible for ensuring that all Users are at least 18 years old.

7. Warranties and disclaimers

7.1 Limited warranty. OnePlan warrants that: (a) the Service will operate materially in accordance with its description in the User Guides when used in accordance with such User Guides and under normal circumstances during the relevant Service Term; and (b) OnePlan will not materially decrease the functionality of the Service during the Service Term.

7.2 Warranty Remedy.  If OnePlan breaches a warranty in clause 7.1, and Customer makes a reasonably detailed warranty claim within 7 days of discovering the issue, OnePlan will use reasonably commercial efforts to correct the issue.  If OnePlan cannot so within a reasonable time period, Customer may terminate the Service and, as its sole remedy, will be entitled to receive a refund of any unused Charges pre-paid for the Service after the date of termination. The warranties in clauses 7.1 will not apply to the extent that any error arises as a result of: (a) incorrect operation or use of the Service by Customer or a User; (b) use of the Service with other software or services or on equipment with which it is incompatible or that are provided by a third party; or (c) any unapproved modification of the Service. This clause 7.2 sets out Customer’s sole and exclusive remedy, and OnePlan’s sole and exclusive liability, for any breach of the warranties in clause 7.1. 

7.3 Disclaimers.  Other than as expressly stated in these Terms, the Service is provided ‘as is’ and without warranty, whether express or implied, statutory or otherwise, to the maximum extent permitted by law. 

8. Intellectual property and publicity

8.1 Ownership.  Other than as expressly stated in these Terms, neither party grants the other any right, title or interest. As between the parties, OnePlan (or its licensor(s), as applicable) owns all Intellectual Property Rights in and to the Service, the 3D Models, and all related software, tools, databases, data, methodologies, other materials, and all associated know-how. Customer acknowledges that the Service is offered as an online, hosted solution, and therefore Customer has no right to obtain a copy of the underlying computer code of the Service software.  

8.2 Feedback. OnePlan may freely use and incorporate into its Service any suggestions, enhancement requests, recommendations, corrections, or other feedback provided by Customer or by any Users relating to the Service (“Feedback”), it being acknowledged that any such Feedback will be owned exclusively by OnePlan. 

8.3 Usage Data.  Subject to its obligations under clause 10, OnePlan may collect and use Usage Data to develop, improve, support, and operate its products and services.  OnePlan will not share any Usage Data with a third party unless such data is aggregated and anonymized such that Customer and the Users cannot be identified, except where such data is shared with a third party that reasonably needs to identify Customer or Users as part of the provision of the Service to Customer.

9. Confidentiality

9.1 Obligations. Each party that receives Confidential Information will: (a) maintain the confidentiality of the Confidential Information and will not disclose it to third parties excepted as permitted in these Terms; and (b) not use the Confidential Information other than as necessary for the performance or receipt of the Service. The receiving party may disclose the Confidential Information to its employees, agents, contractors, and sub-contractors that have a legitimate need to receive such information.  Receiving party shall remain responsible to the other party for the compliance with this clause 9 of such persons and undertakes that such persons will be bound to confidentiality obligations no less protective than this clause 9. The Service and its content, in particular the 3D Models, are strictly Confidential Information.

9.2 Excluded information.  The provisions of this clause 9 will not apply to information that the receiving party can demonstrate: (a) becomes publicly known through no fault of the receiving party, its employees, agents, contractors, or sub-contractors; (b) is lawfully received by receiving party from a third party free of any obligation of confidence at the time of its disclosure; (c) is independently developed by the receiving party without using the disclosing party’s Confidential Information; or (d) is required by law, by court or governmental or regulatory order to be disclosed.

10. Data; Security

10.1 DPA.  The parties will comply with the terms of the DPA set out at Schedule 1.

10.2 Security.  OnePlan will implement appropriate technical and organisational security measures inrespect of the Service in accordance with applicable law.

