DATA PROCESSING ADDENDUM数据处理附加条款
This Data Processing Addendum, including its Attachments, (“https://www.read.ai/termsofservice此数据处理附加条款，包括其附录，(“”) Read AI, Inc.（",” “,” 或“”）与企业用户（“，”或“你”）之间的协议，作为 Read AI, Inc. 服务条款的一部分，网址为，并可能不时更新，或任何其他涉及 Read 和客户之间合同服务交付的协议。“”）。 该 DPA 自您同意协议之日起生效。 该 DPA 将在协议终止或根据本 DPA 条款提前终止时自动终止。 如果本 DPA、协议或任何其他文档的条款与条件之间存在冲突，以本 DPA 的条款与条件为准与控制，但处理客户个人数据主题方面除外（以下定义的术语）。 本 DPA 中未定义但使用大写字母的术语将在协议中给出其定义。
1.1. Scope. This DPA applies where Company Processes Customer Personal Data as a Processor on behalf of Customer, the Controller, in connection with providing the Services. The parties agree that Read is the Processor of Customer Personal Data, except where Read acts as an independent Controller processing Customer Personal Data in accordance with Section 1.5 in connection with its own legitimate business operations.
1.2. Limitations on Use. In Company’s capacity as a Processor, Company will Process Customer Personal Data only: (a) pursuant to Customer’s documented Instructions as specified under Section 1.3 (Instructions), including with regard to transfers of Customer Personal Data to a third country; and (b) as otherwise required by applicable laws, provided that Company will inform Customer (unless prohibited by law) of the applicable legal requirement before such Processing. As a Processor, Company will not (except where otherwise instructed to do so by the Customer): (a) retain, use, or disclose the Customer Personal Data (i) outside of the direct business relationship between the parties or (ii) for any purpose other than for the specific purpose of performing the Services; (b) sell or share (as defined by Data Protection Law) the Customer Personal Data; or (c) combine Customer Personal Data with Personal Data Company receives from individuals or other sources, except as permitted by Data Protection Law.
1.3. Processor Instructions. Customer instructs Company to Process Customer Personal Data as necessary to provide the Services and as otherwise authorized or permitted under this DPA and the Agreement, including as specified in Attachment 2 (Scope of Processing). This DPA, the Agreement, and any instructions provided by Customer through configuration tools made available by Company are Customer’s documented instructions regarding Company’s Processing of Customer Personal Data (“Instructions”). Additional Instructions provided by Customer (if any) require prior written agreement by Customer and Company. Customer will not instruct Company to Process Customer Personal Data in violation of any Data Protection Law. Company may suspend Processing based upon any Customer Instructions that Company reasonably suspects violate Data Protection Law, provided Company will promptly inform Customer if Company believes an instruction infringes Data Protection Law.
1.4. Compliance. Each party will comply with its obligations under Data Protection Law. Company shall promptly notify Customer if it determines that it cannot meet its obligations under Data Protection Law. Upon receiving written notice from Customer that Company has Processed Customer Personal Data without authorization, Company will take reasonable and appropriate steps to stop and remediate such Processing.
1.5. Independent Controller Processing. Read may Process certain data (including Customer Personal Data and Service Data) for its own legitimate business purposes, as an independent Controller, solely when the Processing is strictly necessary and proportionate, and if the Processing is for one of the following purposes:
1.5.1. Customer Personal Data, including but not limited to name, user name, profile photo, email address, phone number, and postal address may be Processed for: (i) billing and account management, and related Customer correspondence; (ii) complying with and resolving legal obligations, including responding to Data Subject Requests (defined in Section 2.1) for Personal Data processed by Company as Controller, financial requirements, agreements, and disputes; (iii) abuse detection, prevention, and protection, virus scanning and scanning to detect violations of terms of service (such as copyright infringement, SPAM, and actions not permitted under Read's Terms of Service); (iv) improving and optimizing the performance and core functionalities of accessibility, privacy, security, and the IT infrastructure efficiency of the Services; (v) internal reporting, financial reporting, revenue planning, capacity planning, and forecast modeling (including product strategy); and (vi) receiving and using Feedback for Read's overall service improvement. For the avoidance of doubt, the company does not process the following categories of Customer Personal Data for the purposes of this Section 1.5.1: audio and video recordings, transcription content, the substance of communications or meeting content.
