THIS DATA PROCESSING AGREEMENT (the “Agreement“) is entered into by and between:
the “Client” and
AMMA FAMILY BR LTDA, a legal entity formed and existing under the laws of Federative Republic of Brazil, business (registered) address: cidade de São Paulo/SP, Estado de São Paulo, Rua Coronel Melo de Oliveira, 424, Perdizes, CEP 05011-040, Companies Registration Identification Number (NIRE): 35261753974, Tax ID (CNPJ): 51.408.966/0001-01, also acting on behalf of its Affiliates (the “AMMA FAMILY BR”),
hereinafter jointly referred to as "Parties" and individually referred to as "Party".
This Agreement is an integral part of the TERMS AND CONDITIONS FOR ADVERTISING in Pregnancy Tracker Mobile Application (the “Terms”).

WHEREAS
(A) AMMA FAMILY BR owns, controls, and operates the Apps that help women, including but not limited to pregnant women track their pregnancy and parents capture their newborns’ milestones and the Client wishes to expand its audience and target its promotional activities on the App Users;
(B) In order to achieve the above goal the Parties have entered into an advertising agreement based on the Terms and a corresponding Advertising Order(s) to place the Client’s Registration Field in the Apps (the “Principal Agreement”) that requires certain User Data to be processed by AMMA FAMILY BR as Processor;
(С) The Client acts in the capacity of a Data Controller;
(D) The Parties seek to implement an agreement that complies with the requirements of the current legal framework in relation to Personal Data processing;
(E) The Parties wish to lay down their rights and obligations in that regard.
IT IS AGREED AS FOLLOWS:

1. Definitions and Interpretation

1.1. Unless otherwise defined herein, capitalized terms and expressions used in this Agreement shall have the following meaning:
1.1.1. “Affiliate” means with respect to a specified entity, an entity that directly or indirectly through one or more intermediaries, is controlled by such specified entity or controls the specified entity, or are under common control with the specified entity, in each case where the term “control” means possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract interest or otherwise.
1.1.2. “Agreement” means this Agreement and all Schedules.
1.1.3. “Apps” means the mobile applications ‘AMMA Pregnancy Tracker’ owned, controlled and operated by the AMMA FAMILY BR and/or its Affiliates that are published and can be downloaded at the following links:

- Google Play;
- iTunes/Appstore;
- AppGallery.

1.1.4. “App Users” – users of the Apps who have agreed to the Client’s Privacy Policy posted directly or by the link in the Apps by means of checking the appropriate box in the Apps.
1.1.5. “Client’s Privacy Policy” – the Client’s Processing Policy that pertains to Processing of Personal Data, as may from time to time be revised by the Client to comply with the Data Protection Laws.
1.1.6. “Subprocessor” means any Processor appointed by or on behalf of AMMA FAMILY BR to process Personal Data on behalf of the Client in connection with the Agreement.
1.1.7. “Applicable Data Protection Law” means (a) all applicable laws pertaining to the Processing of Personal Data in any part of the world; and (b) all formal guidance and codes issued by any data protection authority, or equivalent regulator, applicable in any part of the world, each as amended from time to time.
1.1.8. “Data Transfer” means:
1.1.8.1. a transfer of User Data from AMMA FAMILY BR to the Client and/or a Client’s 3rd Party Processor”; or
1.1.8.2. a transfer of User Data from AMMA FAMILY BR to a subcontracted Processor and/or back, or between two establishments of a subcontracted Processor.
1.1.9. “3^rd Party Processor” means any Data Processor, other than AMMA FAMILY BR, designated by the Client.
1.1.10. “User Data” means any App Users’ information Processed by AMMA FAMILY BR on behalf of Client pursuant to or in connection with this Agreement that may include Personal Data.
“Data Controller”, “Data Processor”, “Data Owner”, “Personal Data”, “Process/Processing” and “Privacy Policy” or “Privacy Notice” have the meanings set out in the Applicable Data Protection Laws or, if not defined in such Applicable Data Protection Laws.
1.2. All other capitalized words and expressions in the Agreement shall, unless explicitly stated otherwise or the context otherwise requires, have the same respective meanings as in the Principal Agreement.

