The contractual relationship between Emarsys eMarketing Systems AG, Maerzstraße 1, 1150 Vienna, Austria (hereinafter referred to as “Emarsys”) and its customer (“Customer”) is governed by the following Emarsys standard terms and conditions. If the Customer already receives services from Emarsys on the basis of an earlier agreement, from now on the following Emarsys standard terms and conditions shall also apply to those services, thereby replacing the previous version of Emarsys’ standard terms and conditions. If in future the Customer orders additional services from Emarsys the following Emarsys standard terms and conditions shall also apply to such future services.

Any additional or contrary standard terms and conditions of the Customer shall not apply, even if Emarsys accepts a purchase order in which the Customer refers to its own standard terms and conditions and/or which is accompanied by a copy of the Customer’s own standard terms and conditions.

1. Services provided by Emarsys

1.1. Subject matter of the agreement. Emarsys shall provide the services that are detailed in its proposal to the Customer during the term of the agreement. Unless it is explicitly agreed in writing the agreement does not oblige Emarsys to deliver any future functionality or features. The Customer agrees that its decision to conclude the agreement with Emarsys is not dependent on any oral or written public comments made by Emarsys regarding future functionality or features.

1.2. Provision of software. Where Emarsys’ services comprise the provision of software the Customer shall be entitled to use the licensed software within the agreed scope during the term of the agreement for its own business purposes. The software is provided by Emarsys as “Software as a Service” (“SaaS”) to be used via the internet. The hard- and software used by Emarsys to provide its services are centrally hosted by Emarsys in one or more data centres, and will not be handed over to the Customer.

1.3. Hosting of software. Emarsys will not itself host the provided software, but will use external data centres which are operated according to generally acknowledged rules of technology by specialized data centre operators acting as subcontractors of Emarsys. Emarsys shall remain fully responsible to the Customer for any services provided by such data centre operators.

1.4. Deliverability. Emarsys owes the correct setup and operation of its IT systems and the due dispatching of messages which the Customer sends via Emarsys to the addressees’ internet services providers, but not the guaranteed delivery of such messages to the addressees’ inboxes. The delivery of messages sent via Emarsys to the addressees’ inbox depends to some extent on certain behaviors of the addressees’ internet services providers which are not under Emarsys’ control (such as automatically bouncing or discarding messages that are incorrectly classified as “spam”).

1.5. Internet user behaviors. The commercial effect of the services provided by Emarsys depends to some extent on certain behaviors of internet users (e.g. whether or not emails are opened and links clicked, or the web browser’s cookie settings). These user behaviors are not under Emarsys’ control, and therefore do not fall into Emarsys’ area of responsibility.

1.6. Commercial results. Emarsys shall provide the agreed services to the Customer, but shall not be responsible to ensure that these services achieves certain commercial results for the Customer.

1.7. Retention of rights. Only the limited usage rights which are explicitly mentioned in this agreement shall be granted to the Customer, and the Customer does not acquire any additional or other rights in the Emarsys software. 

1.8. Transfer of rights. Any transfer and/or sub-licensing of the Customer’s rights under this agreement to third parties shall be void unless it is made with Emarsys’ prior written consent. This also applies if the third party concerned is an affiliated company of the Customer.

1.9. Changes to technology. If during the term of the agreement Emarsys develops new versions of its technology in order to adjust to technical or commercial market developments, Emarsys may replace the corresponding technology used by the Customer under this agreement with such new version (even if such change may impose additional software or hardware requirements
upon the Customer to maintain the system’s full functional usability).

2. Obligations of the Customer

2.1. Customer co-operation in due time. The Customer shall provide all necessary assistance to permit Emarsys performing its services in due time so that Emarsys can comply with the agreed timeline.

2.2. Sufficient usage rights of the Customer. The Customer represents and warrants that both the Customer and Emarsys may legally use for the purpose of this agreement any templates or data which the Customer has provided to Emarsys. If third parties make claims or accuse Emarsys of legal offenses based on the allegation that such sufficient usage rights do not exist, the following shall apply: the Customer shall indemnify and hold harmless Emarsys against any such claims without delay, shall provide appropriate support for any legal defense, and shall further indemnify and hold harmless Emarsys against any and all costs incurred by Emarsys for such legal defense. This indemnification obligation shall be subject to Emarsys (i) informing the Customer in text form of any such claims without delay, (ii) not making any acknowledgements or similar declarations, and (iii) enabling the Customer, to the extent permitted by procedural requirements, to conduct all court procedures and out-of-court negotiations at the Customer’s expense.

2.3. Technical requirements. To use and control the software provided by Emarsys the Customer will need an up to date standard web browser. This browser and the corresponding Customer’s internet access are not part of the services owed by Emarsys. A secure connection between the Customer’s computer and Emarsys’ servers may further require a VPN or SSL connection. Should this require special preparations on behalf of the Customer’s internet service provider (“ISP”), the Customer shall implement these requirements together with its ISP at its own cost and under its own responsibility.

2.4. Customer systems. If the provision of Emarsys’ services requires adjustments to the Customer’s own IT systems and/or of IT systems provided by third parties on behalf of the Customer (collectively “Customer Systems”, e.g. the provision of interfaces for data exports/imports from/to Customer Systems, or the inclusion of tracking codes into Customer websites) the Customer shall make such adjustments at its own cost and under its own responsibility, but in consultation with Emarsys. If the Customer installs or enables a Customer System to interface with an Emarsys software the Customer grants Emarsys permission to allow that Customer System to access the Customer’s data as required for the interoperation of that Customer System with the Emarsys software. Only the Customer shall be responsible for the correct operation of the Customer Systems and their connection to the Emarsys software interfaces provided by Emarsys. Emarsys shall not be responsible for any disclosure, modification or deletion of the Customer’s data resulting from access by a Customer System.

