In this Addendum, the following words and expressions have the following meanings:

2.1 In order to provide services under the MSA and enable the Controller to access and use the Platform, the Processor may Process Personal Data on behalf of the Controller. This Addendum is therefore incorporated into the MSA and regulates the rights and obligations between the Parties in relation to such Processing of Personal Data.

2.2 The scope of Processing and the Controller's Personal Data involved in such Processing is specified in Appendix No. 1 hereto. By using the Platform for his business purposes, the Controller sets and controls the purpose of Processing this Personal Data. Any further reference to Personal Data means solely Personal Data described in Appendix no. 1 hereto unless explicitly stated otherwise.

2.3 In case of changes to the Platform that have an effect on the categories of Personal Data being Processed, the Processor is to inform the Controller about the changes upfront and provide the updated Appendix No. 1.

3.1 The Controller is to ensure an adequate legal basis for Processing Personal Data and that the Data Subjects are duly informed about the Processing. The controller should use the Platform for Processing Personal Data only when these conditions are met.

3.2 In the absence of separate Instructions, the Controller agrees they shall be Processed in a manner consistent with the functioning of the Platform, i.e. as described in the General Terms of Use and/or other documentation for the Platform (e.g. FAQs).

3.3 Controller has the right at any point in time to independently execute corrections, deletion and/or transfer of the Personal Data or, if it cannot, request the same from the Processor.

4.1 Processor accepts all the duties foreseen for the processors in the Regulation, Article 28 and which are in more detail explained hereafter.

4.2 Processor undertakes to Process Personal Data solely for the purposes foreseen by the MSA. The processor will apply the technical and organizational measures stated in Point 5 below to this Processing.

4.3 Processor may be in a position of a separate controller in case when he has separate legal basis for Processing Personal Data. For example when Processing Personal Data is necessary to achieve any of the following:

4.4 Processor undertakes to reasonably support Controller, on his request, in complying with the provisions of the Regulation. In particular, in case of any of the Data Subject's requests which may include, but are not limited to, any requests regarding the access, rectification, erasure, restriction, and transfer of Personal Data of an individual Data Subject, the Processor will forward any such request to Controller without delay and in case Controller seeks assistance with any such request, Processor will respond no later than within the next 3 (three) working days.

4.5 Processor has obliged all its employees, and other persons involved in Processing Personal Data to maintain the confidentiality of Personal Data on a permanent basis. Processor undertakes to inform its employees and all other persons involved in the Processing of Personal Data about its obligations hereunder.

4.6 In case of a suspected or established Personal Data Breach, the Processor shall notify the Controller without delay, no later than within the next 24 (twenty-four) hours. The notification will include information on the time and nature of the event (including information on Data Subjects, data in question, categories of Personal Data, and an estimated number of Data Subjects impacted by the Personal Data Breach), system and processing, time of detection, potential consequences as well as measures taken or proposed by Processor to resolve or reduce the impact of the Personal Data Breach. Processor shall analyze and document the cause of the Personal Data Breach immediately after becoming aware of it and submit it to Controller upon his request.

4.7 The Controller shall have the right to audit the Processing of Personal Data carried out within the Platform no more than once every twenty-four (24) months, and at any time upon the written request of a competent national data protection supervisory authority, for the sole purpose of verifying the Processor’s compliance with this Agreement and applicable Data Protection Laws. To exercise its audit right, the Controller shall provide the Processor with at least fifteen (15) days’ prior written notice of the intended audit, unless a shorter notice period is required by a competent supervisory authority, in which case the Controller shall provide notice as soon as reasonably practicable. The Processor shall reasonably cooperate with the Controller and enable the audit to be conducted during normal business hours, subject to the Processor’s reasonable security, confidentiality and operational policies, and in a manner that minimizes disruption to the Processor’s business operations. The Controller undertakes to complete the audit within fifteen (15) days from the commencement of the audit. All information obtained or generated in connection with the audit shall be treated as strictly confidential, unless disclosure is required by applicable law or a competent supervisory authority. Unless otherwise agreed in writing, the Controller shall bear all costs and expenses related to the audit, including any reasonable costs incurred by the Processor in connection with such audit, except where the audit reveals a material breach of this Agreement by the Processor.

