Neurotechnology UAB (company code: 120441850 , address: Laisvės pr. 125A, Vilnius, Lithuania, email: ) (the Data importer) and User (the Data exporter) have agreed on the following conditions for personal data transferring, which may occur by using SentiSight.ai software products and services, and concluded this agreement (the Data Transfer Agreement) which shall form integral part of Terms of use and Privacy Policy:

  1. Personal Data Processing
    1. The Data importer acts as data processor of the Data exporter within the meaning of the General Data Protection Regulation (EU) 2016/679 of 27 April 2016 (the GDPR).
    2. The Data importer undertakes to process personal data only based on the instructions of the Data exporter, and to ensure that its employees or other authorized persons who will process personal data received from the Data exporter will be permanently bound by confidentiality agreements to warrant confidentiality of personal data received from the Data exporter.
  2. Obligations of the Data Processor
    1. If the Data importer cannot provide compliance with this Data Transfer Agreement or data protection legislation for whatever reasons, it agrees to inform promptly the Data exporter of its inability to comply, in which case the Data exporter is entitled to suspend the transfer of data to the Data importer, to prevent the latter from processing data, and/or terminate the present Data Transfer Agreement.
    2. The Data importer agrees and warrants that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the Data exporter and related to the processing of personal data and its obligations under the Data Transfer Agreement.
    3. The Data importer undertakes to implement the appropriate technical and organizational security measures specified in the legislation, and established or recommended by the competent authorities of data protection before processing the personal data.
    4. The Data importer undertakes to notify the Data exporter immediately about (i) any legally binding request for disclosure of personal data received from the Data exporter by a law enforcement authority unless otherwise prohibited; (ii) any accidental or unauthorized access to the data, any leak of personal data and/or violation of the personal data security; and (iii) any requests received directly from the data subjects without responding to such requests, unless it has been otherwise authorized to do so.
    5. The Data importer undertakes no later than within one month to answer comprehensively to all inquiries from the Data exporter relating to its processing of personal data, and to abide by the advice and instructions of the competent supervisory authority with regard to the processing of the personal data.
    6. The Data importer undertakes to make available to the data subject upon request a copy of the clauses of the present Data Transfer Agreement, except for the part which constitutes the Data importer’s commercial secret, and a summary description of the security measures in those cases where the data subject is unable to obtain such information from the Data exporter.
    7. Data exporter agrees that the Data importer has the right to subcontract and engage third parties (sub-processors) providing various IT ancillary services to the Data importer and listed in the Exhibit 1 below. The provided list of such sub-processors may be updated from time to time, please check periodically this list.
    8. Where the Data importer engages a third party (sub-processor) for performance of the present Data Transfer Agreement, the Data importer undertakes to ensure that the contract between the Data importer and third party contains the third party’s obligations similar to this Data Transfer Agreement.
    9. The Data importer undertakes to assist the Data exporter in ensuring compliance with the duties stipulated in Articles 32-36 of the GDPR taking due regard of the nature of data processing, and the information available to the Data exporter.
    10. The Data importer must take the measures required under Article 32 of the GDPR regarding security of data processing.
  3. Obligations of the Data Exporter
    1. The Data exporter agrees and warrants that the processing of personal data, including their transfer to the Data importer, is and will continue to be carried out in accordance with the data protection legislation and applicable law.
    2. The Data exporter undertakes throughout the duration of the personal data-processing services to instruct the Data importer to process the personal data transferred only on the Data exporter’s behalf and in accordance with the data protection legislation and the present Data Transfer Agreement.
    3. The Data exporter agrees to make available copies of the present Data Transfer Agreement and other agreements on personal data processing to a competent supervisory authority, if the latter requests them or if it is required under data protection legislation. The Data importer hereby represents that it has no objections to the same.
  4. Obligations of the Parties
    1. Both parties undertake to ensure that personal data are protected against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the costs of their implementation.
    2. The parties agree that the supervisory authority has the right to conduct an audit of the Data importer, which has the same scope and is subject to the same conditions as would apply to an audit of the Data exporter under the applicable data protection legislation.
  5. Term
    1. This Data Transfer Agreement shall remain valid as long as the Terms of use are valid. Expiry of the Terms of use shall automatically imply expiry of this Data Transfer Agreement. The Data exporter also has the right to unilaterally terminate this Data Transfer Agreement at any time without specifying any reasons, or to suspend performance of this Data Transfer Agreement, and prohibit the Data importer from processing the personal data and other data received from the Data exporter.
  6. Obligations after the Termination of Personal Data Processing Services
    1. The parties agree that on the termination of the provision of data-processing services, the Data importer and sub-processors (if any) shall, at the choice of the Data exporter, return all the personal data transferred and the copies thereof to the Data exporter or shall destroy all the personal data and send conformation that it/they has/have done so to the Data exporter, unless legislation imposed upon the Data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the Data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not process the personal data transferred anymore.
  7. Governing Law and Dispute Resolution
    1. The present Data Transfer Agreement and the personal data processing are subject to the laws of the Republic of Lithuania and the European Union. Any dispute, disagreement or claim arising out of this Data Transfer Agreement or related thereto (unless settled amicably) shall be resolved by a competent state court of the Republic of Lithuania located in the Vilnius city in the procedure established by the laws.
  8. Final Provisions
    1. Invalidity of one provision of this Data Transfer Agreement shall not render the entire Data Transfer Agreement invalid. By an agreement between the parties, the invalid provision must be promptly substituted with a valid one as close to the invalid provision as possible in its spirit and contents, and such substituting provision must have a similar legal and economic effect as the replaced provision.

EXHIBIT 1 TO DATA TRANSFER AGREEMENT
This exhibit forms integral part of the Data Transfer Agreement.

Data subjects
The personal data transferred concern any individuals 16 years of age and above.

Categories of data
The personal data transferred include: photos, name, email address, email correspondence, postal address, payment history, invoice related information, IP address

Processing operations
The transferred personal data will be used solely to provide SentiSight.ai services.

Data importer’s sub-processors:

  • Hetzner Online GmbH – https://www.hetzner.com
  • Amazon Web Services – https://aws.amazon.com/

This Data Transfer Agreement and its Exhibit was last updated on December 07, 2018.