Welcome to Lucky Orange!
Lucky Orange, LLC (“Lucky Orange,”) makes the Lucky Orange website and its proprietary software, services, extensions, and application programming interfaces (collectively, the “Service”) available for your use subject to the terms and conditions herein and any additional terms contained in an amendment or addendum (collectively, the “Agreement”). This Agreement is between Lucky Orange and the legal entity or entities that accept(s) this Agreement by physical or electronic signature, or by a click-through acceptance (“Customer”, “You”, or “your”). This Agreement is effective as of the earlier of the date of click-through acceptance, as applicable (such date, the “Effective Date”).
The disclaimers, terms, and conditions in this Agreement are of general application and may be supplemented by additional policies, procedures, disclaimers, guidelines, rules, terms, and conditions of specific application that Lucky Orange discloses. If You are bound to more than one agreement with Lucky Orange with respect to the Service, and if those agreement terms vary, then the order of precedence is as follows: an agreement executed by Lucky Orange and You that expressly supersedes all other agreements, an electronic version of an agreement accepted pursuant to an amendment or formal written quote, and any other electronic agreement provided with the Service. Customer agrees that the Data Processing Agreement which is hereby incorporated into the Agreement in Exhibit A, forms an integral part of this Agreement and that customer has read and agrees to be bound by its terms.
1. DEFINITIONS
The terms in this Section shall have the meanings described below, and other terms may be defined within the context of this Agreement.
"Attachment" means any Lucky Orange form detailing a software order, add-on licenses or additional services which are incorporated into and becomes a part of this Agreement. Depending on the service or software ordered, the amendment may be completed online. Examples of an Attachment includes, but is not limited to; a written order form, invoice, quote, statement of work, addendum, amendment or email confirmation. This Agreement shall govern unless the Attachment specifically references a particular Section name and number within this Agreement which is explicitly intended to be superseded by the terms therein.
"Customer Data" means any and all of your data and your User’s data, information, and materials that are uploaded, collected, or otherwise processed by or on behalf of You or that are accessed by Lucky Orange in connection with yours or your User’s use of the Service.
"Derived Data" means all data and information created, processed, or provided to You by Lucky Orange in performing the Service, or that result from the Customer, User or Visitor Data provided to Lucky Orange through the Service.
"Documentation" means any documentation distributed by Lucky Orange or its pertaining to the Service, including without limitation any accompanying or online user guides or technical information relating to the Service, User documentation, and technical data sheets in effect on the Effective Date, in each case, as may be updated or amended by or on behalf of Lucky Orange from time to time.
"Fees" means the subscription license fee and other fees set forth in this Agreement for the right to license and use the Service.
"Service" means the proprietary software, licensed products, services, including any updates, that Lucky Orange provides to Customer under the terms of the Agreement.
"Sensitive Data" includes payment card data or other financial account information, driver’s license numbers, birthdates, social security numbers, government-issued identifiers, passwords or other log-in credentials, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, and data concerning a natural person's sex life or sexual orientation or similarly sensitive information.
"Term" shall have the meaning set forth in Section 6.1.
"User" means an individual who is authorized by You to use the Service within its organization or, if applicable, within a multi-tenant or managed services environment, and to whom You have supplied a User identification and password. Users may include, for example, your employees, consultants and contractors.
"Visitor" means any individual that are not Users, that interacts with your website (or the website which You are tracking) but not directly with the Service.
2. OUR SERVICE
2.1 Grant of Limited License.
On the condition You comply with your obligations under this Agreement, and subject to additional terms of any third-party licenses applicable to third-party software included in the Service, Lucky Orange hereby grants to You a limited, revocable, non-exclusive, non-transferable (except as provided in Section 11.12), right to access and use the Service and Documentation solely in connection with personal or internal business purposes. Other than as expressly granted in this Agreement, no other rights are granted, including without limitation any and all Lucky Orange patents, copyrights, moral rights, trade secrets, trademarks, service marks, publicity rights, and other proprietary rights (whether or not perfected or perfectible) (collectively, “Intellectual Property Rights”). Nothing in this Agreement grants to You any rights whatsoever in or relating to the source code of the Service, other than the limited right to place the Lucky Orange JavaScripts on your website(s). All ownership rights, title, interest and Intellectual Property Rights in and to the Service shall remain in Lucky Orange and/or its licensors. If You do not comply with this Agreement, Lucky Orange reserves the right to revoke any license granted in this Agreement and limit your access to the Service. Any use of the Service that exceeds the rights expressly granted in this Agreement is strictly prohibited and constitutes a violation of this Agreement, which may result in the suspension or termination of your right to access and use the Service. Provided that You do not utilize or base any such developments on the Lucky Orange Confidential Information, Lucky Orange specifically acknowledges that You may at any time independently develop information similar to, or products and services that compete with products or services identified in the Confidential Information.
2.2 Modification.
You agree that Lucky Orange has the right to change, modify, add to or discontinue or retire any aspect or feature of the Service at any time without any obligation to give You notice of any changes. From time to time and without notice to You, Lucky Orange may, but is under no obligation to, release upgrades, fixes or new versions of the Service, although these upgrades may not be consistent across all platforms and devices. Lucky Orange may restrict the time the Service is available, and restrict the amount of use permitted at its sole discretion and without prior notice or additional liability to You.
2.3 License Upgrade.
Additional licenses may be purchased during the term of the Agreement. Any such software, add on, or storage upgrade will be reflected in an amendment to the Agreement in the form of a signed amendment or email order upgrade confirmation.
