Version: 1.0 of February 1st, 2019

 Data Processing Terms for MyArtwork Portal Usage

1. CERTAIN DEFINITIONS

As used herein,

User Information: means Personal Data collected directly from User’s employees or agents via the Portal.

User: means the legal entity to whom the Portal is made available.

Gemalto: means Gemalto SA a company organized under the law of France located at 6 Rue de la Verrerie, 92190 Meudon, France.

Personal Data: means any information relating to an identified or identifiable individual where the individual is associated with User.

Portal: means that certain portal made available to User via the URL https://myartwork.gemalto.com. The Portal requires registration to access it triggering the disclosure of certain User Information such as full name and professional e-mail address.

Processor: means Gemalto.

2. PURPOSE OF PROCESSING OF USER INFORMATION

2.1 The purpose of the processing of the User Information is to allow and authenticate access to and usage of the Portal and to administer the account of the employee(s) or agent(s) of the User accessing the Portal.

2.2 Gemalto determines the purpose and means of the processing of the User Information, hence Gemalto is the entity controlling the User Information.

3. QUANTITY OF DATA

3.1 Gemalto restricts the processing of User Information to the Personal Data that is reasonably adequate and relevant for the purpose of the Portal.

3.2 Gemalto retains the User Information for the duration of the usage of the Portal, and to the extent reasonably necessary to comply with an applicable legal requirement or advisable in light of an applicable statute of limitations.

3.3 Promptly after the applicable retention period has ended, the User Information are securely deleted or destroyed.

4. INFORMATION AND CONSENT OF INDIVIDUAL

4.1 With respect to the User Information a privacy notice containing these Data Processing Terms is made available to individuals via the Portal, it belongs to each Employees or agents of User accessing the Portal to be acquainted with these Data Processing Terms for Portal Usage before starting to enjoy the usage of the Portal.

4.2 Employees or agents of User consents to the processing of the User Information at the time of entering into the Portal.

5. RIGHTS OF INDIVIDUALS

5.1 Employees and agents of User (hereafter collectively or individually referred to as the “Interested Party”) have the right to request an overview of the Personal Data processed for the purpose of the Portal. If the Personal Data is incorrect or incomplete, the Interested Party has the right to have the Personal Data rectified, deleted or blocked.

5.2 To undertake the rights set forth in Section 5.1 above the Interested Party has to make a request for via the Portal. The request shall contain the following information:

5.3 Within four (4) weeks of Gemalto receiving the request or the objection, Gemalto shall inform the Interested Party in writing of Gemalto position with regard to the request or the objection and any action Gemalto has taken or will take in response.

6. SECURITY

6.1 Gemalto takes appropriate commercially reasonable technical, physical and organizational measures to protect the User Information from misuse or accidental, unlawful or unauthorized destruction, loss, alteration, disclosure, acquisition or access.

6.2 Gemalto’s staff is provided access to User Information only to the extent necessary to undertake the purpose set forth in Section 3 above and to perform their job.

6.3 Gemalto’s staff in contact with User Information shall meet their confidentiality obligations as specified by contract, and Gemalto’s policies.

7. USAGE LIMITATION

7.1 Gemalto only uses the User Information within the scope of the set forth in Section 3 above. Gemalto does not share the User Information with third parties and does not transfer the User Information outside the European Union where the Portal is installed.

8. POLICIES AND PROCEDURES

8.1 Gemalto develops and implements policies and procedures to comply with these Data Processing Terms for Portal Usage.

8.2 Gemalto maintains readily available information regarding the structure and functioning of the Portal.

9. APPLICABLE PRIVACY LAW

9.1 The processing of User Information remains subject to the applicable local law. Individuals keep any rights and remedies they may have under applicable local law.

9.2 Where these Data Processing Terms provide more protection than applicable local law or provide additional safeguards, rights or remedies for individuals, these Data Processing Terms apply.

9.3 Any additional safeguards, rights or remedies granted to individuals under these Data Processing Terms for Portal Usage are granted by and enforceable in France against Gemalto only. Gemalto ensure that adequate steps are taken to address the implementation of these Data Processing Terms for Portal Usage.