Privacy and Security Statement
This Privacy and Security Statement (“Statement”) governs the processing of Personal Information on otonomo’s cloud-based marketplace for vehicles-generated data (“Marketplace”). The Statement is incorporated by reference to otonomo’s agreements with the Marketplace partners (“Agreements”), and reflects their commitment to process Personal Information lawfully and fairly.
If there is any conflict between the Statement and the Agreement, the terms of the Statement will prevail.
Terms and definitions
In the course of using the Marketplace, otonomo and Marketplace Partners (together: the “Parties“) Process Personal Information. This Statement reflects the Parties’ agreement to comply with the following provisions, with regard to the processing of Personal Information on the Marketplace and to use means, measures, procedures and good-faith efforts for this purpose.
The terms used in this Statement will have the meanings set forth below. Capitalized terms not otherwise defined in this Statement will have the meaning as set forth in the Agreement.
The terms used in this Statement will have the meanings set forth below. Capitalized terms not otherwise defined in this Statement will have the meaning as set forth in the Agreement.
- “Agreement” means an agreement between otonomo and a Marketplace Partner.
- “Affiliate” means any legal entity directly or indirectly controlling, controlled by or under common control with a party to the Agreement, where “control” means the ownership of a majority share of the voting stock, equity or voting interests of such entity.
- “Controller” means otonomo or Marketplace Partner.
- “Controller to Controller SCCs” means the Standard Contractual Clauses (Controller to Controller Transfers – Set II) in the Annex to the European Commission Decision of December 27, 2004, as may be amended or replaced from time to time by the European Commission.
- “Controller to Processor SCCs” means the Standard Contractual Clauses (Processors) in the Annex to the European Commission Decision of February 5, 2010, as may be amended or replaced from time to time by the European Commission.
- “Data Provider” – a Marketplace Partner who provides data to the Marketplace pursuant to the terms of the Agreement.
- “Data Customer” – a Marketplace Partner who receives from, or granted access to data available through the Marketplace pursuant to the terms of the Agreement.
- “Individual” means a natural person to whom Personal Information relates, also referred to as “Data Subject” pursuant to EU data protection Laws and regulations.
- “Marketplace” means otonomo’s cloud-based vehicle-generated data exchange platform.
- “Marketplace Partner” means as applicable – a vehicle-data provider, a vehicle-data customer, their Affiliates and other third parties who may access and use the Marketplace.
- “Member State” means a country that is member of the European Union or the European Economic Area.
- “otonomo” – otonomo Inc., otonomo Technologies Ltd. and their Affiliates.
- “Personal Information” means information about an identified or identifiable Individual, also referred to as ‘personal data’ under EU data protection laws and regulations, which is provided, consumed or otherwise processed in the course of the Marketplace activities.
- “Personnel” means the employees, agents, consultants and contractors of Marketplace Partners and Marketplace Partners’ Affiliates.
- “Privacy Laws and Regulations” means US federal and state privacy laws and regulations, data protection laws and regulations of the European Union, including Regulation (EU) 2016/679 (“GDPR”) and Israeli privacy laws and regulations, and applicable data protection and privacy laws of other territories, all as applicable to the Processing of Personal Information under the Agreement.
- “Privacy Shield” means the EU-US Privacy Shield Framework, as administered by the U.S. Department of Commerce and approved by the European Commission pursuant to Decision C(2016)4176 of July 12, 2016.
- “Privacy Shield Principles” mean the Privacy Shield Principles, as supplemented by the Supplemental Principles and contained in Annex II to the European Commission Decision C(2016)4176 of July 12, 2016, as may be amended, superseded or replaced.
- “Process” or “Processing” means any operation or set of operations which are performed on Personal Information, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.
- Scope and Roles. This Statement applies when Personal Information is Processed by otonomo or a Marketplace Partner. To the extent that EU Privacy Laws and Regulations apply to the Personal Information, otonomo and Marketplace Partner act as independent data controllers. The Parties further acknowledge and agree that the Parties are not joint controllers as this term is referred to under the GDPR.
- Processing by a Data Provider. A Data Provider is responsible for the accuracy, quality, and legality of the Personal Information that the Data Provider provides the Marketplace, and for the means by which the Data Provider acquired such Personal Information. The Data Provider confirms, and at otonomo’s request will demonstrate that all relevant Individuals identified or identifiable by the Data Provider’s Data received appropriate disclosures and notifications, as required under the applicable law, including for the use, distribution and trans-border transfer of the Data Provider’s Data, which encompasses the use of the Data Provider’s Data under the terms of the Agreement, and received the Individuals’ explicit consents thereto. If a third party provided the notices to the Individuals and received their consent, the Data Provider will bear sole responsibility to verify and will be able to demonstrate that the notices and consents were sufficient for the purposes of use under the terms of the Agreement and adequate pursuant to the applicable law.
- Processing by a Data Customer. A Data Customer undertakes to access and use Marketplace-originated Personal Information in accordance with the defined purposes and restrictions of use of the Personal Information under the terms of the Agreement. Where applicable, Marketplace Partner undertakes further to provide additional notices and receive explicit consent, as necessary and pursuant to applicable Privacy Laws and Regulations to use the Personal Information pursuant to this Statement and the Agreement.