2.5. Customer login credentials. Emarsys will provide the Customer with login credentials (user name and password) which will permit access to the Customer’s data. The confidentiality of any Customer data stored by Emarsys depends on the Customer’s own confidential handling of these login credentials. Any acts performed by third parties using the Customer’s login credentials will be considered as, and treated like, acts performed by the Customer itself. Should the Customer note that its login credentials have been compromised the Customer shall immediately notify Emarsys to effect a change of these login credentials.

3. Customer data

3.1. Customer owns the data. All rights in and to the data which the Customer stores into the databases provided by Emarsys, or which Emarsys collects on behalf of the Customer, belong to the Customer. Emarsys will use such data neither for its own purposes nor for the purposes of third parties, and will not sell or otherwise transfer such data to third parties. During the term of the agreement the Customer can access and export those parts of the Customer data that Emarsys makes available via the standard functions provided by its software. Customer’s access to any other parts of the Customer’s data (e.g. the underlying “raw” data in Emarsys’ databases) requires a separate agreement between Emarsys and the Customer providing for an adequate remuneration for the corresponding working time of Emarsys’ staff.

3.2. Types of data and data subjects. The Customer’s data may particularly comprise contact data (e.g. names, street and email addresses), historical transaction data (e.g. order history) and web browsing data (e.g. click-path) of the Customer’s website users and email newsletter recipients; details are defined in the purchase order and in the relevant service specifications.

3.3. Customer’s data back-up. The Customer shall be obliged to use the software’s export functionality to regularly (at least whenever any relevant changes to the data have occurred) create its own back-up copies of the data made available by Emarsys via the export interface. Such preventive measures against a potential loss of data shall be the Customer’s own responsibility.

3.4. Data export when the agreement ends. For a period of 30 days after expiry of this agreement the Customer, using its existing login credentials, remains able to access the Customer data stored by Emarsys, and to export these data in CSV format using the standard export functions provided by the software. Only the Customer itself shall be responsible to export the Customer data in due time to secure them for future use. Any transfers or exports of data that cannot be performed by the software’s standard functions will have to be ordered in due time and separately remunerated by the Customer.

3.5. Deletion when the agreement ends. Upon expiry of the 30 days data export period pursuant to section 3.4 Emarsys shall delete the Customer’s data from its storage media, and shall destroy any corresponding documents under its control, except to the extent that Emarsys is bound by statutory retention provisions to continue storing such data.

3.6. Back-up copies. The obligation to delete data pursuant to section 3.5 above shall not apply to data contained in regular back-up copies of comprehensive datasets, where individual deletion of the Customer’s Data would cause significant efforts for Emarsys. Restoring or using such data copies in any way after the agreement has ended shall not be permitted. The Customer may request Emarsys to delete such copies as well, provided the Customer agrees to reimburse Emarsys for any costs incurred in such process; this shall also comprise adequate compensation for the corresponding working time of Emarsys’ staff.

4. Data protection and data security

4.1. Data controller. The Customer remains the sole data controller for its data pursuant to applicable data protection laws (meaning that the Customer alone determines the purposes and means of collecting, processing and using the data), and shall be responsible for the lawful collection, processing and use of the data as well as for preserving the rights of the data subjects.
Where required, the Customer shall inform the data subjects about the collection, processing and use of the data, and/or obtain their consent.

4.2. Obligation to observe instructions. Emarsys shall process the Customer’s data on behalf of the Customer exclusively within the scope and for the purpose of providing the services to the Customer and in accordance with the Customer’s instructions. Emarsys shall not use the data for any other purposes, and shall in particular not pass on the data to unauthorized third parties, nor use the data for its own purposes.

4.3. Providing Instructions. Where Emarsys collects, processes or uses Customer’s data by means of the standard software provided to the Customer for online use, the Customer usually provides its instructions pursuant to Section 4.2 by using the online interface of this software. In all other cases, instructions issued by the Customer must be made via the web interface provided to the Customer by Emarsys or in text form (which includes email); any oral instructions must be immediately confirmed in text form. The Customer shall be entitled to issue such instructions at its discretion. Where the scope of such instructions is beyond the standard features of Emarsys’ software, or otherwise beyond the scope of services which Emarsys owes to the customer under the agreement, the Customer shall remunerate such additional services separately. Where an instruction can only be implemented by employing unreasonable efforts, Emarsys may terminate the agreement for cause.

4.4. Obligation to notify. Emarsys shall notify the Customer without delay if Emarsys believes that any instructions issued by the Customer violate the provisions of applicable data protection provisions. Emarsys may suspend the implementation of such instructions until they are modified or confirmed by the Customer’s person in charge. Emarsys shall not, however, be obliged to verify that any instructions given by the Customer are legally compliant.

4.5. Correction, deletion, blocking. Where Customer’s data must be corrected, deleted or blocked, the Customer itself shall carry out these measures by using the corresponding functions of the provided software. Where this is not possible, Emarsys shall correct, delete or block such data according to instructions provided by the Customer at the Customer’s risk and expense.

4.6. Location of data processing. If the Customer is based in the European Union (EU) the Customer’s data shall only be processed within the EU or in member states of the European Economic Area (EEA), except where the Customer has granted Emarsys permission, either in this agreement or by any other means, to process data in a country which is not a member state of the EU or the EEA.