11. Indemnity and Liability

11.1 OnePlan indemnity.  OnePlan will defend, indemnify and hold Customer harmless from and against all claims, losses, damages, fines, expenses and liability incurred by Customer (including court costs and reasonable legal costs) resulting from any claim by a third party that the Service infringes the Intellectual Property Rights of that third party. OnePlan will have no liability under this clause 11.1, in respect of any claim which arises in whole or in part from: (a) any modification of the Service other than by OnePlan; (b) use of the Service (or any part) by Customer otherwise than in accordance with these Terms; or (c) the combination of the Service with products or processes not provided by OnePlan. This clause sets out Customer’s sole remedy with respect to any claim of intellectual property infringement in relation to the Service.

11.2 Liability cap.  Subject to clause 11.4 and except with respect to either party’s breach of clause 9(Confidentiality), each party’s total aggregate liability in respect of any loss or damage suffered by the other party (howsoever arising), will not exceed the value of the Charges under the relevant Order paid or payable by Customer to OnePlan in the 12-month period immediately preceding the first incident giving rise to the relevant claim. 

11.3 Excluded losses.  Subject to clause 11.4, neither party will be liable to the other party (howsoever arising) for: (a) consequential, indirect or special losses; or (b) any of the following (whether direct or indirect): loss of profit; destruction, loss of use or corruption of data; loss of use; loss of contract; loss of opportunity; and/or harm to reputation or loss of goodwill. 

11.4 Unlimited liability.  Notwithstanding any other provision of these Terms, neither party’s liability will be limited in any way in respect of the following: (a) death or personal injury caused by its negligence; (b) fraud or fraudulent misrepresentation; or (c) any other losses which cannot be excluded or limited by applicable law.

12. Termination

12.1 Termination for cause.  Either party may terminate an Order immediately at any time by giving notice in writing to the other party if: (a) the other party is subject to an insolvency event which will mean, in relation to an entity; (i) that it is unable or admits inability to pay its debts as they fall due; (ii) that the value of its assets is less than its liabilities (taking into account contingent and prospective liabilities); or (iii) the appointment of a liquidator, administrator or other insolvency or similar officer in respect of it or its assets or any analogous procedure or step is taken in any jurisdiction; (b) the other party suspends or ceases, or threatens to suspend or cease, carrying on business; (c) the other party’s financial position deteriorates so far as to reasonably justify the opinion that its ability to give effect to these Terms is in jeopardy; (d) the other party commits a material breach of these Terms and such breach is not remediable; (e) the other party commits a material breach of these Terms that is capable of being remedied and such breach has not been remedied within 7 days of receiving written notice or (f) the other party has failed to pay any amount due under these Terms or an Order on the due date and such amount remains unpaid for 7 days after the other party has received written notification that the payment is overdue.

12.2 Effect of termination.  Immediately on termination or expiry of the Order (for any reason), the rights granted by OnePlan under these Terms will terminate and Customer will (and will procure that each User will) stop using the Service. Termination or expiry of the Order will not affect any accrued rights and liabilities of either party at any time up to the date of termination or expiry. 

12.3 Surviving clauses.  Any clauses that expressly or by implication are intended to continue beyond termination will survive any expiration or termination of an Order.

12.4 Suspension of the Service.  OnePlan may suspend access to the Service to all or some of the Users if: (a) OnePlan reasonably suspects that there has been misuse of or threat to the Service or a breach of these Terms that, in OnePlan’s reasonable opinion, threatens the confidentiality, integrity or availability of the Service (in which case OnePlan will take steps to investigate the issue and may restore or continue to suspend access at OnePlan’s reasonable discretion); (b) any overdue Charges have not been paid to Paris 2024 by the due date; or (c) as required by law or at the request of governmental entities. OnePlan will provide notice of suspension as is commercially reasonable under the circumstances. Where any of the above events has been cured, OnePlan will, without undue delay, reinstate the Service.

13. General

13.1 Authority.  Each party represents and warrants to the other that it has: (a) the right, power and authority to enter into and to perform its obligations under the Terms; and (b) all necessary rights, licences and consents to grant to the other the rights (if any) as set out in the Terms.

13.2 Entire Agreement.  These Terms (and each applicable Order) constitute the entire agreementbetween the parties and supersedes all previous contracts, understandings, and arrangements between them in respect of its subject matter, whether in writing or oral. You acknowledge that you have not relied on any statement, promise or representation or assurance or warranty that is not set out in these Terms.  If Customer issues a purchase order in relation to an Order: (a) such purchase order will be for Customer’s internal or administrative purposes; and (b) no additional purchase order terms will apply. 

