Hopin Standard Contractual Clauses Amendment

Hopin and Customer entered into the Hopin Data Processing Agreement or alternative data protection terms (“DPA”), at or around the same time as the agreement for services between Hopin and Customer (the “Main Agreement”). The parties now wish to amend the terms of the DPA as set out in this Hopin Standard Contractual Clauses Amendment (“SCC Amendment”).

Except as expressly agreed to in this SCC Amendment, the terms of the DPA and the Main Agreement are unmodified and remain in full effect. Any capitalized terms used but not defined herein have the meanings in the DPA and Main Agreement. 

This SCC Amendment shall be effective from the Subscription Start Date specified on the Sales Order referencing this SCC Amendment (“SCC Amendment Effective Date”).

Background:

(A) On 4 June 2021 the EU Commission published the new form of standard contractual clauses following its Implementing Decision (EU) 2021/914 which are to be used to provide adequate protection for transfers of personal data from the European Economic Area to countries without an EU Commission adequacy decision.

(B) On August 27, 2021, the Swiss Federal Data Protection Authority announced recognition of the aforementioned as an approved personal data transfer mechanism from Switzerland to non-adequate countries.

(C) On March 21, 2022, following the UK’s exit from the EU, the UK adopted an addendum to the standard contractual clauses, which acts as a transfer mechanism for personal data from the UK to countries not covered by the UK’s adequacy regulations. 

In order to comply with the aforementioned changes to data protection legislation in respect of Restricted Transfers, the Parties agree to amend the DPA as follows:

1. Contracting parties: Hopin Ltd, incorporated and registered in Egland and Wales with company number 12035150, whose registered office is at 5 Churchill Place, 10th Floor, England E14 5HU. Hopin enters into the DPA with the Customer on its behalf and on behalf of its Affiliates. For this purpose, “Affiliates” means any entity which directly or indirectly controls, is controlled by, or is under common control with the subject entity, including StreamYard, Inc., and which provides the Service.
2. Definitions. “EU C-to-P Transfer Clauses”, “Standard Contractual Clauses” and “Restricted Transfer” are added to the DPA and/or amend the same or similar definitions in the document:

“EU C-to-P Transfer Clauses” means EU SCCs sections I, II, III and IV (as applicable) to the extent they reference Module Two (Controller-to-Processor);

“Restricted Transfer” means a transfer of personal data under this DPA from the European Economic Area, Switzerland, or United Kingdom to countries which do not ensure an adequate level of data protection within the meaning of applicable laws of the foregoing territories, to the extent such transfers are subject to such applicable laws; and 

“Standard Contractual Clauses” means (i) where the EU GDPR applies, the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 available at: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en. (“EU SCCs”), and (ii) where the UK GDPR applies, the  "International Data Transfer Addendum to the EU Commission Standard Contractual Clauses" issued by the Information Commissioner under s.119A(1) of the Data Protection Act 2018 (“UK Addendum”, available at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf).

3. Description of Data Processing. Types of personal data and Categories of data are deleted and replaced as follows:

Types of personal data

“Event Data” is (a) any personal data contained in materials submitted by Customer in the course of creating or during an event (e.g. speaker bios); and (b) personal data embedded in Customer event related content (e.g. event recordings, participant chat transcripts). 

“StreamYard Data” is any personal data processed as part of the StreamYard studio and broadcasting service, which is not Participant Data or Event Data, (e.g. as personal data contained in live and/or recorded video streams).

Categories of data subject

Individuals who participate in events.

Individuals whose personal data is contained in Event Data and/or StreamYard Data. 

4. Sub-processors. The list of sub-processors is deleted and hereby replaced by the list available at https://hopin.com/security. 
5. Restricted Transfers. The terms relating to Restricted Transfers are deleted and replaced with clauses 5.1 to 5.3  below.  Alternatively, if the DPA does not contain terms relating to Restricted Transfers,clauses 5.1 to 5.3 below are added to the document.

5.1 Insofar as the Services lead to a Restricted Transfer, Hopin (acting also on behalf of StreamYard, Inc.) and Customer hereby enter into the EU C-to-P Transfer Clauses and the UK Addendum (where applicable) on the basis that the exporter is Customer and the importer is Hopin US, Inc. and/or StreamYard, Inc. and on the basis that:

(a) To the extent that Customer is located in the EU and/or the personal data is protected by the EU GDPR, the EU C-to-P Transfer Clauses will be completed as follows:

(i) in Clause 7, the optional docking clause, will not apply;

(ii) in Clause 9, Option 2 will apply and Customer acknowledges and agrees that Hopin may engage new sub-processors in the manner described in this DPA;

(iii) in Clause 11, the optional language will not apply;

(iv) in Clause 17, the EU C-to-P Transfer Clauses will be governed by the jurisdiction of Ireland;

(v) in Clause 18, disputes shall be resolved before the courts in the jurisdiction of Ireland;

(iv) The competent supervisory authority shall be the Irish Data Protection Commission;

(vii) For the purposes of Annex I to the EU C-to-P Transfer Clauses: (a) the categories of data transferred are Event Data and/or StreamYard Data (as defined above); and (b) the categories of data subject, subject matter, nature and purpose and duration and frequency of the transfer and retention are set out in the Main Agreement. It is not anticipated that sensitive data will be transferred;

(viii) For the purpose of Annex II the security measures are specified at https://hopin.com/security, which are hereby incorporated by reference.

(b)To the extent Customer is located in the UK and/or the personal data is protected by the UK GDPR, the UK Addendum will apply as follows:

(i) The EU C-to-P Transfer Clauses (as amended as specified by Part 2 of the UK Addendum) are completed as set out above in Section 5.1(a); and

(ii) Tables 1 to 3 of the UK Addendum shall be deemed completed with the information set out above in Section 6.1(a) (as applicable) and table 4 in Part 1 shall be deemed completed by selecting "data importer".

5.2 To the extent there is any conflict between this DPA and/or the Main Agreement with any applicable Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.

5.3 To the extent required by UK law, all references to EU and EU Member State law in the Standard Contractual Clauses shall be read as references to the equivalent laws of England and Wales.

‍