4.7. Obligation to comply with data secrecy. Emarsys shall familiarize its employees involved in the processing of personal data with the relevant data protection provisions, and shall bind these employees in writing to comply with data secrecy. This confidentiality obligation of employees involved in the processing of data shall remain in effect even if they no longer work for Emarsys.

4.8. Notification obligation in case of illegal disclosure. If Emarsys notices that Customer’s data controlled by Emarsys are disclosed to third parties in a way that is not in compliant with applicable statutory data protection laws, the provisions of this agreement, and/or instructions of the Customer, Emarsys shall immediately inform the Customer about such event. If within the Customer’s sphere of responsibility any data that are also being processed, collected or used by Emarsys under this agreement are unintentionally disclosed to an unauthorized third party, the Customer shall immediately inform Emarsys about such event.

4.9. Support obligation. Where the Customer requires Emarsys’ support in order to fulfil its data protection obligations towards data subjects, Emarsys shall provide appropriate support to the
Customer in this regard. The Customer shall remunerate Emarsys separately on a time and materials basis for any corresponding efforts.

4.10. Technical and organizational measures. Within its area of responsibility Emarsys shall take the technical and organizational measures to protect data as detailed in appendix 1a to this agreement.

4.11. Indemnification. If third parties (which may include government authorities) make claims or accuse Emarsys of legal offenses based on the allegation that the Customer has breached its data protection obligations, in particular where data subjects allege that the data processing on behalf of the Customer infringes their rights, the following shall apply: the Customer shall indemnify and hold harmless Emarsys against any such claims without delay, shall provide appropriate support for any legal defense, and shall further indemnify and hold harmless Emarsys
against any and all costs incurred by Emarsys for such legal defense. This indemnification obligation shall be subject to Emarsys (i) informing the Customer in text form of any such claims
without delay, (ii) not making any acknowledgements or similar declarations, and (iii) enabling Emarsys Terms and Conditions 5
the Customer, to the extent permitted by procedural requirements, to conduct all court procedures and out-of-court negotiations at the Customer’s expense.

5. Customer’s audit right

5.1. Certification. Emarsys undertakes to employ an ISO 27001 certified information security management system during the term of this agreement, and to demonstrate this to the Customer upon request.

5.2. Audits. The Customer may, to the extent required, audit Emarsys’ compliance with a) statutory data protection provisions, b) contractual provisions of the parties and c) instructions issued by the Customer. The Customer shall provide at least four weeks prior written notice before any such audit is made on the premises of Emarsys. Audits must be carried out during normal business hours and without causing significant disturbances to the business operations of Emarsys.

5.3. Costs. Any costs caused by the Customer’s audits shall be borne by the Customer. This shall also include adequate compensation for the working time of Emarsys’ staff while they are at the service of the Customer.

5.4. Protection of Emarsys. Where an audit may lead to the disclosure of Emarsys’ business or trade secrets or threaten Emarsys’ intellectual property rights, the Customer shall employ an
independent expert in order to carry out the audit, and the expert shall agree to be bound to secrecy for Emarsys’ benefit.

6. Requirements for the Customer’s use of Emarsys’ services

6.1. Legal compliance. The Customer shall ensure that its use of the services provided by Emarsys is neither in breach of applicable laws and regulations, not infringes any rights of third parties. This includes the Customer’s obligation to
a) only send emails for which the recipients have given a valid consent to receiving such emails, or which may be legally sent for other reasons under all applicable laws and regulations;
b) ensure that the contractual use of any content provided by the Customer (e.g. texts or images) does not infringe any personality rights, trademarks, copyrights or other intellectual property rights of third parties;
c) ensure that Emarsys’ collection and processing of personal data on behalf of the Customer does not infringe any applicable data protection laws; this particularly includes the obligation to obtain, if required, a valid consent to such data collection and processing from the data subjects.

6.2. No offensive content. The Customer must not use the systems provided by Emarsys to process any racist, extremist, inciting, cruel or insulting content, content that is in violation of applicable laws for the protection of minors, or any other form of offensive content.

6.3. Customer contact details. The Customer must ensure that any email which the Customer sends using Emarsys’ system is clearly recognizable as an email from the Customer. Any such email must easily recognizable contain at least the following information:
a) The Customer’s full name and street address; for legal entities also their legal form
b) The Customer’s contact details (at least a postal address, a telephone number, or an email
address).
Any statutory obligations for the Customer to provide additional information remain unaffected.

6.4. Opt-out information. In every email which the Customer sends using Emarsys the Customer shall inform the respective recipient that (and how) this recipient can object to the receipt of any further such emails. As a general rule such objections (“Opt-outs”) must be possible without the recipient’s knowledge of login credentials (e.g., user name and password), except where Emarsys has given its prior written consent to a different way of handling. Opt-outs must be processed by the Customer without delay.

6.5. Complaints. If the Customer receives a complaint in connection with its use of the systems provided by Emarsys the Customer shall duly process such complaint, and provide the complainant with a first reaction on the complaint’s subject matter as soon as reasonably possible.

6.6. Compliance reviews. Emarsys shall be entitled (but not obliged) to verify at its own cost that the Customer complies with the statutory and contractual requirements for using the Emarsys systems.

6.7. Legal recourse for Emarsys. In case of a culpable breach of the Customer’s obligations pursuant to sections 6.1 through 6.5 above, Emarsys may – in addition to any other rights which Emarsys may have under this agreement or applicable statutes – temporarily block the Customer’s account and/or terminate the agreement with the Customer for cause with immediate effect.