13.3 Notices.  Notices and other communications under these Terms will be sent by email to: (a) in the case of those to OnePlan, to OnePlan Limited for the attention of the Legal Department to [email protected] and (b) in the case of notices to Customer, to any email or physical address notified to OnePlan. Notices given in legal proceedings or other dispute resolution proceedings may not be sent by email.

13.4 Modifications to Terms. OnePlan may modify these Terms from time to time. Customer may be required to click to accept or otherwise agree to the modified Terms in order to continue using the Service. Continued use of the Service after the updated version of the Terms go into effect will constitute Customer’s acceptance of such updated version.

13.5 Waivers. No failure, delay, or omission by either party in exercising any right, power or remedy provided by law or under these Terms will operate as a waiver of that right, power or remedy, nor will it preclude or restrict any future exercise of that or any other right, power or remedy.

13.6 Assignment.  Neither party may assign or otherwise transfer an Order or these Terms without the advance written consent of the other party, except (a) in connection with a merger, reorganization, acquisition, or other transfer of all or substantially all of such party’s assets or voting shares to such party’s successor; and/or (b) to any Affiliate of that party. Each party will promptly provide notice of any such assignment or transfer. The parties hereby irrevocably agree in advance to provide their cooperation to such assignment or transfer and will perform any formality to complete such assignment or transfer. Any non-permitted assignment is void.

13.7 No joint venture.  An Order or these Terms does not establish any joint venture, partnership, trust, fiduciary or other relationship between the parties, other than the contractual relationship expressly provided for in it. These Terms will not prevent OnePlan from entering into similar agreements with third parties, or from independently developing, using, selling or licensing documentation, products and/or services which are similar to those provided under these Terms.

13.8 Force majeure.  Neither party will be in breach of these Terms or otherwise liable to the other party for any delay in performance or non-performance of any of its obligations to the extent that the delay or non-performance is caused, in whole or in part, by an event or sequence of events beyond a party’s reasonable control preventing or delaying it from performing its obligations. 

13.9 Severability.  If any provision of these Terms is held to be unenforceable or invalid, that provision will be limited to the minimum extent necessary so that these Terms will otherwise remain in effect.

13.10 Third party rights.  A person who is not a party to these Terms will not have any rights under the Contracts (Rights of Third Parties) Act 1999 or otherwise to enforce any of its provisions.

13.11 Export.  Customer agrees that it will not submit the Service or User Guides to any government agency for licensing consideration or other regulatory approval without the prior written consent of OnePlan. Each party (a) will comply with all applicable export and import laws and (b) represents and warrants that it is not listed on any US or UK government, or EU Commission list of prohibited or restricted parties or located in (or a national of) a country subject to a US or UK government or EU Commission government embargo or designated by such government/ Commission as a “terrorist supporting” country. 

13.12 Anti-Bribery. Each party will comply with all applicable laws, statues and regulations relating to anti-bribery and anti-corruption.

13.13 Governing law; Disputes.  These Terms and each Order is be governed by the laws of England and Wales. The parties irrevocably agree that the courts of England shall have exclusive jurisdiction to settle any dispute or claim arising out of, or in connection with, an Order or theseTerms.

14. Defined Terms.

Defined/capitalised terms have the meaning given in the body of these Terms or in this clause 14 of these Terms.