5.1 Processor guarantees that it has carried out and continues to carry out the appropriate technical and organizational measures so that the Processing meets the standards set by the Regulation and in particular the requirements listed in Appendix No. 2.

5.2 The Processor has the right to update Appendix No. 2 at any time during the term of this Addendum, with prior notice sent to the Controller at least sixty (60) days in advance, provided that such updates do not reduce the level of personal data protection compared to the existing measures. If the Controller is unable or unwilling to accept the Processor’s updates, the Controller has the right to terminate the MSA and this Addendum before the amendments enter into force.

6.1 Processor is hereby given general authorization by Controller to engage sub-processors to Process Personal Data. The list of the approved sub-processors is provided in Appendix No. 3. The Controller is informed that the sub-processors under Section “Integral” are necessary for Platform to duly operate while sub-processors under Section “Optional” will process Personal Data only if and when Controller decides to use the relevant function/module of the Platform.

6.2 Processor did and does regular data privacy impact assessments of its sub-processors and the way they Process this Personal Data. Only if such assessment shows low risk resulting from this Processing, will the Processor engage or continue to engage the relevant sub-processors.

6.3 Processor and sub-processors enter into separate agreements governing the Processing of Personal Data. Thereby the sub-processors accept at least the same level of care in relation to the Personal Data as foreseen by this Addendum (in part in which it refers to the Processor).

6.4 The Processor reserves the right to modify the designated sub-processors (replacement of existing or addition of new ones) through an amendment to Appendix No. 3, with prior written notice to the Controller.

7.1 Processor shall not transfer or provide access to Personal Data to persons located in third countries (non-EU and EEA countries) without obtaining the prior written consent of Controller. It is deemed that the Controller gave his prior written consent for the transfer to any sub-processor listed in Appendix No. 3.

7.2 If the Processor permits its sub-processors to access the Personal Data covered by this Agreement from outside the EEA, to process or store such Personal Data outside the EEA, or if those sub-processors are located outside the EEA, the Processor hereby warrants to the Controller that, in each such case, the transfer shall be based on the Standard Contractual Clauses – Module 3 (“SCCs”) adopted by the European Commission and entered into between the Processor and the relevant sub-processor.

8.1 Processor shall be liable for damages caused by Processing Personal Data only where it has not complied with obligations of the Regulation specifically directed to processors or where Processor has acted outside or contrary to lawful instructions of Controller.

8.2 Processor will be released from any liability in case he was not duly informed about the potential breach of the Regulation and/or this Addendum and did not receive proper opportunity to defend itself (and Controller) against the alleged breach.

9.1 The duration of this Addendum shall correspond to the duration of the MSA.

10.1 Once the MSA expires or on prior request of the Controller, the Processor shall delete Personal Data related to the Controller (or to any of his Data Subjects). The processor is under no duty to keep this or any other data related to the Controller once the MSA expires. It is up to the Controller to organize the timely transfer of such data before the MSA expires.

10.2 This is of no effect to any Personal Data Processed by the Processor as the controller.

11.1 The Appendices form an integral part of this Addendum. In case of discrepancies between the provisions of this Addendum and the MSA, the provisions of this Addendum shall prevail.

11.2 This Addendum and any dispute or claim arising out of or in connection with it or its subject matter, whether of a contractual or non-contractual nature, shall be governed by, construed, and enforced in accordance with the laws of the Republic of Croatia, excluding the Croatian international private law provisions governing conflicts. The competent court is the court at the Processor’s registered seat.

This Appendix provides a comprehensive overview of the categories of data subjects, personal data, and purposes of processing associated with the use of the Services.

Measures to prevent unauthorized physical access to premises and facilities where data processing systems are housed:

Measures to prevent unauthorized use of data processing systems:

Measures to prevent unauthorized access to software and data:

Measures to ensure that data collected for different purposes can be processed separately:

Measures to ensure traceability of data access and input:

Organizational safeguards to support data security:

These sub-processors are not engaged by the Service Provider by default, but may be used solely at the discretion of the User.