6.8. Indemnification. If third parties (which may include government authorities) make claims or accuse Emarsys of legal offenses based on a culpable breach of the Customer’s obligations pursuant to sections 6.1 through 6.5 above, the following shall apply: the Customer shall indemnify and hold harmless Emarsys against any such claims without delay, shall provide appropriate support for any legal defense, and shall further indemnify and hold harmless Emarsys against any and all costs incurred by Emarsys for such legal defense. This indemnification obligation shall be subject to Emarsys (i) informing the Customer in text form of any such claims without delay, (ii) not making any acknowledgements or similar declarations, and (iii) enabling the Customer, to the extent permitted by procedural requirements, to conduct all court procedures and out-of-court negotiations at the Customer’s expense.

7. Whitelist systems and compliance with their rules and regulations

7.1. Compliance with applicable rules and regulations. Emarsys may participate in one or more acknowledged and reputable whitelist systems during the term of the agreement to improve the delivery rates of the emails and other electronic advertisements (together “Advertising Media”) distributed by its customers using Emarsys technology. The Customer is obliged to comply with all requirements stipulated in the corresponding rules and regulations of such whitelist systems. Upon request Emarsys will inform the Customer at any time about the whitelist systems in which Emarsys currently participates, and which requirements the corresponding rules and regulations stipulate for the distribution of Advertising Media.

7.2. Additional requirements. If during the term of this agreement Emarsys accedes to a new acknowledged and reputable whitelist system with rules and regulations which stipulate additional requirements for the distribution of Advertising Media going beyond the requirements of the previously applicable rules and regulations, Emarsys shall actively inform the Customer about these additional requirements and specify an adequate time period (usually one month) for adjustment, after which the Customer shall also comply with these additional requirements.

7.3. Legal recourse for Emarsys. In case of a culpable breach of the Customer’s obligations pursuant to sections 7.1 and 7.2 above, Emarsys may – in addition to any other rights which Emarsys may have under this agreement or applicable statutes – temporarily block the Customer’s account and/or terminate the agreement with the Customer for cause with immediate effect.

7.4. Indemnification. Should a culpable breach of the Customer’s obligations pursuant to sections 7.1 and 7.2 above result in Emarsys’ exclusion from a whitelist system and should third parties raise claims against Emarsys based on the deteriorated delivery rates of Advertising Media distributed via Emarsys, the following shall apply: the Customer shall indemnify and hold harmless Emarsys against any such claims without delay, shall provide appropriate support for any legal defense, and shall further indemnify and hold harmless Emarsys against any and all costs incurred by Emarsys for such legal defense. This indemnification obligation shall be subject to Emarsys (i) informing the Customer in text form of any such claims without delay, (ii) not making any acknowledgements or similar declarations, and (iii) enabling the Customer, to the extent permitted by procedural requirements, to conduct all court procedures and out-of-court negotiations at the Customer’s expense.

8. Agency services

8.1. No legal review. To the extent that Emarsys provides programming services, the design or production of content, or any other marketing agency services to the Customer, Emarsys shall not be obliged to perform, and assume responsibility for, the legal clearance of the corresponding Work Results under applicable trademark, design, or unfair competition laws, except where such legal clearance has been explicitly agreed to be part of Emarsys’ services.

8.2. Costs. Any creation of concepts or drafts, or any other agency services which Emarsys provides to the Customer shall be remunerated unless it is explicitly agreed otherwise.

8.3. Freedom of design. When providing agency services Emarsys shall deliver the agreed designs or other agreed deliverables (together “Work Results”) at its discretion as long as they are within the scope of the Customer’s instructions provided to Emarsys when placing the order. The Customer cannot raise warranty claims based on Emarsys’ artistic design in this regard. If the Customer requests changes during or after Emarsys’ production process any additional efforts caused by the change request shall be remunerated separately and in addition to Emarsys’ remuneration claim for any started or bindingly agreed tasks.

8.4. Customer approval. Upon the Customer’s approval of texts, drafts or production templates the Customer assumes responsibility for the correctness of texts and designs, and Emarsys shall no longer be liable in this regard.

8.5. Production supervision. Any production supervision obligations for Emarsys require an explicit agreement to provide such services. In case of such agreement Emarsys is entitled to take the corresponding decisions, and to provide any necessary instructions, at its own discretion. Emarsys shall only be liable for its own mistakes in this regard, and not for mistakes made by the production company being supervised. If Emarsys assumes the production supervision the Customer will only receive any proofs prior to production if this has been explicitly agreed.

8.6. License. The Customer shall have the right to use the Work Results of Emarsys’ agency services for the purpose of performing the respective contract. Unless it is agreed otherwise this right of the Customer shall be on a non-exclusive basis. Any transfer or sub-licensing to third parties or any use of the Work Results in any higher volumes than originally anticipated requires a written agreement. If the Customer uses Work Results in higher volumes than originally anticipated Emarsys may – in addition to any other rights which Emarsys may have under this agreement or applicable statutes – demand an additional remuneration from the Customer for such additional use, as well as an indemnification from all potential claims which any affected licensors of Emarsys may raise.

8.7. Retention of title. Any rights to use the Work Results of Emarsys’ agency services shall only transfer to the Customer after the corresponding remuneration has been fully paid.

8.8. Computer files. Emarsys shall not be obliged to hand over any computer created data or layout files for its agency Work Results. If the Customer wishes to obtain such electronic files, this will require an additional agreement specifying an additional remuneration for Emarsys. If Emarsys has provided such computer files to the Customer these files may only be modified and/or used with Emarsys’ prior written consent.