1.5.2. In addition, Service Data may be Processed for: (i) sales and marketing; (ii) performing data analytics; (iii) monitoring, improving, and supporting the Services; and (iv) designing, developing, and offering Read products and Services.
Except as permitted by Clause 1.7, when acting as an independent Controller, Company will not process Customer Personal Data for any purposes other than the above list of legitimate business purposes.
1.6. Company will not Process Customer Personal Data for third-party advertising, direct marketing, profiling, research or analytics purposes except where such processing is (i) necessary to comply with Customer's Instructions as set out this DPA, or (ii) for the legitimate business purposes described in Section 1.5 or (iii) part of Company’s free Services or individual (i.e., non-enterprise) Services.
1.7. Company shall only process Customer Personal Data for the purposes specified in this DPA; provided, however, Company may process Customer Personal Data and Service Data for “further” or “compatible” purposes (within the meaning of Articles 5(1)(b) and 6(4) GDPR, where applicable), to the extent it is acting as an independent Controller as set out in Sections 1.5.1 and 1.5.2, or seek consent from end users for new types of data processing, where permitted by the Read account administrator and Data Protection Law.
1.8. Confidentiality. Company will ensure that persons authorized by Company to Process any Customer Personal Data are subject to appropriate confidentiality obligations.
1.9. Security. Regardless of its role as a Processor or independent Controller, Company will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against Security Incidents and provide the level of protection required by Data Protection Law in accordance with Attachment 4 (Data Security Exhibit). Company may amend the technical and organizational measures, provided the new measures do not materially reduce the level of security provided by Attachment 4 (Data Security Exhibit).
1.10. Disposal. In its capacity as a Processor, at the choice of Customer, Company will (or will enable Customer via the Services to) delete (and will delete existing copies of) all Customer Personal Data after termination of the Agreement (unless Data Protection Law requires the storage of such Customer Personal Data by Company, in which case Company will only further retain and Process such Customer Personal Data for the limited duration and purposes required by such Data Protection Law). The certification of deletion contemplated by Section 8.5 of the SCCs shall be provided on Customers’ written request.
1.11. Deidentified Data. In Company’s capacity as a Processor, Customer authorizes Company to Process Deidentified Data to provide and improve the Services. Company will (a) take reasonable measures to ensure the Deidentified Data cannot be associated with a Data Subject and (b) publicly commit to maintain and use Deidentified Data in deidentified form and not attempt to reidentify Deidentified Data except as permitted by Data Protection Law.
To the extent Company acts as a Processor:在公司作为处理方的情况下：
2.1. Data Subject Rights Assistance. Customer shall be responsible for responding to requests from individuals to exercise rights under Data Protection Law relating to Customer Personal Data (each a “Data Subject Request”). Customer will inform Company of any Data Subject Request to which Company must comply and provide the information necessary for Company to comply with the request. Company will, to the extent permitted by Data Protection Law, notify Customer if Company receives a Data Subject Request. To the extent Customer, in its use of the Services, does not have the ability to address the Data Subject Request, Company will, on Customer’s request, use commercially reasonable assistance to Customer in responding to such Data Subject Request, to the extent the response to such Data Subject Request is required under Data Protection Law.
2.2. Security Assistance. Taking into account the nature of Processing and the information available to Company, Company will provide commercially reasonable efforts to assist Customer in Customer’s efforts to comply with Customer’s obligations to secure Customer Personal Data by providing the information and assistance described in Section 3 (Audits).
2.3. Security Incident Notice and Assistance. Company will notify Customer without undue delay after becoming aware of a Security Incident. Company will further take commercially reasonable steps to mitigate the effects and minimize any impact from the Security Incident and assist Customer in complying with any related notification obligations under Data Protection Law.
2.4. The obligations described in Section 2.3 shall not apply if a Security Incident results from the actions or omissions of Customer, except where required by Data Protection Law. Company’s obligation to report or respond to a Security Incident under Section 2.3 will not be construed as an acknowledgement by Company of any fault or liability with respect to the Security Incident.
2.5. Notification to Read. If Customer determines to notify any governmental entity, Data Subject(s), the public, or others of a Security Incident, to the extent such notice directly or indirectly refers to or identifies Read, where permitted by applicable laws, Customer will notify Read in writing in advance of such notice and will, in good faith, consult with Read and consider any clarifications or corrections Read may reasonably recommend or request to any such notification that relates to Read’s involvement in or relevance to such Security Incident and is consistent with applicable laws.