2.4 Removal of Access.
Lucky Orange reserves the right to refuse access to the Service to any User. Your access to the Service is provided on a term subscription basis with no guarantee of future availability. You agree that Lucky Orange may immediately suspend or terminate your access to the Service or any part thereof in the event that: (1) You breach or violate this Agreement or other incorporated agreements or guidelines; (2) Lucky Orange discontinues or materially modifies the Service; (3) there is an unexpected technical or security issue or problem; or (4) You engage in fraudulent or illegal activities or a material breach of your obligations under the terms of the Agreement. You further agree that such measures may be taken in Lucky Orange’s sole discretion and without any liability to You or any third party.
2.5 Defects and Availability.
Lucky Orange uses commercially reasonable efforts to maintain the Service, however, Lucky Orange is not responsible for any defects or failures associated with the Service, any part thereof, or any damages (either direct or indirect) that may result from any such defects or failures. Lucky Orange is not obligated to provide You support for, and shall not be responsible or liable for, any errors of the Service or any damages resulting from your failure to implement the Service on your website(s) in accordance with the Service Documentation (available here: https://help.luckyorange.com/). The Service may be inaccessible or inoperable for any reason, including, without limitation: (1) equipment malfunctions; (2) periodic maintenance procedures or repairs which may be undertaken from time-to-time; or (3) causes beyond Lucky Orange’s reasonable control or which could not reasonably foreseen. You understand that the Service is provided over the Internet and hosted by a third party provider, so the quality and availability of the Service may be affected by factors outside of Lucky Orange’s control. The Service is not intended to be available 100% of the time and Lucky Orange does not make any guarantees regarding the reliability or availability of the Service and will not be liable to You or any third party for damages or losses related to the Service being unavailable.
2.6 Free Trial.
When You register for the Service, Lucky Orange may provide You a limited, revocable, non-exclusive, non-transferable right and license to use the Service for a limited time for free ("Free Trial Period"). The term for the Free Trial Period will begin on the date of your registration for the Service and will continue for a period of seven (7) days, unless extended or sooner terminated in accordance with the Agreement. Upon completion of the Free Trial Period, You will be presented with the option to terminate your access to the Service, or convert to one of the paid Service plans by providing standard credit card information in addition to the information You provided to Lucky Orange upon registration.
2.7 Third Party Materials.
Some third party materials may be subject to other terms and conditions, which may be found in a “Read Me” or “About” or similar file in the Service or in the Documentation. “Third Party Materials” means software, interfaces, and firmware, licensed by Lucky Orange from third parties and which are incorporated into and/or distributed as part of the Service. Because Lucky Orange has no control over Third Party Materials, You acknowledge and agree that Lucky Orange is not responsible for the availability of such Third Party Materials, and Lucky Orange does not endorse and is not responsible or liable for any content, advertising, products, or other materials on or available from such Third Party Materials or for any privacy or other practices of such third parties operating those websites or providing such materials. You further acknowledge and agree that Lucky Orange will not be responsible or liable, directly or indirectly, and You hold Lucky Orange harmless for any damage or loss caused or alleged to be caused by, in connection with or resulting from your use of or reliance upon any such Third Party Materials available on or through any such website or resource. Lucky Orange strongly encourages You to review any separate terms of use and privacy policies governing the use of such third party websites and Third Party Materials.
2.8 Ownership of Intellectual Property.
Unless otherwise specifically noted in this Agreement, images, trademarks, service marks, logos and icons displayed on the Service or the Lucky Orange website, are the property of Lucky Orange and/or its licensors and may not be used without its prior written consent. The Service, including all systems, databases, information, data, documents, materials, works, Lucky Orange Content, and all intellectual property rights in and to the foregoing (collectively, the “Lucky Orange Materials”) shall at all times remain the exclusive intellectual property of Lucky Orange and its third-party licensors. You are not acquiring any Intellectual Property Rights in or to the Lucky Orange Materials other than a non-exclusive right to access and use the Service or the website solely in accordance with the terms of this Agreement. The Lucky Orange Materials are deemed intellectual property and may not be reproduced, recreated, sublicensed, modified, accessed, or used in any manner or disseminated or distributed to any other party in violation of this Agreement. Any unauthorized use of any Lucky Orange Materials, whether owned by Lucky Orange or any other parties, may violate copyright laws, trademark laws, intellectual property, privacy and publicity laws and communications regulations and statutes. Any third-party software included in the Lucky Orange Materials is licensed and subject to the additional terms of the applicable third-party license. Trademarks owned by third parties are the property of those respective third parties.
3. CLIENT RESPONSIBILITIES, REPRESENTATIONS, AND RESTRICTIONS
3.1 Account Registration and Delegation.
Access to the Service requires You to be registered with Lucky Orange via the registration form. This form will require You to provide certain requested information about yourself. Once Lucky Orange receives such information, You will be provided with an account and login information, including a username and password, to successfully complete the registration process. As the account owner, You are the only person authorized to access and use your account.
3.2 Unauthorized Use and Information Changes.
You must immediately notify Lucky Orange if your registration information changes or You learn of or have reason to suspect any unauthorized use of your account or any other breach of security. You are responsible for maintaining the confidentiality of your username and password and are fully responsible for all activities that occur under your username and password. You agree that You will provide truthful and accurate information during the registration process. Lucky Orange may refuse to grant You a particular username for any reason, including, without limitation, if Lucky Orange has reason to believe that such username impersonates someone else, is protected by trademark or other proprietary rights, or is vulgar or otherwise offensive.
3.3 Storing Credentials.
You are responsible for any damages to Lucky Orange or the Service resulting from unauthorized access to the Service from your account and Lucky Orange will have no liability to You or any third party for damages or loss related to such unauthorized access or use.