2. Subject Matter of the Agreement

2.1. The Client hereby instructs AMMA FAMILY BR as Processor to Process the User Data of App Users for and on behalf of the Client as Data Controller.
2.2. The User Data to be Processed, as well as the timeframe of Processing and any additional terms shall be laid out in the Advertising Order form(s) which constitute the Principal Agreement.

3. Rights and Obligations of the Parties

3.1. AMMA FAMILY BR undertakes to:
3.1.1. not Process User Data other than on the relevant Client’s instructions;
3.1.2. post the Client’s Privacy Policy in the App or link to it;
3.1.3. update the Client’s Privacy Policy per Client’s instructions;
3.1.4. procure API (Application Programming Interface) integration with the help of which the User Data will be transmitted to Client and/or Client’s 3rd Party Processor, unless the other way of transfer is agreed by the Parties;
3.1.5. process the User Data under this Agreement separately from any other data processed by it with the help of the Apps;
3.1.6. follow other instructions of the Client in connection with the Processing of User Data.

3.2. The Client undertakes to:
3.2.1. directly name AMMA FAMILY BR as its Data Processor, with all the rights and obligations as such, in the Client’s Privacy Policy, including cross-border transfer provisions;
3.2.2. timely provide revised versions of the Privacy Policy to be posted in the Apps;
3.2.3. ensure that AMMA FAMILY BR has all the information and access status necessary for the above API integration;
3.2.4. at its own discretion as a Data Controller to identify the period and purposes of Processing the Personal Data of the App Users, reflect such period and purposes in its Privacy Policy and, if necessary, assess the appropriate level of security and instruct AMMA FAMILY BR on introducing and maintaining the appropriate security measures;

3.3. The Client hereby grants AMMA FAMILY BR for the term of this Agreement:
3.3.1. the right to post the Client’s Privacy Policy in the Apps on behalf of the Client;
3.3.2. the permission to use the Client’s commercial designation, brand name, trademarks and other means of individualization for the purpose of performance of this Agreement that includes but is not limited to informing the App Users of the Client’s promotional programs, etc.
3.4. The Parties undertake to:
3.4.1. take reasonable steps to ensure the reliability of any employee, agent or contractor of any Subprocessor/3rd Party Processor who may have access to the User Data, ensuring in each case that access is strictly limited to those individuals who need to know / access the relevant User Data, as strictly necessary for the purposes of the Principal Agreement, and to comply with Applicable Data Protection Laws in the context of that individual’s duties to the Subprocessor/3rd Party Processor, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality;
3.4.2. The Client is solely responsible for compliance with Data Owner’s rights fulfillment.
3.4.2.1. In case of receiving request from any Data Owner, AMMA FAMILY BR shall provide the Client with all details of request including but not limited to date of request, channel of request, text of request, Data Owner information (if any) promptly. The term of providing information shall not exceed 5 business days.
3.4.2.2. If the Client instructs AMMA FAMILY BR to do so, AMMA FAMILY BR shall rectify, delete, or restrict the processing of Personal Data.
3.4.2.3. If a Data Owner contacts AMMA FAMILY BR directly to have his or her personal data rectified, deleted or the processing restricted, AMMA FAMILY BR shall forward this request to the Client immediately upon receipt. The term of providing information shall not exceed 5 business days.
3.4.2.4. The assistance shall, in each case, be limited to the processing of Personal Data under this Agreement.
3.4.3. The Parties agree to cooperate and assist each other in complying with the obligations set out by the Applicable Data Protection Laws including the cooperation in terms of data breaches.
3.4.3.1. The term of providing information shall not exceed 5 business days.
3.4.3.2. The assistance shall, in each case, be limited to the processing of Personal Data under this Agreement.