2.6. Data Protection Impact Assessment (“DPIA”) and Prior Consultation Assistance. Taking into account the nature of Processing and the information available to Company, Company will provide commercially reasonable assistance to Customer in ensuring compliance with the obligations related to DPIAs and consulting with regulatory authorities.
To the extent Company acts as a Processor:在公司作为处理方的情况下：
3.1. Company Audits. Company may procure audits by third parties to assess Company’s adherence to the following standards or requirements: (a) SOC 2 Type II; (b) ISO 27001; (c) PCI DSS Service Provider Level 1; and/or (d) certifications or other documentation evidencing compliance with alternative standards that are substantially equivalent to the foregoing (collectively, “Audits”). Subject to the confidentiality obligations set forth in the Agreement, Company will provide Customer with summaries of Company’s then-current Audit reports (“Reports”) on Customer’s request. If the Agreement does not include a provision protecting Company’s confidential information, then the Reports will be made available to Customer subject to a mutually agreed upon non-disclosure agreement covering the Reports.
3.2 Customer Audits. Customer agrees to exercise its audit rights by first requesting the Reports as described in Section 3.1 (Company Reports). Customer will only request additional information or an on-site audit of Company to the extent the information provided by Company is not reasonably sufficient to enable Customer to evaluate Company’s compliance with this DPA and/or Data Protection Law. Except in the event of a Security Incident or regulatory investigation, Customer will provide no less than 30 days' advance notice of its request for an on-site audit and will cooperate in good faith with Company to schedule any such audit on a mutually agreeable date and time. Any such on-site audit must occur during Company’s normal business hours and be conducted by Customer or a nationally recognized independent auditor that has agreed to confidentiality provisions reasonably acceptable to Company. Customer is responsible for ensuring that the audit will comply with Company’s applicable on-site policies and procedures and will not unreasonably interfere with Company’s business activities. Customer will provide a written summary of any audit findings to Company, and the results of the audit will be the confidential information of Company.
To the extent Company acts as a Processor:在公司作为处理器的情况下：
4.1. Appointment of Subprocessors. Customer authorizes Company to use subcontractors to Process Customer Personal Data in connection with providing the Services (each, a “Subprocessor”). Customer specifically consents to Company’s appointment of the Subprocessors listed at https://trust.read.ai/subprocessors (the “Subprocessor List”).
4.2. Objection Right for New Subprocessors.
4.2.1. Company will notify Customer of its intent to update the Subprocessor List at least 15 days prior to engaging a new Subprocessor. Customer may object to Company’s use of a new Subprocessor within 10 days of receiving such notice by sending an e-mail to privacy@read.ai clearly indicating its desire to object to any such change.
4.2.2. If Customer objects to the change in Subprocessors, Company and Customer will cooperate in good faith to resolve Customer’s objection. If the parties are unable to resolve Customer’s objection within 10 days, then either party may terminate the Agreement only with respect to those Services that Company indicates cannot be provided without the objected-to Subprocessor.
4.3. Liability. Company will impose data protection obligations upon any Subprocessor that are no less protective of Customer Personal Data than those included in this DPA. Company will be liable to Customer for any breach of such obligations by its Subprocessors as it would for its own acts and omissions.
To the extent Company acts as a Processor:如果公司通知客户数据传输可根据数据保护法律通过替代传输机制（如数据隐私框架）进行，则各方将依靠替代机制使数据传输合法化，而不是依赖以下的规定。
5.1. Overview. The parties will conduct any transfers of European Economic Area, UK, and Swiss residents’ Customer Personal Data to a country not subject to an adequacy decision (a “Data Transfer”) pursuant to the SCCs, which are incorporated and deemed executed by this reference. If Company notifies Customer that Data Transfers can be conducted in compliance with Data Protection Law pursuant to an alternative transfer mechanism such as the Data Privacy Framework, the parties will rely on the alternative mechanism to legitimize Data Transfers instead of the provisions that follow.
5.2. SCCs. The parties agree to comply with the general clauses and; (i) where Company acts as a Processor, with Module 2 (Controller to Processor) of the SCCs with Customer as the “data exporter” and Company as the “data importer” ; and (ii) where Company acts as independent Controller, with Module 1 (Controller to Controller) of the SCCs with Customer as the “data exporter” and Company as the “data importer”.
