Data Processing Agreement

Effective Date: 28/08/2023‍

This agreement is made effective upon you (”Data Controller”) entering into the Terms of Service of the Noon application and Noon at Work B.V., Stationsplein 45, 3013 AK Rotterdam, The Netherlands ("Data Processor").

1. Definitions and Interpretation

1.1. Personal Data‍

Any information relating to an identified or identifiable natural person.

1.2. Data Subject

The identified or identifiable natural person to whom the Personal Data refers.

1.3. Processing

Any operation or set of operations performed on Personal Data.

1.4. Subprocessor

Any third-party appointed by or on behalf of Noon to process Personal Data in connection with the Agreement.

2. Purpose of the Processing

Noon agrees to process the Personal Data solely for providing services as detailed in the Terms of Service Agreement between the parties and for no other purpose unless otherwise instructed by the Data Controller in writing.

3. Obligations of the Data Processor

3.1. Compliance With Applicable Law

Noon will process the Personal Data in compliance with applicable data protection laws, including GDPR.

3.2. Commitment to Confidentiality

Noon shall ensure that its personnel authorized to process the Personal Data are committed to confidentiality.

4. Subprocessors

4.1. Engagement of Subprocessors

The Data Controller grants a general authorization to Noon to engage Subprocessors.

4.2. Subprocessor Agreements

Noon will enter into a written agreement with each Subprocessor and will ensure they commit to the same data protection obligations as set forth in this Agreement.

4.3. List of Subprocessors

A list of subprocessors that Noon engages can be found in Section 8 of our privacy policy.

5. Data Transfer

5.1. International Data Transfer

Noon will not transfer Personal Data outside of the EEA or UK unless it complies with the provisions set forth by GDPR concerning such transfers.

6. Data Security

6.1. Measures Against Unlawful Processing

Noon will take appropriate technical and organizational measures against unauthorized or unlawful processing of the Personal Data.

6.2. Data Breaches

In the event of a Personal Data breach, Noon will notify the Data Controller without undue delay.

7. Data Subject Rights

Noon will assist the Data Controller in facilitating the rights of the Data Subjects under GDPR. This includes but is not limited to rights of access, rectification, erasure, and data portability.

8. Return or Deletion of Data

Upon termination of the agreement or upon request, Noon will, at the choice of the Data Controller, return or delete all the Personal Data unless EU or EU Member State law requires storage of the Personal Data.

9. Audits

9.1. Availability of Information

Noon shall make available to the Data Controller all necessary information to demonstrate compliance with the obligations laid down in this Agreement.

9.2. Auditing of Data Processing Activities

The Data Controller may audit the data processing activities of Noon with reasonable notice.

10. Liability and Indemnification

10.1. Fault

The parties agree that any liability arising from violations of this Agreement will be apportioned based on respective fault.

10.2. Indemnification

Each party shall indemnify the other against all liabilities, costs, expenses, damages, and losses suffered or incurred by the other party arising out of or in connection with the breach of GDPR.

11. Governing Law and Jurisdiction

This Agreement shall be governed by the laws of The Netherlands. Any disputes arising from or in connection with this Agreement shall be submitted to the competent court in Rotterdam.

12. General Provisions

12.1. Conflict Resolution

If there exists any conflict between this Agreement and the main service agreement or any other agreement between the parties, the terms of this Agreement shall prevail.

12.2. Amendment

This Agreement may only be amended by written agreement of both parties.