Charges	the agreed charges payable for any more than one User Account for Customer access to the Service, as stated in the Order.
Confidential Information	all information (whether in oral, written or electronic form) relating to the business of a party which may reasonably be considered to be confidential in nature, including information relating to the parties’ technology, know-how, Intellectual Property Rights, pricing, assets, finances, strategy, products and customers. OnePlan’s Confidential Information includes any technical or performance information about the Service.
Intellectual Property Rights	patents, utility models, rights to inventions, copyright and neighbouring and related rights, moral rights, trade marksand service marks, business names and domain names, rights in get-up and trade dress, goodwill and the right to sue for passing off or unfair competition, rights in designs, rights in computer software, database rights, rights to use, and protect the confidentiality of, confidential information (including know-how and trade secrets) and all other intellectual property rights, in each case whether registered or unregistered and including all applications and rights to apply for and be granted, renewals or extensions of, and rights to claim priority from, such rights and all similar or equivalent rights or forms of protection which subsist or will subsist now or in the future in any part of the world.
Order	Customer’s order for the Service placed through Paris 2024 (Rate Card Ordering Platform) and accepted by Paris 2024.
Recommended System Requirements	the recommended requirements for Customer’s operating system in order for Customer to access and use the Service, as updated from time to time are: browser – Google Chrome; RAM – >8GB; disk type – SDD hard drive; internet connection download bandwidth >12mbps; and computer must be able to run WebGL.
Service:	VenueTwin Viewer – Paris 2024, provided to Customer by OnePlanon its own behalf and behalf of Paris 2024.
Service Term:	the period during which a Customer may use the Service, commencing on the Start Date and ending on expiry of the Customer’s agreed period of use as detailed in the Order (unless terminated earlier in accordance with these Terms).
Start Date	The start date of the Service Term.
Usage Data	any data derived from the operation, support and/or use by Customer or Users of the Service, including configurations, log data, and the performance results for the Service.
User:	an individual user authorised by the Customer to access and use the Service.
User Guides:	applicable technical documentation, user guides, and resources for the Service (in any format) made available to Users on the landing page of the Service, and updated by OnePlan from time to time.
User Account:	the right granted by OnePlan to Customer for a User to use the Service in accordance with these Terms.

 

 

Schedule 1 – OnePlan Customer Data Processing Addendum (version: 1 April 2022)

This Data Processing Addendum (“DPA”) forms a part of these Terms between OnePlan and Customer(the “Agreement”). This DPA applies where and only to the extent that OnePlan Processes Personal Data on behalf of Customer in the course of providing the Customer with access to the Service.

1. Definitions. For the purposes of this DPA, the following terms will have the meanings set out below. Capitalised terms not otherwise defined herein will have the meaning given to them in the Agreement. 

1.1. “adequate country”, “controller”, “processor”, and “supervisory authorities” have the meanings given in the Data Protection Laws.

1.2. “Affiliate” means an entity that owns or controls, is owned or controlled by, or is under common control or ownership with, either Customer or OnePlan respectively. “Control,” for purposes of this definition, means the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise.

1.3. “Customer Personal Data” means any Personal Data Processed by OnePlan or a Sub-processor on behalf of Customer.

1.4. “Data Protection Laws” means any local, national or international laws, rules and regulations related to privacy, security, data protection, and/or the Processing of Personal Data, as amended, replaced or superseded from time to time.  This includes the European Union Regulation (EU) 2016/679, the Data Protection Act 2018, and the California Consumer Privacy Act of 2018 (CCPA)/California Privacy Rights Act of 2020 (CPRA).

1.5. “Data Subject” means the identified or identifiable person to whom Personal Data relates. 

1.6. “Personal Data” means (a) information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person or household; and (b) any information defined as “personal data”, “personal information,” or other similar terms under applicable Data Protection Laws.  

1.7. “Personal Data Breach” means the accidental, unauthorized, or unlawful destruction, loss, alteration, disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise Processed by OnePlan or any Sub-processor.

1.8. “Process” means any operation or set of operations that is performed upon Personal Data, whether or not by automatic means, such as access, collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, return or destruction, and “processed,” or “processing” shall be construed accordingly.

1.9. “Processor” means any person or entity which Processes Customer Personal Data, including as applicable any “service provider” or “contractor” as those terms are defined by applicable Data Protection Laws. 

1.10. “Regulator” means any independent public authority, government agency, and any similar regulatory authority responsible for the enforcement of Data Protection Laws.

1.11. “Sub-processor” means any Processor (including any third party and any OnePlan Affiliate) appointed by or on behalf of OnePlan who may Process Customer Personal Data.

2. Processing details.

The details of the Processing of Customer Personal Data by OnePlan are as follows. 

2.1. Nature and purpose of the Processing.  Customer authorises OnePlan to Process Customer Personal Data that arises from the provision of the Service as described in the Agreement.

2.2. Duration.  OnePlan will process Personal Data for the duration of the Agreement (including any extensions to its duration) and any additional time after termination necessary for OnePlan to complete its obligations relating to Personal Data. 