8.9. Copyright notice. Emarsys can demand that any copies of its agency Work Results carry a copyright notice to the benefit of Emarsys.

8.10. Customer input. Any Customer suggestions regarding the design of agency Work Results, or any other input given by the Customer, does not result in a co-creatorship of the Customer and has no influence on the remuneration owed by the Customer.

9. Delivery and acceptance

9.1. Binding delivery dates. Delivery dates are only binding if they are explicitly agreed or confirmed by Emarsys as binding. If a written agreement exists the confirmation of a binding delivery date shall also be required in written form.

9.2. Acceptance. The Customer shall formally accept any services and deliverables which Emarsys has provided in accordance with the contract. Minor defects shall not prevent formal acceptance, but shall be subject to the removal of defects procedure. The Customer’s acceptance shall be deemed as given if the Customer (i) does not provide a written statement refusing acceptance and providing the corresponding reasons within 14 days after delivery of the services or deliverables, or (ii) puts the services or deliverables into productive use.

9.3. Customer requests. Emarsys shall not be obliged to comply with the Customer’s requests for additional system functionalities, but may include such functionalities in one of its next software releases at Emarsys’ sole discretion.

10. Removal of technical defects

In case of a technical defect Emarsys will
a) within 4 hours if the defect concerns the system’s overall availability or a part of the system that is indispensable for its operation (severity level 1);
b) within 24 hours if the defect diminishes the system’s availability or its documented
functionality without critically affecting its use by the Customer (severity level 2)
After receipt of the first defect notification from the Customer during ordinary business hours start
working on the defect’s removal.

11. Remuneration

11.1. Setup fees. Emarsys will invoice the agreed setup fees as follows:
a) 1/3 in the month the agreement is signed;
b) 1/3 in the following month, but not later than the month in which the last installment of the setup fee pursuant to the following subsection c) becomes due;
c) 1/3 in the month in which Emarsys notifies the Customer that the account for operating the software provided by Emarsys is available to the Customer. This payment obligation shall remain unaffected if the Customer does not yet use the account for sending messages or for collecting data because of unfulfilled Customer obligations (e.g. no compliance clearance pursuant to section 6.6, failure to agree on a date for preparation workshops or application training, or in case of missing templates, data or any other content to be provided by the Customer).
In case of a quick setup the last installment pursuant to subsection c) may become due in the same month as the second and/or the first installment pursuant to subsection b) and/or a).

11.2. On-going fees. Emarsys will invoice the agreed on-going fees monthly at the end of the relevant month, beginning in the month in which the last installment of the setup fee pursuant to section c) becomes due.

11.3. Taxes. All prices are exclusive of any applicable VAT, sales tax or comparable indirect taxes, which shall be added at their statutory rate if applicable.

11.4. Travel. Any evidenced travel costs and allowances for travels which Emarsys makes in relation to the agreement and which have been approved by the Customer shall be reimbursed by the Customer.

11.5. Payment term. Emarsys’ remuneration shall be due and payable without deduction within 8 business days after Emarsys’ invoice date. Payment shall be made to the bank account specified in Emarsys’ invoice. 

11.6. Payment delays. In case of delayed payment Emarsys shall be entitled, after providing a written payment reminder to the Customer, to suspend its provision of all further services until all outstanding amounts have been fully paid.

11.7. Additional consequences of delayed payment. Notwithstanding any suspension of services pursuant to section 11.6 the Customer shall continue to pay the agreed remuneration for the time of suspension, and any outstanding amounts shall accrue interest. The level of interest for its late payment which the Customer is obliged to pay shall be the interest rate applied by the European Central Bank to its most recent main refinancing operation carried out before the first calendar day of the half-year in question (“Reference Rate”) plus eight percentage points. The Reference Rate in force on the first calendar day of the half-year in question shall apply for the following six months. Emarsys right to claim compensation for any additional damages caused by the delayed payment and/or to terminate the agreement for cause shall remain unaffected.

11.8. Set-off. The Customer shall not be entitled to offset its own claims against any claim of Emarsys under this agreement (or to claim any right of retention) unless the Customer’s counter-claim is (i) undisputed by Emarsys, (ii) confirmed by a binding court decision that cannot be appealed, or (iii) based on a defect of the specific service for which Emarsys demands payment with its own claim against the Customer.

12. Confidentiality

12.1. Both parties will likely disclose confidential information to each other in connection with this agreement. Confidential information shall be all information marked in writing as “confidential”, or oral information which is subsequently confirmed in writing and marked as confidential, as well as any information whose confidential nature is evident from its content or from the circumstances under which it was disclosed. Confidential information shall also include any commercial agreements between the parties as well as any personal data collected or processed hereunder. If there is any doubt as to the confidential nature of information, the party having received the information shall contact the other party and seek clarification without undue delay, in any event before disclosing the information to third parties.

12.2. Information shall not be deemed confidential if the receiving party can prove that (a) it was known to it before disclosure by the other party; (b) it developed the information independently without recourse to or use of information obtained from the other party; (c) it lawfully received the information from third parties who, to its knowledge, were not bound by any confidentiality obligation to the other party; (d) such information became known to it or is known to the general public without infringement of these provisions or of any other provisions in place to protect the business secrets of the other party; or (e) it must be disclosed based on a statutory obligation or an official or judicial order. In the latter case the receiving party shall inform the other party of the impending disclosure to a third party without undue delay.