5.3. Transfers Subject to Swiss Data Protection Law. If any Customer Personal Data subject to the Swiss Federal Act on Data Protection of 25 September 2020 (as amended, replaced, or updated from time to time, the “FADP”) is subject to a Data Transfer, the parties will conduct such transfer pursuant to the SCCs with the following modifications: the competent supervisory authority in Annex I.C under Clause 13 shall be the Federal Data Protection and Information Commissioner; references to a “Member State” and “EU Member State” will not be read to prevent individuals in Switzerland from suing for their rights in Switzerland; and references to “GDPR” in the SCCs will be understood as references to the FADP.
5.4. Transfers Subject to the UK GDPR. Any Customer Personal Data that is subject to the UK GDPR and a Data Transfer will be subject to the UK IDTA, which is incorporated and deemed executed by this reference.
7.1.
Each party’s and all of its affiliates’ liability, taken together in the aggregate, arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitation of liability in the Agreement. Nothing in this Section 6 is intended to restrict the rights of individuals under Data Protection Law.除本数据处理协议中有具体修订和修改外，协议中的条款和规定保持不变并继续充分生效。 除了标准合同条款和英国IDTA中明确说明的内容外，协议的管治法律和法院选择条款将适用于与本数据处理协议相关的任何争议。
7.1. To the extent there is any conflict between the terms of this DPA, on the one hand, and the applicable SCCs or UK IDTA, on the other hand, the SCCs or UK IDTA, as appropriate, will control. Except as specifically amended and modified by this DPA, the terms and provisions of the Agreement remain unchanged and in full force and effect. Except as expressly stated in the SCCs and the UK IDTA, the governing law and forum selection provisions of the Agreement will apply to any disputes arising out of this DPA. No supplement, modification, or amendment of this DPA will be binding unless executed in writing by each party to this DPA.
7.2. If there is a change in (i) Data Protection Law, or (ii) a determination, decision, or order by a Supervisory Authority or competent court affecting this DPA or the lawfulness of any Processing activities under this DPA, then Read may propose supplements and modifications to this DPA. If the Customer objects to the supplement or modification, then Customer must object to the supplement or modification within thirty (30) days or the right to object is waived. If Customer timely objects to the appropriateness of the supplement or modification, then the parties will work to resolve their differences, and if resolution cannot occur within thirty (30) days of Customer’s notice of objection, then either party may terminate this DPA and any affected portion(s) of the Agreement. All supplements and modifications will be in writing and signed by the parties unless the terms of the Agreement provide otherwise.
7.3. The provisions of this DPA are severable. If any phrase, clause or provision or Attachment (including the SCCs) is invalid or unenforceable in whole or in part, such invalidity or unenforceability shall affect only such phrase, clause or provision, and the rest of this DPA or the remainder of the Attachment, shall remain in full force and effect.
“”指数据保护法下的“控制者”和“业务”（及其类似变体）。
Attachment 1: Definitions“”指在附件2中描述的公司代表客户处理的个人数据。
“”指GDPR、英国GDPR、FADP、CCPA、科罗拉多隐私法、康涅狄格州个人数据隐私和在线监控法案、弗吉尼亚州消费者数据保护法和犹他州消费者隐私法以及适用于公司处理客户个人数据的其他州、联邦或国际数据保护或隐私法。
For purposes of this DPA, the following terms will have the meaning ascribed below:
“CCPA” means the California Consumer Privacy Act of 2018, including (a) as amended by the California Privacy Rights Act of 2020 or otherwise and (b) any regulations promulgated thereunder.
“Controller” means “controller” and “business” (and analogous variations of such terms) under Data Protection Law.
“Customer Personal Data” means Personal Data that Company Processes on behalf of Customer in connection with providing the Services as described in Attachment 2. Customer Personal Data does not include Service Data.
“Data Protection Law” means the GDPR, the UK GDPR, the FADP, the CCPA, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Virginia Consumer Data Protection Act, the Utah Consumer Privacy Act, and any other state, federal, or international data protection or privacy laws that apply to Company’s Processing of Customer Personal Data.
"Data Subject” means the identified or identifiable person to whom Personal Data relates.
“Deidentified Data” means information that cannot reasonably be linked to or associated with Customer or any Data Subject.
“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
“Personal Data” means “personal data” and “personal information” (and analogous variations of such terms) under Data Protection Law.
“Process” or ”Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, extending further to such operation or operations under Data Protection Law.
“Processor” means “processor” and “service provider” (and analogous variations of such terms) under Data Protection Law.