2.3. Categories of Data Subjects.  The categories of Data Subjects to which Customer Personal Data relate may include, but are not limited to: 

• • • • Employees or contact persons of Customer; and/or
      • Individuals permitted or required by Customers to make use of the Service.

2.4. Types of Personal Data.  The types of Customer Personal Data may include, but are not limited to: 

• • • • Identification and contact data (name, address, title, contact details); and
      • IT information (IP addresses, usage data, cookies data, location data); and/or
      • Any other Personal Data provided by Customer for the purpose of transmission, storage and/or analysis by OnePlan, and which are determined and controlled by Customer in its sole discretion.

2.5. Special Categories of Personal Data (if applicable).  Subject to any applicable restrictions and/or conditions in the Agreement, Customer may also include ‘special categories of personal data’ or similarly sensitive personal data (as described or defined in Data Protection Laws) in Customer Personal Data, the extent of which is determined and controlled by Customer in its sole discretion. None is anticipated by the parties. 

To the extent OnePlan collects, receives or otherwise Processes any ‘special categories of personal data’ without written authorisation or request by Customer, OnePlan shall notify Customer as promptly as possible.

3. Processing of Personal Data.

3.1. The parties acknowledge that, with regard to the Processing of Customer Personal Data, OnePlan is the processor and Customer is the controller.

3.2. Customer is responsible for obtaining all consents, licences and legal bases required to allow OnePlan to process Customer Personal Data. 

3.3. OnePlan will: 

3.3.1. only process personal data in accordance with this DPA and Customer’s instructions (unless legally required to do otherwise);

3.3.2. not share, sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate orally, in writing, or by electronic or other means, Customer Personal Data to another person or entity for any reason, except (a) as necessary to fulfil OnePlan’s obligations with respect to the Service; or (b) as otherwise required by applicable Data Protection Laws; 

3.3.3. not combine Customer Personal Data with Personal Data OnePlan receives from or on behalf of another person or entity or collects from its own interactions with a Data Subject except to perform a business purpose as defined in regulations adopted pursuant to Cal. Civ. Code 1798.185(10(a);

3.3.4. inform Customer immediately if (in its opinion) any instructions infringe Data Protection Laws;

3.3.5. ensure that anyone authorised to process Customer Personal Data is committed to confidentiality obligations no less strict than in this Agreement with respect to confidentiality and security;

3.3.6. without undue delay, provide Customer with reasonable assistance with: 

(a) data protection impact assessments, 

(b) responses to Data Subjects’ requests to exercise their rights under Data Protection Laws, and 

(c) engagement with supervisory authorities; 

3.3.7. if requested, provide Customer with information necessary to demonstrate its compliance with obligations under Data Protection Laws and this DPA;

3.3.8. allow for audits at Customer’s reasonable request, provided that audits are limited to once a year and during business hours, except in the event of a security incident; and

3.3.9. after termination of this DPA, delete or return Customer Personal Data upon Customer’s written request unless retention is required to meet legal or regulatory obligations (but only to the extent and for such period as required by such legal or regulatory requirement).  

4. Security. OnePlan shall implement and maintain appropriate technical and organizational safeguards to protect Customer Personal Data that are no less rigorous than accepted industry standards for information security (i.e., a recognized, industry-standard information security audit or certification standard, such as ISO 27001, SOC 2, NIST 800-53, or similar) and shall ensure that all such safeguards comply with applicable Data Protection Laws. In assessing the appropriate level of security, OnePlan shall take into account the risks that are presented by Processing, in particular from accidental, unauthorized, or unlawful destruction, loss, alteration, damage, disclosure of, or access to Customer Personal Data transmitted, stored, or otherwise Processed. 
5. Personal Data Breach.  In the event of a Personal Data Breach impacting Customer Personal Data, OnePlan shall: 

5.1. notify Customer as soon as practicable under the circumstances, but no later than seventy-two (72) hours after OnePlan or any Sub-processor becomes aware of such Personal Data Breach; 

5.2. immediately take all appropriate steps, at its sole cost and expense, to investigate, contain, remediate the cause and mitigate any effects or potential harms to Data Subjects arising from the Personal Data Breach;

5.3. provide Customer with sufficient details of the Personal Data Breach to allow Customer to meet any obligations under Data Protection Laws to report or inform Data Subjects or relevant Regulators of the Personal Data Breach; 

5.4. immediately take all appropriate steps, at its sole cost and expense, to investigate, contain, remediate the cause and mitigate any effects or potential harms to Data Subjects arising from the Personal Data Breach; and 

5.5. cooperate, and require any Sub-processor to cooperate, with Customer in the investigation, mitigation, and remediation of any such Personal Data Breach.