- Processing by otonomo. otonomo undertakes to (i) Process Personal Information under the terms of this Statement, or under terms not less protective to Personal Information, as may be required by Marketplace Partners; (ii) make available to the public a notice about the Marketplace privacy practices; (iii) secure all necessary rights, licenses and permissions from the Data Providers to Process Personal Information under this Statement and the Agreement; and, (iv) as applicable, receive appropriate assurances from the Data Customers that all notices have been provided to relevant Individuals and explicit consent received by them, as necessary and pursuant to the applicable Privacy Laws and Regulations, for otonomo to Process the Personal Information pursuant to this Statement and transfer the Personal Information to the applicable Data Customers.
- Processing for Legitimate Interests. Where permitted under, and subject to the limitations of applicable Privacy Laws and Regulations, Marketplace Partners and otonomo may Process Personal Information for legitimate interests.
Principles Of Processing
- Each Party undertakes to Process Personal Information only in accordance with this Statement. Processing of Personal Information outside the scope of this Statement (if any) will require prior written agreement between otonomo and Marketplace Partner.
- The Parties further undertake to follow the following general principles:
- Personal Information is processed lawfully, fairly and transparently;
- Personal Information is collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
- Personal Information is adequate, relevant and limited to what is necessary in relation to the purposes for which the Personal Information is processed;
- Reasonable steps are taken to make sure that the Personal Information is accurate and, where necessary, kept up to date and that inaccurate data is rectified or deleted without delay;
- Personal Information is kept in an identifiable form for no longer than necessary for the purposes for which the Personal Information is processed;
- Personal Information is protected and secured, including against unauthorized or unlawful processing, accidental loss, destruction or damage, using appropriate technical or organizational measures.
Rights Of Individuals
- Individuals’ Rights. Each Marketplace Partner establishes and maintains a procedure for the exercise of Individual’s personal rights, as required by applicable Privacy laws and Regulations. Individuals may submit requests to exercise their Marketplace-related rights by contacting otonomo’s compliance team at: firstname.lastname@example.org. Specifically, each party will provide Individuals with a clear and accessible right to object to any further use of their Personal Information for the purposes under the Agreement. Each party undertakes to make all reasonable efforts to accommodate these requests.
- Assistance in Compliance. Each Party will cooperate with the other Party and use commercially reasonable efforts to provide each other with assistance in connection with –
- Any required notification to Individuals and supervising authorities, as applicable, taking into account the nature of Processing and the information available to each Party, as further provided under Section 9.3.
- Impact assessments and prior consultations conducted by a Party;
- A Party’s demonstration of compliance with applicable Privacy Laws and Regulations;
- A Party’s handling of requests to exercise data subjects’ rights, as further provided under Section 5.3.
- A Party’s handling of individuals or other third parties’ complaints and inquiries in connection with Marketplace-related Personal Information;
- Notices. Unless prohibited under applicable laws, each Party will expeditiously notify the other Party of:
- Any violation by the Party, or anyone on the Party’s behalf of any provision under this Statement or a Party’s instruction pursuant thereof;
- Any official competent supervisory proceedings regarding the Marketplace-related Processing of Personal Information;
- Any legal or factual circumstances preventing a Party from executing any of the Party’s obligations under the terms of this Statement; and,
- Any material changes impacting the technical and organizational security measures implemented by a Party which cause such measures to fall short of the Party’s information security obligations under this Statement.
- Mutual Assistance to Exercise Individuals’ Rights. Each Party will, to the extent legally permitted, promptly notify to the other applicable Party if it receives a request from an Individual, who’s Personal Information is included in the Marketplace, to exercise the right to access, correct, amend or delete Personal Information related to the Individual, or to exercise such other personal right that the Individual is entitled to pursuant the applicable Privacy laws and Regulations. Each party will provide the other Party with commercially reasonable cooperation and assistance in relation to handling the Individual’s request, to the extent legally permitted and to the extent the other Party does not have access to such Personal Information through the Marketplace.
Affilliates and Third-Party Service Providers
- Affiliates and Service Providers. The Parties acknowledge and agree that: (i) Each Party’s Affiliates may retain and Process Personal Information on such Party’s behalf to exercise the Party’s rights and commitments under the Agreement; and (ii) Each Party and such Party’s Affiliates respectively may engage third-party service providers in the performance of the Agreement. All relevant Affiliates and third-party service providers, to whom a Party transfers Personal Information in the performance of the Agreement have entered into written agreements with such Party or other legal instruments that bind them by substantially the same material obligations under this Statement.
- Liability. Each Party will assume responsibility for the acts and omissions of the Party’s Affiliates and service providers, in relation to the Processing of Personal Information.
Cross_Border Transfer Of Personal Information
- The parties may use, engage in, certify, or self-certify with applicable instruments, measures, contracts and other mechanisms, to facilitate the lawful transfer of Personal Information between territories, as required under applicable Privacy Laws and Regulations.