3.4 Representations.
You hereby represent and warrant that: (1) You have the legal capacity and authority to enter into and perform your obligations under this Agreement; (2) You will comply with the terms and conditions of this Agreement and any other agreement to which You are subject that is related to your use of the Service or any part thereof; (3) You have provided and will maintain accurate and complete information, including, without limitation, your legal name, email address, and any other information Lucky Orange may reasonably require; (4) your access to and use of the Service or any part thereof will not constitute a breach or violation of any other agreement, contract, terms of use or any law or regulation to which You are subject; (5) You will immediately notify Lucky Orange in the event that You learn or suspect that the personal information You have provided has been disclosed or otherwise made known to any other person; (6) You will not use the Service in order to gain competitive intelligence about Lucky Orange, the Service, or any product or service offered via the Service or to otherwise compete with Lucky Orange; and (7) the User Data You provide does not violate the rights of any third party, including, without limitation, the intellectual property, privacy or publicity rights of any third party, and You have acquired the appropriate consent of all third parties (if required) to provide the User Data through our Service.
3.5 Restrictions.
You may not: (1) license, sublicense, sell, resell, transfer, assign, distribute, or otherwise commercially exploit or make available to any third party any portion of our Service in any way; (2) copy (except as required to place the Lucky Orange JavaScripts on your website), modify, adapt, alter, translate, create derivative works, reverse engineer, decompile, disassemble, or otherwise attempt to learn the source code, communications protocol, structure, or ideas upon which the Service is based; (3) use the Service or Traffic Data to develop a competing service or product; (4) use any device, software, or routine intended to damage or otherwise interfere with the proper functioning of the Service, servers, data centers, or networks connected to the Service or take any other action that interferes with any other person’s use of the Service; (5) decrypt, transfer, create Internet links to the Service, or “frame” or “mirror” the Service on any other server or wireless or Internet-based device; (6) use or merge the Service or any component thereof with other software, databases, or services not provided or approved by Lucky Orange; (7) circumvent or attempt to circumvent any electronic protection measures in place to regulate or control access to the Service, or remove, obscure, or alter any notices or indications of any Intellectual Property Rights, any trade names, trademarks, service marks, logos, trade dress, and any other distinctive or proprietary symbols, labels, designs, or designations, or any electronic notices; (8) use the Service for any fraudulent or otherwise unlawful purposes or in violation of this Agreement; (9) develop, distribute, or sell any software or other functionality capable of launching, being launched from, or otherwise integrated with the Service; (10) use any bot, spider, or other automatic or manual device or process for the purpose of harvesting or compiling information on the Service for any reason; (11) access or attempt to access any other User’s account or use the Service in a way that prevents or inhibits another User from enjoying the Service; (12) use any Derived Data made available through the Service in any manner that misappropriates any trade secret or infringes any copyright, trademark, patent, rights of publicity, or other proprietary right of any party; (13) introduce into the Service any virus, rogue program, Trojan horse, worm or other malicious or intentionally destructive code, software routines, or equipment components designed to permit unauthorized access to or disable, erase, or otherwise harm the Service, or perform any such actions; (14) introduce into the Service any back door, time bomb, drop dead device, or other software routine designed to disable a computer program automatically with the passage of time or under the positive control of an unauthorized person; (15) delete, modify, hack, or attempt to change or alter the Service, Derived Data, notices on the Service; (16) connect to or access any Lucky Orange computer system or network other than the Service; (17) impersonate any other person or entity to use or gain access to the Service; (18) conduct or otherwise participate in any distributed denial-of-service attack or similar malicious attack intended or designed to artificially delay, disrupt or otherwise adversely affect the Service or any other User’s access to or use of the Service; or (19) post or transmit any data which contains Sensitive Data to the Lucky Orange servers and any controls or inputs required by You will not solicit Sensitive Data. Further, by using the Services, You confirm that You will not input, and will not solicit Users to input, Sensitive Data or otherwise use the Service in a manner that could give rise to obligations under GDPR, CCPA or any other applicable laws relating to the Sensitive Data or personal information. Lucky Orange reserves the right to investigate and prosecute violations of any of the above to the fullest extent of the law. Lucky Orange may involve and cooperate with law enforcement authorities in prosecuting Users who violate this Agreement.
4. DATA RIGHTS, USES, AND LIMITATIONS
4.1 Customer and User Data.
You hereby grant to Lucky Orange a nonexclusive, worldwide, royalty-free, fully-paid, transferable license to host, cache, record, copy, view, and display User and Visitor Data for the purpose of (1) providing the Services to You: (2) internal use by Lucky Orange and its affiliates; (3) any purpose related to the billing, activation, provision, maintenance, upgrades, updates, deactivation and/or use of the Service and/or related products and/or services; (4) any purposes permitted by any applicable law. Except as set forth in this Agreement, as between Lucky Orange and You, You retain all right, title, and interest in and to User and Visitor Data. You shall have sole responsibility for the accuracy, quality, integrity, legality, reliability, appropriateness, and right to use such User and Visitor Data, and You agree that, except for Lucky Orange’s gross negligence or willful misconduct, Lucky Orange shall not be responsible or liable for the unauthorized access to, alteration of, or deletion, correction, destruction, corruption, damage, loss or failure to secure or store yours or your Visitor and User’s Data. You acknowledge and agree that You bear sole responsibility for adequately controlling, processing, storing and backing up such Visitor and User Data. Lucky Orange reserves the right, but not the obligation, to refuse to post or to remove any information or materials, in whole or in part, that Lucky Orange believes to be unacceptable, undesirable, or in violation of this Agreement or the rights of third parties.