12.3. Except to the extent it is necessary for the performance of the agreement each party undertakes to maintain the other party’s confidential information in strictest confidence, and to apply at least the same degree of care in protecting the other party’s confidential information as it applies to protect its own confidential information. Section 13 remains unaffected.

12.4. The mutual confidentiality obligations of this section shall apply for the entire term of the agreement and for an additional period of 5 years after its termination.

12.5. As of this agreement’s commencement date pursuant to section 15.1 the mutual confidentiality obligations of this section shall replace any other confidentiality or non-disclosure obligations regarding the subject matter of this agreement on which the parties may have agreed before, and such other confidentiality or non-disclosure obligations shall no longer apply.

13. References

13.1. References. Emarsys shall be entitled to use the Customer’s name and logo for reference purposes in its own advertising materials such as website, trade fair presentation, brochures, newsletters etc. If such use is subject to specific guidelines the Customer will notify these to Emarsys.

13.2. Specimen copies. Within this scope Emarsys is entitled to use and reproduce specimen copies of its Work Results delivered to the customer for its own marketing purposes.

13.3. Press releases and case studies. Any use of the Customer’s name and/or logo in press releases to external distribution lists and/or in case studies shall only be made with the Customer’s consent.

14. Subcontracting

14.1. Commissioning of subcontractors. Emarsys may commission subcontractors to perform its contractual obligations, provided (i) the Customer has given its prior approval of the subcontractor or (ii) Emarsys has concluded a written agreement with the subcontractor which provides a level of protection to the benefit of the Customer and its data which is at least equal to the level of protection provided by this agreement. Emarsys shall remain fully responsible to the Customer for any services provided by a subcontractor.

14.2. Approved subcontractors. The Customer hereby approves the commissioning of the subcontractors named in appendix 1b.

14.3. Revocation of approvals. Customer may only revoke any given approvals to the commissioning of subcontractors for good cause, provided that such cause (i) is directly related to the affected subcontractor and (ii) would entitle the Customer to terminate this entire agreement for cause if the approval is not revoked.

15. Term and termination

15.1. Term. The contract commences on the agreed date (without an explicit agreement on the commencement date upon signature of the contract by both parties) and cannot be terminated for convenience by either party before the contract’s agreed minimum term has ended. If the minimum term is specified as a number of months (e.g. “12 months”) or years (e.g. “2 years”) the respective period for calculating the minimum term will start with the month in which the last installment of the setup fee pursuant to section c) becomes due.

15.2. Automatic renewal and termination for convenience. A termination notice must be served to the other party in writing at least three months before the termination date at the end of the minimum term (or at the end of a renewal period, respectively). As long as neither party terminates in due time, the contract shall automatically remain in effect for successive renewal periods of twelve months each. The provisions of this section shall similarly apply to any termination of the contract to the end of any such renewal period.

15.3. Termination for cause. The parties’ right to terminate this agreement for cause with immediate effect shall remain unaffected.

15.4. Consequences of termination. After the last day of the contract term has ended the Customer is no longer entitled to use the Emarsys products (except the module for data exports pursuant to section 3.4).

15.5. Survival of provisions. Any provisions of this agreement which by their nature are designed to continue to apply after the contract has ended shall remain unaffected by the contract’s termination. This particularly applies for any indemnification or damage claims which the parties may have.

16. Limitation of liability

16.1. Ordinary negligence. In case of damages caused by not more than ordinary negligence the Customer’s liability claims against Emarsys shall be limited to an amount which Emarsys had anticipated (or should have reasonably anticipated) as a potential consequence of its breach which gave rise to the claim at the time of such breach. Emarsys’ liability for indirect damages, consequential damages and loss of profit shall be fully excluded in such cases.

16.2. Loss of data. Emarsys shall not be liable for any loss of, or damage to, data or programs to the extent that such loss or damage would have been avoided or mitigated by adequate preventative measures of the Customer (which includes the Customer’s own creation of daily back-up copies).

16.3. Application irrespective of legal theory. Except in cases of a contractual guarantee, damages caused intentionally or by gross negligence or damages to life or limb, the foregoing limitations of liability shall apply to any and all damage claims under or in connection with this agreement, irrespective on the legal theory on which they are based (including tort claims).

16.4. Application to direct claims. The foregoing limitations of liability shall also apply to any direct damage claims which the Customer may have against employees or representatives of Emarsys.

16.5. Insurance. Emarsys undertakes to maintain adequate insurance cover for potential liability claims which may arise under or in connection with this agreement.

17. Beta testing by Customer

17.1. Scope. Emarsys can provide products or features which are not yet ready for the market (hereinafter referred to as “Beta Versions”) to the Customer for testing purposes. In do so Emarsys will expressly notify the Customer that the product or service to be tested is a Beta Version. If the Customer decides to test a Beta Version, the supplemental provisions of this section 17 shall apply. In case of conflicts the provisions of this section shall prevail over the other provisions of these standard terms and conditions.

17.2. Possible defects. Both Emarsys and the Customer expect that a Beta Version may have defects. The Customer will consider this possibility when testing the product or feature. The Customer will in particular create additional backup copies of relevant data to prevent potential data losses caused by the Beta Version, and will not use the Beta Version in connection with activities that are business critical or may cause significant damages.

17.3. No charge. Testing a Beta Version is free of charge for both the Customer and for Emarsys.

17.4. Defects. Emarsys shall only be liable for potential defects of quality or for defects of title of a Beta Version if Emarsys has maliciously concealed the defect.