“SCCs” means Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on SCCs for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (Text with EEA relevance), available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914, as may be replaced or superseded by the European Commission. For the purposes of Module 2, the parties make the following choices for implementing the SCCs:
For the purposes of Module 1, the parties make the following choices for implementing the SCCs:
“Security Incident” means “personal data breach” and “security incident” (and analogous variations of such terms) under Data Protection Law. For clarity, Security Incident does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data (such as unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems).“Service Data” means any data relating to the use, support, or operation of the Services, which is collected directly by Read from or about users of the Services or Customer’s use of the Services for use for Read’s own purposes.
“Services” means the services provided by Company pursuant to the Agreement.
“Supervisory Authority” means an independent public authority responsible for monitoring the application of Data Protection Law, including the Processing of Personal Data covered by this DPA.
“UK GDPR” means the GDPR as incorporated into United Kingdom law by the Data Protection Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (each as amended, superseded, or replaced).
“UK IDTA” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, Version B1.0, in force 21 March 2022, available at https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf. Neither party can terminate the UK IDTA pursuant to Table 4 and Section 19 thereof without the written consent of the other.
Attachment 2 - Scope of Processing附件2 - 处理范围
Data exporter
Customer
Data importer
Company
Subject-Matter and Duration of Processing
Company Processes Customer Personal Data if and when provided by Customer in the course of providing the Services in accordance with the Agreement and until the Agreement terminates or expires.
Nature and Purpose of Processing
Processing of Customer Personal Data in connection with and for the purpose of Company providing the Services to Customer pursuant to the Agreement. Specifically, the Customer Personal Data will, if and to the extent Customer provides it, be subject to storage and analysis, among other Processing activities.
Types of Customer Personal Data
Customer may submit Customer Personal Data to the Services, the extent of which is determined and controlled by Customer in its sole discretion. This may include, but is not limited to the following categories of data:
Categories of Data Subjects
The data subjects will include Customer’s employees, contractors, and end-users.
Special Categories of Data (as applicable)
The Services are not designed for special categories of Personal Data. Company does not anticipate that Customer will submit special categories to the Services. To the extent that such data is submitted to the Services, it is determined and controlled by Customer in its sole discretion.
Frequency of Transfers
Company will import Customer Personal Data on a continuous basis.
Period of Data Retention
Company will retain the Personal Data until the termination of the Agreement, unless otherwise agreed to by the parties.
Attachment 3 - Scope of Processing (Company as Controller)
Data exporter
Customer
Data importer
Company
Subject-Matter and Duration of Processing
Company Processes Customer Personal Data and Service Data for the purposes described in Section 1.5 of this DPA and for as long as necessary to achieve the purposes of processing.
Nature and Purpose of Processing
Processing of Customer Personal Data and Service Data for the purposes described in Section 1.5 of this DPA. Specifically, the Customer Personal Data and Service Data will, if and to the extent Customer provides it, be subject to storage and analysis, among other Processing activities.
Types of Personal Data
Customer may submit Personal Data to the Services and Company may obtain Personal Data via the provision of the Services. This may include, but is not limited to the following categories of data:
Categories of Data Subjects
The data subjects will include Customer’s employees, contractors, and end-users.
Special Categories of Data (as applicable)
The Services are not designed for special categories of Personal Data. Company does not anticipate that Customer will submit special categories to the Services and Company shall not seek to obtain special categories through its provision of the Services.
Frequency of Transfers
Company will import Customer Personal Data and Service Data on a continuous basis.
Period of Data Retention
Company will retain the Personal Data for as long as necessary to achieve its intended purposes and as otherwise notified to Data Subjects in Company’s applicable privacy notice.