4.2 Client Data Representations.
You represent, warrant, and covenant that: (1) You are the owner or authorized licensee of Visitor and User Data and have the right to grant the rights set forth herein; (2) You have obtained all consents necessary under applicable law to disclose Customer Data to Lucky Orange; and (3) You will not publish, post, upload, record, or otherwise distribute or transmit any data or other material that: (i) infringes or would infringe any copyright, patent, trademark, trade secret or other proprietary right of any party, or any rights of publicity or privacy of any party; (ii) violates any law, statute, ordinance, or regulation; (iii) is inappropriate, profane, defamatory, libelous, obscene, indecent, threatening, harassing, or otherwise unlawful; (iv) is harmful to minors or otherwise pornographic; (v) is materially false, misleading, or inaccurate; and/or (vi) contains information for which You not have the right to permit Lucky Orange to access and process any User or Visitor Data.
4.3 Privacy.
You are responsible for compliance with all privacy laws and regulations applicable to your use of the Service, including providing any required notice(s) to individuals. By using the Service, You are responsible for providing your Users and Visitors with information on how to opt out of tracking by the Service (e.g., providing a link to the opt-out mechanism on Lucky Orange’s site). You are not to transmit, or allow transmission of, Customer Data that contains Sensitive Data to the Lucky Orange system by use of any of the Lucky Orange Service features. In an effort to assist You in preventing the transmission of Sensitive Data to the Lucky Orange servers, Lucky Orange makes available tools outlined in the Privacy Policy located here, and the help documentation found here. For example, the Lucky Orange system natively employs keystroke masking techniques for text entered into text fields or input boxes prior to transmission to the servers. If, however, You enable keystroke logging by using the help documentation (located here), it is your responsibility to ensure that You do not enable keystroke logging on fields that may contain Sensitive Data. Without limitation, you agree to indemnify, defend, and hold Lucky Orange harmless from and against any third party claims that arise from or are related to your transmission of Sensitive Data to Lucky Orange in CONNECTION WITH your use of the Service.
4.4 Derived Data.
You shall own all rights in and to all Derived Data, subject to the rights and licenses granted herein. Lucky Orange may generate or develop information and data (collectively, the “Derived Data”) resulting from the manipulation or analysis of any of your data, Visitor data, along with any other collected data based upon its operation and provision of the Services, along with any associated databases, algorithms, external data, calculations and other processes, methods or tools used by Lucky Orange and the Service. Derived data shall be deemed to include the aggregated, de-identified and statistical information collected by Lucky Orange from the operation of the Services and processing, manipulation and analysis of Customer and Visitor Data, including, without limitation, the number of records, the number and types of transactions, configurations, reports processed in the Services, and performance results for the Service. All Derived Data (and, in relation to You for the purposes of this Agreement, all external data) is, or shall be, and shall remain the property of Lucky Orange. Lucky Orange understands and acknowledges that You may use, manage, modify, summarize, maintain, create derivative works of, and update Derived Data. You acknowledge and agree that during and after the term of the Agreement; (i) Lucky Orange may retain and use Derived Data for the purposes of providing the Services to You and to third-party customers, and for conducting research, development and product improvement efforts; (ii) Lucky Orange may share Derived Data with any third-party service providers providing services to Lucky Orange or collaborating with Lucky Orange, subject to obligations of confidentiality; and (iii) Lucky Orange may use and share with third parties any Derived Data in aggregated or de-identified form such that the source of the data cannot be identified. You acknowledge and agree that Derived Data may commercially be exploited by or on behalf of Lucky Orange for commercial purposes, subject to the restrictions set forth above and in this Agreement.
4.5 Feedback.
Lucky Orange welcomes comments, feedback, information, or materials regarding the Service or any of the other Lucky Orange products or services (collectively, “Feedback”). By submitting Feedback to Lucky Orange, You agree to assign, and hereby irrevocably assign to Lucky Orange, all right, title, and interest, on a worldwide basis, in and to the Feedback and all copyrights, moral rights, and other Intellectual Property Rights embodied in such. Lucky Orange will be free to use, copy, distribute, publish and modify the Feedback on an unrestricted basis, without compensation to You.
5. FEES AND PAYMENT
5.1 Payment Terms.
You agree to pay to Lucky Orange all applicable Fees due for the Service in accordance with terms of this Agreement and any applicable amendment with any applicable taxes required. Except as otherwise specified herein or in any attachment, (1) Fees are based on the Service purchased and not actual usage, (2) all payment obligations under this Agreement are non-cancelable and non-refundable, and (3) quantities purchased cannot be decreased during the relevant Term. Any payments more than thirty (30) days overdue will bear a late payment fee of two percent interest (2.0%) per month, or, if less, the highest amount permitted by law. You agree to be responsible for payment for all activity by third parties who access or use the Service through your account. You are responsible for all incidental charges related to using the Service such as charges for Internet access, third party software licenses, or other data transmission fees.
5.2 Taxes.
Service fees are exclusive of all invoice and bank processing fees, taxes, levies, or duties imposed by taxing authorities, and You are responsible for payment of all such fees, taxes, levies, or duties, excluding only United States income (federal or state) taxes imposed on Lucky Orange, including by way of example and not limitation, import duties and fees, sales, use, transfer, excise, value-added, and gross receipts (”Taxes”) In the event You are required to withhold any portion of service fees due to payments to banks or taxing authorities, (1) You agree to do so and to indemnify Lucky Orange for any liability resulting from your failure to make such withholdings, and (2) Lucky Orange reserves the right to adjust the pricing of the Service so that You are responsible for payment to Lucky Orange of the full amount for the Service, net of any such withholdings, so that the net amounts received by Lucky Orange after such withholdings is equal to what was invoiced.