17.5. Liability. In relation to a Beta Version Emarsys shall only be responsible for intent and gross negligence.

17.6. Confidentiality. All features of a Beta Version are confidential information of Emarsys, and the Customer shall treat them as such according to the contractual confidentiality obligations.

17.7. Right to terminate at any time. Both Emarsys and the Customer have the right to terminate the test of a Beta Version for convenience at any time without having to observe a notice period. Termination by Emarsys will particularly occur if Emarsys’ development to the Beta Version is (i) discontinued or (ii) completed and the relevant product or feature is offered commercially.

18. Applicable law and legal venue

18.1. Applicable law. This agreement is exclusively governed by German law (excluding any references to other jurisdictions). The UN Convention on Contracts for the International Sale of Goods shall not apply.

18.2. Legal venue. Exclusive legal venue for all disputes under or in connection with this agreement shall be to the courts of Berlin, Germany. In addition to this either party may initiate court proceedings at the general place of jurisdiction of the other party.

19. Written form

Where this agreement provides that statements of a party must be made in writing it is sufficient to transmit a scanned copy of the statement as a personally signed paper document by fax or
email attachment (but not the transmission of the statement as a mere email text), or to digitally sign the statement using the system of the service provider DocuSign. In such case either party can subsequently demand that the statement is documented in a personally signed paper document.

20. Severability

Should individual provisions of this agreement be or become invalid, the remaining clauses of this agreement shall not be affected. The parties shall replace the invalid provision with a
replacement provision which would have been agreed by the parties pursuant to their original economic intentions. This principle shall also apply in case of any omissions in the contract.

Appendix 1a: Technical and Organizational Measures

1. Entry Control

The following measures prevent unauthorized third parties from physically accessing the data processing equipment that is used for handling personal data:

  • Implementation of physical access control:
    • The building is constructed in such a way that it ensures suitable protection of the
      area in question.
    • All potential access points have been secured against unauthorized access.
    • The existing means of access authentication (key or chip card) is used by and binding
      for all.
    • There is a physical access control system installed.
  • Management and documentation of individually authorized physical access:
    • There exists an organizational policy governing the access to the business premises.
    • The allocation of keys is documented.
  • Supervision of visitors and external staff:
    • There exists a policy for the supervision of visitors and external staff (accompaniment on the premises, temporary visitor passes, recording of such visits, etc.).
    • There exists a policy for the supervision of maintenance staff (accompaniment on the premises, prior notifications, identity checks, etc.).

2. Admission Control

The following measures prevent unauthorized third parties from using data processing systems (including encryption methods):

  • Admission control (authentication):
    • All data processing systems have a user authentication mechanism installed.
    • Proper implementation of these measures (user authentication) is being monitored.
    • A password generator for random passwords is being used.
  • Secure transmission of authentication data (credentials) over the network:
    • The transmission of authentication data (credentials) over the network is performed in
      encrypted form.
  • Blocking after failed attempts/inactivity and process for resetting such blocks there is a secure method for resetting access blocks implemented, e.g. by assigning a completely new user ID.
  • Ban of locally-stored passwords and form entries:
    • Access passwords and/or form entries are not stored on the client itself or in its environment (e.g. in the browser or on a Post-it note).
    • Users have been informed that the above is not allowed.
  • Parameters for authorization:
    • There exists a role concept (predefined user profiles).
    • Admission rights are always granted to individuals (i.e. to a specific person).
    • The number of authorized persons is reduced to the exact minimum that is required to sustain normal business operation.
  • Management and documentation of personal authentication media and admission rights:
    • A process that covers the application, permission, allocation, and withdrawal of authentication media and admission rights has been installed as well as documented and is properly applied.
    • A person responsible for the allocation of admission rights has been appointed.
    • A substitute regulation (stand-ins) is in place.
  • Automatic blocking of access:
    • If a workstation or a terminal has been inactive for more than 30 minutes, a password-protected screensaver is automatically activated via the corresponding operating system mechanisms.
  • Manual block of access:
    • There is a policy in place which specifies that during temporary absences, workstations and terminals have to be protected against unauthorized use, e.g. via an automatic or manual activation of the password protected screensaver.
    • Employees are made aware of the necessity to properly employ the measures described above.

3. Access Control

The following measures ensure that those authorized to use a data processing system can only access data which fall under their access permission, and that during data processing and use, as well as after data storage, personal data cannot be read, copied, changed or removed without permission (including encryption methods):

  • Authorization concept/implementation of access restrictions:
    • There are guidelines for the creation, change and deletion of access profiles.
    • Authorized users can only access data which they require for proper execution of the
      task at hand, and as specified in their individual authorization profiles.
    • If a database contains data belonging to more than one client, or if data by more than one client is being processed in the same data processing system, a logical access restriction has been implemented that limits processing to the data of the client at hand (multi-client capability).
  • Management and documentation of personal access permissions:
    • A process that covers the application, permission, allocation and withdrawal of access permissions has been implemented.
    • Permissions are tied to a personal user ID and an account.
    • If the basis on which the authorization has been granted no longer applies change in function), the authorization is immediately withdrawn.
  • Logging of data access:
    • All read, enter, change and delete operations are logged.
    • For misuse detection, sample evaluations are performed on a regular basis.