- The parties may transfer Customer Personal Information related to Individuals in the European Economic Area (“EEA”), to other territories which were formally recognized by the European Commission as providing adequate protection to Personal Information (“Adequacy Recognition“).
- To the extent necessary under EU Privacy Laws and Regulations, the Parties undertake to implement data onward transfer instruments, such as the Controller to Processor SCCs, the Controller to Processor SCCs, the Privacy Shield Framework and a statement of compliance with the Privacy Shield Principles, and such other lawful instruments to transfer Personal Information between the Parties and between a Party to its Affiliates, service providers and other third parties.
- As applicable, if: (i) the Privacy Shield is invalidated; (ii) a party or any of its affiliates or service providers are no longer able to continue complying with the principles of the Privacy Shield; (iii) the Adequacy Recognition is invalidated or otherwise terminated; (iii) the Standard Contractual Clauses are invalidated or no longer in effect; (iv) any other Personal Information transfer safeguard is no longer in effect for any reason, then the parties will take such alternative lawful measures, as may be available and applicable, to continue facilitating the lawful transfer of the Personal Information.
- If a Party is unable to provide an alternative measure to continue transferring Personal Information lawfully, then the other Party may terminate the Statement and Agreement, or those portions of the applicable services which cannot be provided without the transfer of the Personal Information, upon a written notice with immediate effect, and where applicable under the Agreement the other Party will receive a pro-rated refund of applicable pre-paid fees, or a pro-rated reduction of future fees.
- Controls. Each Party will maintain administrative, physical and technical safeguards (including with respect to personnel, facilities, hardware and software, storage and networks, access controls, monitoring and logging, vulnerability and breach detection, and incident response) to protect the security, confidentiality and integrity of the Personal Information, pursuant to the Party’s information security policies and procedures. Each Party will regularly monitor compliance with these safeguards and will not materially decrease the overall security of its Marketplace-related information systems and networks during the term of the Agreement.
- Personnel. Each Party will: (i) be responsible for the sufficiency of the security, privacy, and confidentiality safeguards of all relevant Party’s personnel with respect to the Personal Information; and (ii) be liable for any failure by the Party’s relevant personnel to meet the terms of this Statement; and (iii) take reasonable steps to confirm that the Party’s relevant personnel are protecting the security, privacy and confidentiality of Personal Information related to the Marketplace consistent with the requirements of this Statement.
Security Breach Management and Notification
- Breach Prevention and Management. Each Party will maintain security incident management policies and procedures and will, to the extent permitted by law, promptly notify the other Party, without undue delay and in any event within 48 hours, of any actual or reasonably suspected unauthorized access to, acquisition of, or disclosure of Personal Information related to the Agreement, of which the Party becomes aware (a “Security Incident”).
- Remediation. A Party who suffered a Security Incident related to Personal Information will make its best efforts to identify and remediate the cause of such Security Incident.
- Notification. Each Party undertakes to provide commercially reasonable support and assistance to the other Party, for the other Party’s fulfillment of breach notification duties under applicable Privacy Laws and Regulations, in relation to Personal Information.
- Each Party undertakes to adequately document the Party’s privacy practices and activities in relation to Personal Information, pursuant to the applicable requirements under Privacy Laws and Regulations.
Deletion and Retention Of Personal Information
- Each Party will retain Personal Information in accordance with the procedures and timeframes specified in the Party’s data retention and destruction policies and procedures.
- Notwithstanding, a Party may retain copies of Personal Information as necessary in connection with its routine backup and archiving procedures and to ensure compliance with its legal obligations and its continuing obligations under the applicable law, including to retain data pursuant to legal requirements and to use such data to protect the Party, its Affiliates, agents and any person on their behalf in court and administrative proceedings, and for investigations and inspections related to the use of Marketplace.
Anonymized and Aggregated Data
- Each Party may process data based on extracts of Personal Information related to the Marketplace in aggregated and non-identifiable forms, for the Party’s legitimate business purposes, including for testing, development, controls and operations of the Marketplace, and for commercializing of such data, pursuant to the terms of the Agreement.
- Each Party’s and its Affiliates’ liability arising out of or related to this Statement (whether in contract, tort or under any other theory of liability) is subject to the section ‘Limitation of Liability’ of the Agreement, and any reference in such section to the liability of a Party means that party and its Affiliates in the aggregate. Notwithstanding, where required under applicable Privacy Laws and Regulations, each Party and its Affiliates’ liability and accountability toward Individuals, with respect to a breach by such Party of this Statement and the Processing of the Individuals’ Personal Information is not limited.
Term and Termination
- This Statement will commence on the same date that the Agreement is effective and will continue until the Agreement is expired or terminated, pursuant to the terms therein.
- If a Party is unable or becomes unable to comply with any of the terms under this Statement, the other Party may terminate the Agreement upon a written termination notice with immediate effect.
- Each Party will appoint compliance officers or teams, as necessary and required under Privacy Laws and Regulations, to oversee the Processing of the Personal Information.
- otonomo’s compliance team can be reached at: email@example.com.