6. Sub-processors.

6.1. Use of sub-processors.  Customer consents to OnePlan using sub-processors when processing personal data. OnePlan’s existing sub-processors are listed in Annex A.

6.2. Sub-processor obligations.  OnePlan will: 

6.2.1. require its sub-processors to comply with equivalent terms as OnePlan’sobligations in this DPA;

6.2.2. ensure appropriate safeguards are in place before internationally transferring personal data to its sub-processor; and

6.2.3. be liable for any acts, errors or omissions of its sub-processors under this DPA.

6.3. Approvals.  OnePlan may appoint new sub-processors provided that it notifies Customer in writing within sixty days of such appointment. 

6.4. Objections.  Customer may reasonably object in writing to any future sub-processor. If the parties cannot agree on a solution within a reasonable time, either party may terminate this DPA and (if necessary) the Agreement.  

7. International Personal Data Transfers. Customer acknowledges and agrees that OnePlan may access and Process Customer Personal Data on a global basis as necessary to provide the Service in accordance with the Agreement. Wherever Customer Personal Data is transferred outside its country of origin, each party will ensure such transfers are made in compliance with the requirements of Data Protection Laws.  The parties shall negotiate in good faith any further agreements or supplemental measures which may be required under applicable Data Protection Laws in relation to the international transfer of Customer Personal Data prior to any such transfer. All international transfers of Customer Personal Data subject to EU or UK Data Protection Laws shall be made subject to: (i) an applicable adequacy decision or regulation; or in the absence thereof; (ii) subject to a recipient’s Binding Corporate Rules program; (iii) in accordance with the Standard Contractual Clauses (as adopted by the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as well as any amendments, replacements or other supplementing provisions); or in the absence of each of the foregoing, (iv) any derogations or other transfer measures provided under EU or UK Data Protection Laws. To the extent Customer is required to make any international transfers of Personal Data to OnePlan that require the use of the Standard Contractual Clauses under EU or UK Data Protection Laws, the parties shall amend this DPA to include a copy of the applicable Standard Contractual Clauses.
8. Additional measures. If the Transfer Mechanism is insufficient to safeguard the transfer, the data importer will promptly implement additional or replacement measures as necessary to ensure personal data is protected to the same standard as under Data Protection Laws.
9. Disclosures. If the data importer receives a request from a public authority to access Customer Personal Data, it will (if legally possible):

9.1. challenge the request and promptly notify the data exporter about receiving it; and

9.2. if it is necessary to disclose Customer Personal Data, only disclose the minimum amount required to the public authority and keep a record of the disclosure. 

10. Termination. Upon expiration or termination of the Agreement for any reason, OnePlan’s obligations under this DPA in relation to the Processing of Personal Data will continue for as long as OnePlan has access to Customer Personal Data. 
11. Changes in Data Protection Laws. If any variation is required to this DPA as a result of a change in or subsequently applicable Data Protection Law, the parties agree to discuss and negotiate in good faith any variations to this DPA necessary to address such changes, with a view to agreeing and implementing those or alternative variations as soon as practicable.
12. General Terms. This DPA supersedes any prior data processing agreements, addenda or similar terms between the parties. In the event of any conflict between the Agreement and this DPA, this DPA will govern with respect to the subject matter of this DPA. 

Annex A – Authorised sub-processors

 

Authorised Sub-Processor	Processing this Sub-Processor is authorised to undertake
Salesforce	Contact details to provide CRM services
HubSpot, Inc.	Contact details to provide CRM services
Amazon Web Services	Hosting Customer data
Userpilot, Inc.	IP address and device fingerprint of users to provide product experience tools