4. Transfer Control

The following measures ensure that personal data cannot be read, copied, changed or deleted by unauthorized third parties during electronic transmission, transport or storage on a data carrier, and that it can be checked and determined to which target locations such a transmission of personal data is intended and performed (including encryption methods):

  • Logging:
    • Sending location as well as receiving location are logged.
    • Both locations are specified and documented; all relevant employees know about these specifications.
  • Secure data transmission between server and client:
    • Data transmission between server and client is executed in encrypted form (SSL or SSH or SFTP or VPN).
  • Transmission in the backend:
    • The connection to backend systems is secure.
    • Data that require a high level of protection are encrypted.
  • Risk reduction via network segmentation:
    • A network segmentation is in place and ensures that data transmission is performed via a minimum number of network elements.
    • There exists a net plan.
    • The relevant system is located in a DMZ.
  • Security gateways at network interconnection points:
    • There are firewalls installed at network interconnection points.
    • The firewalls are permanently activated.
    • The firewalls cannot be deactivated by a user.
  • Strengthening of backend systems:
    • Predefined service accounts/passwords have been deactivated.
    • There are guidelines for what to do if a misuse is suspected.
    • There is up-to-date virus protection implemented.
  • Description of all interfaces and the person-related data fields to be transmitted:
    • There exists a documented interface specification.
    • There exist procedural instructions for the transmission.
    • There exists a description of all person-related data fields which are to be transmitted.
  • Man-machine authentication:
    • Mutual authentication via a cryptographic process.
  • Access to local caches:
    • Any access to a potential local cache or database which contains a client’s customer data, for purposes or via applications that the client has not explicitly approved, has been prevented by technical means.
  • A transfer of personal data via postal service does not and will not take place.
  • Collection and destruction process:
    • There exists a policy for a data protection-compliant destruction of data carriers.
    • There exists a policy for the data protection-compliant destruction of documents.
  • Data protection-compliant deletion/destruction procedure:
    • Before data carriers are re-used by other users, they are emptied/deleted in a way that is compliant with data protection law; a recovery of the deleted data is either
      impossible or would cause an unreasonable amount of effort.
    • Hardware components or documents are destroyed in such a way that a recovery is either impossible or would cause an unreasonable amount of effort.

5. Input Control

The following measures ensure that it is subsequently possible to verify and establish if and by whom personal data have been entered in, changed in or removed from data processing
systems (input control):

  • There exists documentation that specifies which persons, due to their function and role, are authorized to, and responsible for, entering, changing and deleting personal data in the data processing system.

6. Order Control

The following measures ensure that personal data which are processed due to a client order can only be processed in compliance with the client’s instructions (order control):

  • Only the clients themselves are authorized to manage the orders in the system.
  • Execution of control obligations:
    • In fulfilling a client’s control obligations, the client is supported by the contractor.
    • All occurring incidents are reported to the client.
    • The contractor has informed all its employees about the obligation to report such
      incidents.
  • Recording of the order execution on the contractor’s part:
    • There exists documentation which guarantees the complete traceability of all individual work steps which are required in the course of executing an order. On request, it can be testified that an individual order was executed in total compliance with the client’s instructions (minimum information: client/customer, action/part order, detailed specification of work steps/process parameters, processing employee, dates, recipient/if applicable).

7. Availability Control

The following measures ensure that personal data are protected against accidental destruction or loss (availability control).

  • Backup concept:
    • There is a backup concept.
    • Backups are performed on a regular basis.
    • A person responsible for the backup, as well as a substitute (stand-in), has been determined.
    • It is checked on a regular basis whether a backup can be restored.
  • Emergency plan:
    • There is an emergency plan which specifies all necessary steps, as well as the persons, in particular on the client side, who are to be informed in case of an emergency.
  • Check of emergency facilities:
    • Emergency generators and overvoltage protection systems are checked regularly, while all operational parameters are monitored on a permanent basis.

8. Principle of Purpose

The following measures ensure that data which have been collected for different purposes can be processed separately:

  • The data belonging to different customers of the client are stored in separate files and different directories and are not bundled or merged.

9. Organization control

  • Process definition/control:
    • There are process instructions in place.
    • For the processing of data within the company, processes and workflows have been defined.
    • The implementation of, and compliance with, these processes is monitored.
  • Training/obligation:
    • Principles of data protection, including technical and organizational measures.
    • Duty of secrecy with regard to trade and business secrets including all operations on the client side (§ 5 BDSG).
    • Proper and careful handling of data, files, data carriers and other kinds of documentation.
    • The trainings are documented.
    • The trainings are repeated regularly, at least every three years.
  • Training/obligation for external parties:
    • External parties will only be granted access to data processing systems after they
      have been notified, trained and committed, in written from, to data secrecy and, if applicable, the secrecy of telecommunications, and other obligations to secrecy.
  • Internal allocation of tasks:
    • Operative and administrative functions have been separated.
  • Substitute regulation:
    • For all business-critical tasks/functions, a substitute (stand-in) has been determined.

Appendix 1b: Subcontractors

Subcontractor:
Emarsys interactive Service GmbH
Stralauer Platz 34
10243 Berlin
Germany

Subcontractor Services:
Agency services in relation to the planning, execution and analysis of email communication

Subcontractor:
Emarsys Technologies Kft.
Árpád út 51
1042 Budapest
Hungary
Subcontractor Services: Deployment / development of the technical email sending platform

Subcontractor:
Scarab Research kft.
Tölgyfa Utca 24
1027 Budapest
Hungary
Subcontractor Services:
Deployment / development of the technical email sending platform for
“recommendation technology”

Subcontractor:
Engage121, Inc.,
20 Glover Avenue, Norwalk, CT 06850 USA
Subcontractor Services: Social Media program and communication provider.

Subcontractor:
LINBIT HA-Solutions GmbH
Stiegergasse 18
1150 Vienna
Austria
Subcontractor Services:
Service partner for operative system
support