5.3 Payment method; Credit Card Authorization.
Until all amounts due have been paid in full, You agree to keep your payment information current at all times and authorize Lucky Orange to charge such payment method (including but not limited to credit card, debit card, wire transfer and/or automated clearing house) provided by You, all amounts due under this Agreement, including without limitation, usage beyond the amount specified in the applicable Attachment.
5.4 Invoicing.
Except with regard to the Free Trial Period, Lucky Orange bills its clients in advance on a monthly basis or once a year for recurring annual plans. All amounts due shall be paid in US dollars. Lucky Orange may invoice You electronically or by paper invoice. You must notify Lucky Orange within thirty (30) days of the receipt of the invoice of any billing errors thereon. If You do not notify Lucky Orange within this time, Lucky Orange will not be required to correct the error and/or make adjustments to your account and You hereby waive any claim, allegation or contention with respect to such invoice. Lucky Orange will not issue refunds for Fees paid for Your Service account, even for periods of inactivity.
5.5 Rate Change.
Lucky Orange reserves the right to change the price of the Service upon notice to You. Such notice may be provided at any time by posting the changes to our website, to your account, or via email. Lucky Orange will not be liable to You or to any third party for any modifications, price changes, or suspension or discontinuation of the Service.
5.6 Early Termination Fee.
For monthly contracts, there is no early termination fee or refunds. For annual contracts billed monthly, You agree to pay three (3) times the monthly cost specified in such annual contracts in the event You terminate this Agreement prior to the expiration or termination of the specified Term.
6. TERM AND TERMINATION
6.1 Term.
You will be bound for the entire Term of this Agreement. “Term” is defined as the period of time beginning on the Effective Date and shall continue until terminated in writing by either party or when terminated in accordance with Section 6.2 below. Except as otherwise specified in any amendment, at the end of any Term, subscriptions will automatically renew for additional Terms equal to the expiring Term length, unless either party gives the other party notice of non-renewal at least thirty (30) days and no more than sixty (60) days before the end of the applicable Term.
6.2 Termination of Services.
Either party may terminate this Agreement at any time, in whole or in part, for any reason, provided that if You terminate, You shall be obligated to pay any Fees accrued prior to the date of termination. You may terminate this Agreement by accessing your Account Settings in your dashboard of the Service and selecting to cancel your account (using the instructions provided). In the event of an additional service plan, You will need to provide written notice of termination, sent to support@luckyorange.com. Upon termination of this Agreement, all licenses, and any other rights and services provided by Lucky Orange to You in this Agreement, shall cease immediately, including the collection of any new data from your website. Termination of this Agreement, any license granted hereunder, or your access to the Service, shall not limit Lucky Orange from pursuing other remedies available to Lucky Orange, including but not limited to injunctive relief. Lucky Orange may also permanently or temporarily terminate, suspend, or otherwise refuse to permit your use of the Service upon reasonable prior written notice without incurring liability as a result thereof, if in our sole determination, You violate, or are reasonably likely to violate, this Agreement, including without limitation, by your nonpayment of Fees. Additionally, You must remove all Lucky Orange scripts and materials from your website within thirty (30) days of termination.
7. CONFIDENTIAL INFORMATION; MUTUAL NON-DISCLOSURE
7.1
Each party to this Agreement may furnish the other party with certain non-public, proprietary information (the “Confidential Information”). For the purposes of this Agreement, Confidential Information is defined as:
Disclosed information that is marked or identified as “confidential” at the time of disclosure, or which constitutes the trade secrets of a party under the governing law of this Agreement.
The source code and object code of the Service, the pricing structure for the Service and Service provided to You, and any other proprietary information owned by Lucky Orange and which is provided or disclosed to You at any time.
Disclosed information relating to any unreleased products or service offerings
The terms and conditions of this Agreement; and
The Service
7.2
Confidential Information shall not include information that:
is or becomes part of the public domain or is generally publicly known through no improper action by the receiving party subsequent to the time of the disclosing party’s communication thereof to the receiving party;
was rightfully in the receiving party’s possession or known by it prior to receipt from the disclosing party;
is rightfully disclosed without restriction to the receiving party by a third party without violation of any confidentiality covenant by such third party;
is independently developed by the receiving party without use of the Confidential Information of the disclosing party;
its disclosure is required by court, regulation or government order and the disclosing party has been given notice of such order and the receiving party reasonably cooperates with the disclosing party in limiting such disclosure to the minimum required, unless a court has ordered that the disclosing party not be given notice.
7.3
Each party agrees to hold the other party’s Confidential Information in confidence and not to use it for any purpose other than the purposes permitted under this Agreement. Each party agrees to use the same standard of care to protect Confidential Information as it uses to protect its own similar confidential and proprietary information, but not less than a reasonable standard of care. Confidential Information of the other party may only be disclosed to those affiliates, employees, contractors and advisors of You or of Lucky Orange, as applicable, on a need-to-know basis and who agree to be bound by confidentiality restrictions at least as restrictive as those contained in this Agreement. Confidential Information remains at all times the property of the disclosing party. Unless otherwise explicitly set forth herein, no licenses or rights under any patent, copyright, trademark, or trade secret are granted or are to be implied with respect to Confidential Information.