Attachment 4 - Data Security Exhibit
范围1.1.。 在公司作为处理方代表控制方客户处理客户个人数据的情况下，适用本 DPA。 双方同意，Read 是客户个人数据的处理方，除非 Read 作为独立控制方为其自身合法业务在第 1.5 节中处理客户个人数据。
使用限制。1.2. 在公司作为处理方的情况下，公司仅根据如下第 1.2 节（指令）中指定的客户书面指令处理客户个人数据，包括转移客户个人数据到第三国；并且依照适用法律要求进行处理，但公司将告知客户（除非法律禁止）相关的法律要求。 作为处理方，公司将不：（x）保存、使用或披露客户个人数据（i）在双方直接业务关系之外，（ii）出于执行服务的特定目的以外的任何用途；（y）出售或分享（数据保护法定义的）客户个人数据；或（z）将客户个人数据与公司从个人或其他来源接收到的个人数据结合，除非数据保护法允许。
处理方指令1.3. 。 客户指令公司必需处理客户个人数据以提供服务，并根据本 DPA 及协议授权的其他用途处理，包括附件 2 中规定的（处理范围）。 该 DPA、协议以及客户通过公司提供的配置工具提供的任何指令是公司处理客户个人数据的客户书面指令（"")。 客户提供的附加指令（如有），需要客户和公司事先书面同意。 客户不得指令公司处理任何违反数据保护法的客户个人数据。 公司若合理怀疑客户指令违反数据保护法的，可能暂停处理，但须及时通知客户若公司认为该指令违反数据保护法。
合规性。1.4. 各方将履行其在数据保护法下的义务。 若公司确定其无法履行其在数据保护法下的义务，将及时通知客户。 收到客户关于公司未经授权处理客户个人数据的书面通知后，公司将采取合理和适当的步骤停止和补救此类处理。
独立控制方处理1.5. 。 Read 可能出于其自身的合法业务目的处理某些客户个人数据，作为独立控制方，仅当处理是严格必要且适当的，如处理出于以下目的：
服务条款1.5.1. 可直接识别的数据（姓名、用户名、头像、电子邮件地址、电话号码、邮寄地址，以及与此类可直接识别数据直接相关的所有客户个人数据）可被处理为：(i) 账单和账户管理，以及相关客户往来；(ii) 符合和解决法律义务，包括回应数据主体请求（第 2.1 节定义）公司作为控制方处理的个人数据，财务需求、协议和争议；(iii) 违法检测、预防与保护，病毒扫描和扫描以检测服务条款的违反（如版权侵权、垃圾邮件、以及 Read 的 下不允许的行为）; (iv) 改善和优化访问、隐私、安全性和服务的 IT 基础设施效率等核心功能；(v) 内部报告、财务报告、收入规划、容量规划和预测建模（包括产品策略）；及 (vi) 接收和使用客户对于 Read 整体服务改进的反馈。
作为独立控制方，公司将不会出于上述合法业务目的清单以外的任何其他目的处理客户个人数据。
1.6. 公司不会为了第三方广告、直销、分析和研究目的处理客户个人数据，除非这种处理：（i）为遵循客户的指令，如本 DPA 所述，或（ii）为第 1.5 节描述的合法业务目的，或（iii）为公司提供的免费服务或个人（即非企业）服务的一部分。
1.7. 公司仅会为本 DPA 指定的目的处理客户个人数据；但公司可以为“进一步”或“兼容”的目的处理客户个人数据（在 GDPR 第 5(1)(b) 和第 6(4) 条的意义范围内，上述规定适用），或在 Read 账户管理员和数据保护法允许的情况下，向终端用户寻求新类型数据处理的同意。
保密性。1.8. 公司将确保公司授权处理任何客户个人数据的人员遵守适当的保密义务。
安全性。1.9. 无论其为处理方还是独立控制方，公司将实施和维持设计用来保护客户个人数据免遭安全事件的适当技术和组织措施，并根据附件 3（数据安全备忘录）的要求提供数据保护法规定的保护级别。 公司可以修改技术和组织措施，但新措施不得大幅降低附件 3（数据安全附录）提供的安全等级。
销毁。1.10. 作为处理方的公司依据客户的选择将在协议终止后删除（并删除现存副本的）所有客户个人数据（除非数据保护法要求公司保留此类客户个人数据，在这种情况下，公司将仅根据数据保护法规定的有限期限和目的进一步保留和处理此类客户个人数据）。 根据 SCCs 第 8.5 节的预期删除认证将根据客户的书面请求提供。