4. Processing of Personal Data

4.1. The Client warrants and represents that the Client comply with all Applicable Data Protection Laws in the Processing of User Data.
4.2. Processing is carried out by AMMA FAMILY BR using automation tools.
4.3. The list of actions (operations), scope of personal data is specified in Annex I.
4.4. AMMA FAMILY BR has the right to transfer the User Data to European Union, United States of America, the United Kingdom, countries of Latin America, Hong Kong, CIS countries, and other countries as permitted by Applicable Data Protection Laws without separate written consent of the Client. Herewith, where there is cross-border Data Transfer, the Parties shall ensure that any personal data are adequately protected. To achieve this, the Parties shall, unless agreed otherwise, rely on other Applicable Data Protection Law for the transfer of personal data.
4.5. The period of Processing of the User Data by AMMA FAMILY BR is determined by the Client in accordance with its Privacy Policy and may be changed by the Client, in such a case the Client shall notify AMMA FAMILY BR about such changes. By all means, except for storage and transfer: the period of Processing shall be not less than the period of validity of the Advertising Order. At the same time, data storage and transfer to the Client can be carried out by AMMA FAMILY BR, including after the execution of other actions within the Application until AMMA FAMILY BR receives the Client’s or App User’s request to delete them. If it is not specified otherwise after termination of the Agreement, AMMA FAMILY BR shall delete or return to the Client all the personal data processed on behalf of the Client relating to processing and delete existing copies after the end of the provision of services as described in Annex I, provided that the deletion of these data does not conflict with any statutory storage obligations of AMMA FAMILY BR. The deletion in accordance with data protection and data security regulations must be documented and confirmed upon request to the Client.
4.6. In no way AMMA FAMILY BR is responsible for any actions and/or omissions with the User Data committed by the Client or any other third party involved by the Client to the processing of the User Data.

5. General Terms

5.1. The Term of this Agreement. The Term of this Agreement shall be equal to the term of the Principal Agreement.
5.2. Confidentiality. Each Party must keep this Agreement and information it receives about the other Party and its business in connection with this Agreement (“Confidential Information”) confidential and must not use or disclose that Confidential Information without the prior written consent of the other Party except to the extent that:
(a) disclosure is required by law;
(b) the relevant information is already in the public domain.
5.3. Notices. All notices and communications given under this Agreement must be in writing and will be delivered personally, sent by post or sent by email to the address or email address set out in the heading of this Agreement at such other address as notified from time to time by the Parties changing address.
5.4. The PARTIES acknowledge and represent, on an irrevocable and irreversible basis, that this AGREEMENT is an executive title under the terms of art. 585, Item II, of the CCP, and can be claimed in whole or in part by any of the contracting Party, without benefit of order.

6. Governing Law and Jurisdiction

6.1. The validity, interpretation, construction and performance of this Agreement is governed by the laws of Federative Republic of Brazil, without giving effect to the principles of conflict of laws.
6.2. If these negotiations do not succeed, the disputed issues will be resolved by competent civil courts of São Paulo, Brazil.


Annex I
DESCRIPTION OF PROCESSING

Categories of data subjects whose Personal Data is processed
· App Users

Nature of the processing
· Collection
· Usage
· Storage
· Updation
· Recording
· Deletion
· Anonymisation
· Pseudoninisation

The period for which the Personal Data shall be retained by AMMA FAMILY BR, or, if this is not possible, the criteria used to determine that period:
· 3 months after termination of the Agreement, or:
· 3 months after the instruction of the Controller to delete Personal Data.

Purposes of processing:
· Participation of App Users in the Client`s loyalty program for the purposes of marketing goods, works and services of the Client by means of showing App Users direct ads and/or by contacting App Users via means of communication, providing App Users with the information on Client`s promotional actions and programs for customers
· Other purposes ad determined by the Client in accordance with its Privacy Policy.
Description of the technical and organisational measures: physical and technical and administrative (organizational) security measures designed to protect Personal Data from damage, loss, alteration, destruction or unauthorized use, access or processing.