8. NO WARRANTY; DISCLAIMER
8.1
LUCKY ORANGE MAKES NO WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, INCLUDING WITHOUT LIMITATION, MERCHANTABILITY, FITNESS FOR A PARTICULAR USE AND NON-INFRINGEMENT. THE SERVICE IS PROVIDED BY LUCKY ORANGE AND ITS LICENSORS "AS IS" AND "AS AVAILABLE." YOU ASSUME ALL RISK FOR YOUR USE OF THE SERVICE, INCLUDING WITHOUT LIMITATION ANY HARM CAUSED BY VIRUSES, WORKS, OR OTHER DAMAGING MATERIALS. IN NO EVENT DOES LUCKY ORANGE GUARANTEE ANY RESULTS, INCREASED TRAFFIC OR USER ENGAGEMENT FOR YOU. LUCKY ORANGE DOES NOT WARRANT THAT THE SERVICE OR ANY PORTION THEREOF, IS ACCURATE, ERROR OR BUG FREE, THAT YOUR USE OF THE SERVICE WILL BE UNINTERRUPTED, OR THAT THE SERVICE'S OPERATION WILL NOT NEGATIVELY AFFECT OTHER SOFTWARE OR HARDWARE. THIS SECTION APPLIES TO THE MAXIMUM EXTENT ALLOWED BY APPLICABLE LAW. THE SERVICE IS OFFERED BY LUCKY ORANGE FROM ITS FACILITIES IN THE UNITED STATES OF AMERICA. LUCKY ORANGE MAKES NO REPRESENTATIONS THAT THE SERVICE IS APPROPRIATE OR AVAILABLE FOR USE IN OTHER COUNTRIES. THOSE WHO ACCESS OR USE THE SERVICE FROM OTHER JURISDICTIONS DO SO AT THEIR OWN RISK AND ARE RESPONSIBLE FOR COMPLIANCE WITH ALL APPLICABLE LAWS, INCLUDING BUT NOT LIMITED LAWS RELATED TO THE COLLECTION OF DATA FROM YOUR WEBSITE’S VISITORS AND USERS.
9. INDEMNIFICATION
9.1 Lucky Orange Indemnification.
Lucky Orange shall defend You against any third party claims that the Service infringes any United States patent or United States copyright or misappropriates any trade secret (to the extent it qualifies as a trade secret under US law), and pay any costs and damages finally awarded by a court of competent jurisdiction or agreed upon in settlement with respect to such claims, provided Lucky Orange is promptly notified of any and all threats, claims and proceedings related thereto and given reasonable assistance and sole control over defense and settlement. Lucky Orange will not be responsible for any settlement it does not pre approve in writing. The foregoing obligations do not apply with respect to the Service or portions or components thereof which are: (1) not supplied by Lucky Orange , (2) modified after delivery by Lucky Orange, or (3) combined with other products, processes or materials where the alleged infringement relates to such combination. Additionally, Lucky Orange shall have no obligation to indemnify You under this Section where You continue any allegedly infringing activity after being notified thereof or after being informed of modifications that would have avoided the alleged infringement, or where your use of the Service is not strictly in accordance with this Agreement or with the Documentation.
9.2 Your Indemnification.
You agree to defend, indemnify, and hold harmless each of Lucky Orange, its affiliates and respective officers, employees, consultants, shareholders and representative from and against any and all claims, liabilities, damages, and/or costs (including attorneys’ and expert witness fees, costs and other expenses) arising out of or related to any actual or alleged claims involving or resulting from: (1) violation of this Agreement or applicable law, rule or regulation by You or any person accessing or using the Service by or through You; (2) infringement or misappropriation by You, or any person accessing or using the Service by or through You, of any intellectual property or privacy or other right of any person or entity (except claims of infringement or misappropriation arising solely from use of the Service as provided under this Agreement); (3) your Users or Visitors, or arising out of or relating to your relationship with any of your Users or Visitors; (4) Visitor Data in any manner; or (5) You or your Users’ breach of any applicable privacy or data protection law, rule or regulation. Lucky Orange reserves the right, at its own expense and its sole discretion, to assume the exclusive defense and control of any matter otherwise subject to indemnification by You.
10. LIMITATION OF LIABILITY
10.1 Limitation.
EXCEPT FOR A PARTY’S INDEMNIFICATION OBLIGATIONS, IN NO EVENT SHALL EITHER PARTY’S AGGREGATE LIABILITY UNDER THIS AGREEMENT EXCEED THE TOTAL AMOUNT PAID FROM YOU TO LUCKY ORANGE AS CONSIDERATION FOR USE OF THE SERVICE DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO SUCH LIABILITY. IN NO EVENT WILL LUCKY ORANGE AND/OR ITS OFFICERS, DIRECTORS, EMPLOYEES, AGENTS OR REPRESENTATIVES BE LIABLE FOR ANY CLAIM ATTRIBUTABLE TO ERRORS, OMISSIONS, OR OTHER INACCURACIES IN THE SERVICE, OR ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES RELATED TO OR ARISING FROM YOUR USE, MISUSE, OR INABILITY TO USE THE SERVICE, INCLUDING BUT NOT LIMITED TO, DAMAGES FOR LOST DATA, LOST PROFITS, OR COSTS OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, PERSONAL INJURY OR PROPERTY DAMAGE OF ANY NATURE, UNAUTHORIZED ACCESS TO THE SERVERS, OR SERVER UNAVAILABILITY, HOWEVER CAUSED UNDER ANY THEORY OF LIABILITY AND WHETHER OR NOT LUCKY ORANGE WAS AWARE OR ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. YOU ACKNOWLEDGE AND AGREE THAT LUCKY ORANGE WOULD NOT ENTER INTO THIS AGREEMENT UNLESS IT COULD RELY ON THE LIMITATIONS DESCRIBED IN THIS PARAGRAPH.