去识别数据。1.11. 作为处理方的公司，授权公司处理去识别数据以提供和改进服务。 公司将（a）采取合理措施确保去识别的数据无法与数据主体相关联，并（b）公开承诺以去识别形式维护和使用去识别数据，不试图重新识别去识别数据，除非数据保护法允许。
数据主体权利协助。2.1. 客户需负责回应个人行使与客户个人数据相关的数据保护法下的权利请求（每一个请求即为“”）。 客户将通知公司任何公司需遵循的数据主体请求，并提供公司所需的符合请求的信息。 在数据保护法允许的范围内，若公司收到数据主体请求，将通知客户。 在客户使用服务的情况下，如果客户无法解决数据主体请求，根据客户的要求，公司将在回应该数据主体的请求上为客户提供合理协助，且此协助仅限于数据保护法要求的范围。
安全协助。2.2. 考虑到处理的性质和公司提供的信息，公司将提供合理的商业努力协助客户遵守其保护客户个人数据的义务，通过提供第 3 节（审计）中的信息和协助。
安全事件通知及协助。2.3. 无不当延误地在公司知晓安全事件后通知客户。 公司将进一步采取合理的商业步骤以减轻安全事件的影响，并协助客户遵循任何相关的通知义务以符合数据保护法。
2.4. 第 2.3 节中描述的义务不适用于由客户行为或遗漏导致的安全事件，除非数据保护法要求。 公司的报告或回应安全事件的义务根据第 2.3 节的规定不得解释为公司对安全事件的任何过失或责任的承认。
DPIA 数据保护影响评估（""）及前置咨询协助。2.5. 考虑到处理的性质和公司提供的信息，公司将为客户在确保遵循与 DPIA 和向监管机构咨询的义务方面提供商业协助。
公司审计3.1. 。 公司可能采取第三方审计以评估公司对以下标准或要求的遵循：（a）SOC 2 Type II；（b）ISO 27001；（c）PCI DSS 服务提供商 1 级； 和/或（d）证明符合替代准则的认证或其他文件，且需与上述基本等同（统称为“”）。 根据协议中规定的保密义务，应在客户要求时向客户提供公司当前审计报告的总结（“报告”）。 如果协议不包含保护公司机密信息的条款，则报告将在双方同意的涵盖报告的非披露协议的前提下提供给客户。
客户审计。3.2 客户同意通过首先请求第3.1节（公司报告）中描述的报告来行使其审计权利。 客户只有在公司提供的信息不足以让客户评估公司对本数据处理协议和/或数据保护法律的合规性时，才会请求额外信息或对公司进行现场审计。 除非发生安全事件或监管调查情况，客户将提前至少30天通知公司其现场审计的请求，并与公司良好信任地合作，以在双方都同意的日期和时间进行任何此类审计。 任何此类现场审计必须在公司的正常营业时间内进行，由客户或已同意保密规定的国家认可的独立审计员执行，且这些规定对公司是合理可接受的。 客户负责确保审计符合公司的适用现场政策和程序，并不会无理干扰公司的业务活动。 客户将向公司提供任何审计结果的书面总结，审计结果将作为公司的机密信息。
子处理器的任命。4.1. 客户授权公司使用分包商处理客户个人数据以提供服务（每个分包商为“”）。 客户特别同意公司在[网站]列出的子处理器的任命（“”）。 4.2.
新子处理器的异议权。公司将在聘请新子处理器至少15天前通知客户将更新子处理器名单的意图。 客户可以在接到此类通知后10天内，通过向privacy@read.ai发送电子邮件，明确表示其反对意见。
4.2.2. 如果客户对子处理器的更换提出异议，则公司和客户将良好信任地合作以解决客户的异议。 如果双方在10天内未能解决客户的异议，则任何一方可终止协议，仅限于公司指出无法在没有所反对的子处理器的情况下提供的服务。
4.3. 公司将对任何子处理器施加数据保护义务，这些义务不低于本数据处理协议中包含的对客户个人数据的保护。
责任。公司将对其子处理器违反这些义务的行为向客户承担责任，就像它对自己的行为和不作为负责任一样。 数据传输 在公司作为处理器的情况下： 5.1.
概览。5.2. 各方同意遵守标准合同条款的一般条款以及模块2（控制者到处理者）的内容，客户作为“数据输出方”，公司作为“数据输入方”。 5.3.
标准合同条款。如果任何受1992年6月19日瑞士联邦数据保护法（“”）约束的客户个人数据需要进行数据传输，则各方将按照标准合同条款进行此类传输，修改如下：附录I.C下第13条中的主管监督机构为联邦数据保护和信息专员；对“成员国”和“欧盟成员国”的提及将不妨碍在瑞士的个人在瑞士为维护其权利而提起诉讼；标准合同条款中对“GDPR”的提及将被理解为指FADP。 5.4.