10.2 FOR CALIFORNIA RESIDENTS.
IF YOU ARE A CALIFORNIA RESIDENT OR COULD OTHERWISE CLAIM THE PROTECTIONS OF CALIFORNIA LAW, YOU FURTHER EXPRESSLY WAIVE THE PROVISIONS OF SECTION 1542 OF THE CALIFORNIA CIVIL CODE, WHICH READS AS FOLLOWS: "A GENERAL RELEASE DOES NOT EXTEND TO CLAIMS THAT THE CREDITOR OR RELEASING PARTY DOES NOT KNOW OR SUSPECT TO EXIST IN HIS OR HER FAVOR AT THE TIME OF THE RELEASE AND THAT, IF KNOWN BY HIM OR HER, WOULD HAVE MATERIALLY AFFECTED HIS OR HER SETTLEMENT WITH THE DEBTOR OR RELEASED PARTY." YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTAND SECTION 1542 OF THE CALIFORNIA CIVIL CODE, AND YOU HEREBY EXPRESSLY WAIVE AND RELINQUISH ALL RIGHTS AND BENEFITS UNDER THAT SECTION AND ANY LAW OF ANY JURISDICTION OF SIMILAR EFFECT WITH RESPECT TO YOUR RELEASE OF ANY CLAIMS YOU MAY HAVE AGAINST LUCKY ORANGE.
11. GOVERNING LAW, JURISDICTION AND DISPUTE RESOLUTION
11.1 Choice of Law.
This Agreement and the rights of the parties hereunder will be governed by and construed in accordance with the laws of the State of Kansas, exclusive of conflict or choice of law rules. The parties agree that any controversy, claim or litigation arising out of or in connection with this Agreement shall be resolved in a federal or state court in the State of Kansas, and consent to the jurisdiction of such court over the parties hereto and such controversy, claim or litigation. The parties acknowledge that this Agreement evidences a transaction involving interstate commerce.
11.2 Dispute Resolution.
Before initiating any legal claim or action (except with respect to equitable relief or non-payment of fees due under this Agreement), the parties agree to refer any dispute, controversy or claim arising out of or related to this Agreement (collectively, a “Claim”) to members of the parties’ executive management (each such member a “Representative”) for resolution, which referral shall be evidenced by a written notice from either party to the other (the “Referral”). The parties’ representatives shall meet in person or via conference call within ten (10) business days of such Referral. If the parties have not reached a mutually agreeable resolution of the Claim within ten (10) business days after their initial meeting, or within an additional time period mutually agreed upon, then either party may request that such claim be submitted to a mediator agreed upon by the parties. The mediator shall assist in attempting to negotiate a resolution of the Claim. The mediation shall be non-binding unless the parties otherwise agree. Unless otherwise agreed by the mediator and parties, the mediation shall be held within twenty-one (21) days of the request for mediation. The parties must attend the mediation and act in good faith to genuinely attempt to resolve the Claim. Any information or documents disclosed by a party under this clause: (a) must be kept confidential; and (b) may only be used to attempt to resolve the Claim. Each party shall pay its own costs of complying with this Section 11.2 and shall equally share the cost of the mediator.
12. MISCELLANEOUS
12. 1 Independent Contractors.
You understand and expressly agree that You and Lucky Orange are independent contractors and not agents or employees of the other party. Neither You nor Lucky Orange has any right, power, or authority to act or create any obligation, express or implied, on behalf of the other party.
12.2 Notices.
Any notice given under this Agreement shall be in writing and in the English language and shall be emailed to Lucky Orange at support@luckyorange.com, or if to You, to the email or physical address associated with your account. You hereby consent to receiving any notices relevant to the Services or this Agreement by email without requiring a handwritten signature for such notice to be effective.
12.3 Force Majeure.
Neither party shall be liable for failing or delaying performance of its obligations (except for the payment of money) resulting from any condition beyond its reasonable control, including but not limited to, governmental action, acts of terrorism, natural disasters, earthquake, fire, flood, or other acts of God, labor conditions, power failures, and Internet disturbances.
12.4 Consent to Do Business Electronically.
You agree not to contest the authorization for, or validity or enforceability of, electronic records and electronic signatures, or the admissibility of copies thereof, under any applicable law.
12.5 Government End Users.
The Service and Documentation are comprised of “commercial computer software” and “commercial computer software documentation” as such terms are used in 48 C.F.R. 12.212 and are provided to any civilian or military branch or agency of the U.S. government in accordance with the policies set forth in 48 C.F.R. 12.212 or 28 C.F.R. 227.7202-1 and 227.7202-3, respectively.
12.6 Compliance with Laws and Export Control.
You shall abide by all applicable local, state, national and foreign laws, rules, treaties and regulations in connection with your use of the Service, including those related to data privacy, international communications and the transmission of technical or personal data. You acknowledge that Lucky Orange may discontinue provision or performance of the Service or terminate the license to the Service granted hereunder following any changes in any relevant applicable law, which in the sole discretion of Lucky Orange, makes performance impossible, or illegal. You further acknowledge that the Service and related technology and technical data (collectively “Controlled Technology”) may be subject to the import and export laws of any country where Controlled Technology is imported or re-exported, including U.S. Export Administration Regulations. You agree not to export, re-export, import or provide any Controlled Technology to any prohibited country (such as embargoed countries), entity, or person (such as designated nationals) for which a license or other governmental approval is required or is otherwise prohibited. All Controlled Technology is prohibited for export or re-export to prohibited countries as listed at: https://www.treasury.gov/resource-center/sanctions/SDN-List/Pages/default.aspx or to any country subject to similar trade sanctions.