受瑞士数据保护法约束的传输。任何受英国GDPR和数据传输约束的客户个人数据将受英国IDTA的约束，英国IDTA通过本参考文献被编入并被视为已执行。 责任限制
受英国GDPR约束的传输。各方及其所有附属公司的责任，整体来说，由本数据处理协议产生或与其相关，不论是合同责任、侵权责任或任何其他责任理论的责任，以协议中的责任限制为准。 本第6节中的任何内容均无意限制个人根据数据保护法的权利。 杂项
7.2. 如果（i）数据保护法律有所变化，或者（ii）监管机关或主管法院的决定、决策或命令影响到本数据处理协议或任何处理活动的合法性，Read可提议对本协议的补充和修改。 如果客户反对补充或修改，则客户必须在30天内反对，否则反对权利将被视为放弃。 如果客户及时反对补充或修改的适当性，双方将努力解决争议，如果在客户提出异议后的30天内无法解决，则任何一方可以终止本数据处理协议及/或协议的任何受影响部分。 所有补充和修改将以书面形式进行并由双方签署，除非协议另有规定。
7.3.j 本数据处理协议的条款是可分割的。 如果任何短语、条款或规定或附件（包括标准合同条款）在整体或部分无效或无法执行，则此类无效或不可执行性仅影响相关短语、条款或规定，其余部分的数据处理协议或附件将继续有效。 附件1：定义
为本数据处理协议目的，以下术语将具有下面赋予的含义： “”指《2018年加州消费者隐私法案》，包括（a）2020年《加州隐私权法案》或其他修正内容，以及（b）根据其颁布的任何法规。
"”指已识别或可识别的个人，其个人数据与其相关。
CCPA“”指无法合理与客户或任何数据主体关联或相关的信息。
控制者“”指《欧洲议会和理事会2016年4月27日关于保护自然人就个人数据处理和此类数据自由流动的条例，并废除第95/46/EC指令（通用数据保护条例）》。
客户个人数据“个人数据”指数据保护法律下的“个人数据”和“个人信息”（及类似变体）。
数据保护法律“”或“”指在个人数据或个人数据集上执行的任何操作或一组操作，无论是否通过自动化手段，如收集、记录、组织、结构化、存储、调整或更改、检索、咨询、使用、通过传输披露、传播或以其他方式提供、对其对齐或组合、限制、擦除或销毁，延伸进一步到数据保护法律下的这样的操作或操作。
数据主体“”指数据保护法律下的“处理器”和“服务提供者”（及其类似变体）。
去标识化数据双方对实施标准合同条款做出的以下选择：
GDPRSection 8.9所设想的审计将根据本数据处理协议的审计规定进行。
处理处理过程在第9条中，选项2将适用，并且子处理器更改通知的时间期限将如本数据处理协议中所述。
处理器
https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914“SCCs”是指《欧盟委员会实施决策(EU) 2021/914 of 4 June 2021》，关于根据《欧洲议会和理事会法规(EU) 2016/679》的规定向第三国转移个人数据的SCCs（与欧洲经济区相关的文本），可在https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914获取，可能会被欧盟委员会替换或取代。 各方选择实现SCCs的下列选项：
安全事件“”指“个人数据泄露”和“安全事件”（以及此类术语的类似变体），在数据保护法下。
服务“” 指公司根据协议提供的服务。
监管机构“” 指负责监测数据保护法律应用的独立公共机构，包括本DPA涵盖的个人数据处理。
UK GDPR“”指通过2018年《数据保护法》纳入英国法律的GDPR，并通过数据保护、隐私和电子通讯（修正案等）进行了修正。 （欧盟退出）2019年条例（每个被修订、替代或替换）。
UK IDTA“” 指由英国信息委员颁布的EU委员会标准合同条款国际数据转移附录，版本B1.0，于2022年3月21日生效，提供链接请访问 https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf。 任一方未经另一方书面同意不得根据表4及其第19条终止UK IDTA。
客户
公司
公司将在提供服务期间及至协议终止或过期期间，根据协议处理客户个人数据。
与公司根据协议向客户提供服务相关并为此目的处理客户个人数据。 特别是，在客户提供的情况下，客户个人数据将被存储和分析等处理活动所覆盖。
客户可以将客户个人数据提交到服务中，其范围由客户自行决定和控制。 这可能包括但不限于以下数据类别：
数据主体将包括客户的员工、承包商和最终用户。
该服务不是为特殊类别的个人数据设计的。 公司预计客户将不会提交特殊类别到服务。 在提交此类数据到服务的情况下，由客户自行决定和控制。
公司将持续导入客户个人数据。
公司将保留个人数据，直至协议终止，除非双方另有约定。
%2C%20Color%3DOriginal.png)