12.7 Equitable Relief.
You agree that your breach of the terms and responsibilities under this Agreement would cause irreparable harm and significant injury to Lucky Orange which would be both difficult to ascertain and for which there is no adequate remedy at law and that Lucky Orange shall be entitled, in addition to any other rights and remedies it may have, to injunctive relief (without the requirement of posting bond), specific performance and other equitable remedies to restrain any threatened, continuing, or further breach, or other equitable relief without prejudice to any other rights and remedies Lucky Orange may have under this Agreement.
12.8 Entire Agreement.
This Agreement constitutes the entire agreement between You and Lucky Orange with respect to the subject matter hereof and supersedes all prior agreements, both oral and written. Lucky Orange may update this Agreement at any time without notice to You. Any changes to the Agreement will be posted on the Lucky Orange website. You can determine when the Agreement was last revised by referring to the “Last Updated” legend at the top of the first page. UNLESS OTHERWISE STATED IN THE AMENDED VERSION OF THE AGREEMENT, ANY CHANGES TO THIS AGREEMENT ARE EFFECTIVE IMMEDIATELY UPON POSTING. Your continued use of the Service will constitute your agreement to any new provisions within the revised Agreement.
12.9 Waiver; Severability.
Either party’s failure to enforce any provision of this Agreement will not be deemed to be a waiver of its right to enforce them. If any term or provision of this Agreement will be held to be invalid, illegal, or unenforceable, the remaining terms and provisions of this Agreement will remain in full force and effect, and such invalid, illegal, or unenforceable term or provision will be deemed not to be part of this Agreement.
12.10 Publicity.
You hereby consent to inclusion of your name and trademarks or service marks in Lucky Orange customer lists that may be published as part of Lucky Orange's marketing and promotional efforts. Lucky Orange may identify You as a customer when referring to lists of its customers.
12.11 Assignment.
You may not assign, transfer, or sell (voluntarily or by operation of law) your rights or obligations under this Agreement without the prior written consent of Lucky Orange. Any purported assignment without Lucky Orange’s consent will be void and will constitute a breach of this Agreement. Lucky Orange may assign this Agreement or delegate or subcontract its obligations under this Agreement at any time.
12.12 Survival.
The provisions of this Agreement shall to survive the expiration or termination of this Agreement, including, without limitation, provisions governing ownership and use of intellectual property, representations, disclaimers, warranties, liability, indemnification, governing law, jurisdiction, venue, remedies, rights after termination, and interpretation of this Agreement, will survive the expiration or termination of this Agreement for their full statutory period.
Exhibit A
Lucky Orange Data Processing Addendum
THIS DATA PROCESSING ADDENDUM (“DPA”) forms part of the Terms of Service Agreement (“Agreement”) between Lucky Orange LLC (“Lucky Orange”) and Customer and reflects the parties’ agreement with regard to the processing of Customer Personal Data. All capitalized terms not defined herein shall have the meaning set forth in the Agreement.
WHEREAS, Customer enters into this DPA on behalf of itself and, to the extent required under Applicable Data Protection Law, in the name and on behalf of its Authorized Affiliates, if and to the extent Lucky Orange processes Personal Data for which such Authorized Affiliates qualify as the Controller; and
WHEREAS, in providing the Service to Customer pursuant to the Agreement, Lucky Orange may Process Customer Personal Data on behalf of Customer, and the parties agree to comply with the following provisions with respect to any Personal Data.
NOW THEREFORE, Lucky Orange and Customer hereby enter into this DPA effective as of the last signature date below. This DPA is incorporated into and forms part of the Agreement.
1. DEFINITIONS
“Applicable Data Protection Laws” means all laws and regulations, including the GDPR, CCPA, and other laws and regulations of the United States, European Union, the European Economic Area and their member states, Switzerland and United Kingdom, applicable to the Processing of Personal Data under the Agreement.
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control,” for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
“Authorized Affiliate” means any of Customer’s Affiliate(s) which (a) is subject to Applicable Data Protection Laws, and (b) is permitted to use the Service pursuant to the Agreement between Customer and Lucky Orange, but has not signed its own Attachment with Lucky Orange and is not a “Customer” as defined under the Agreement.
“Breach” means any breach of security leading accidentally or unlawfully to the destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data
“Customer Personal Data” means Personal Data which is Processed by Lucky Orange on behalf of Customer in connection with the Service.
“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, applicable as of 25 May 2018, and repealing Directive 95/46/EC (General Data Protection Regulation).
“Service” means the software and services that Lucky Orange provides to Customer as further detailed in the Agreement or applicable.
“Standard Contractual Clauses” means the standard contractual clauses attached hereto as Exhibit A.
“Controller”, “Data Subject”, “Personal Data” “Processing”, “Processor”, “Sensitive Data”, “Subprocessor”, and “Supervisory Authority” have the meanings set out in the GDPR.
2. PROCESSING OF PERSONAL DATA
The Parties’ Roles. The parties agree that with regard to the Processing of Customer Personal Data, Customer is the Controller, Lucky Orange is the Processor, and that Lucky Orange will engage Subprocessors pursuant to the requirements of this DPA.
Customer’s Instructions. By entering into this DPA, Customer instructs Lucky Orange to Process Customer Personal Data only in accordance with Applicable Data Protection Laws: (a) to provide the Service; (b) as documented in the Agreement, including this DPA; and (c) as further documented in any other lawful written instructions given by Customer and acknowledged by Lucky Orange as constituting instructions for purposes of this DPA.
Lucky Orange’s Responsibilities. Lucky Orange shall keep Customer Personal Data confidential and shall only Process Customer Personal Data on behalf of and in accordance with Customer’s documented instructions for Processing, including with regard to transfers of Customer Personal Data to a third country, in accordance with the Agreement. Lucky Orange shall promptly inform Customer if, in its opinion, any instruction of Customer infringes Applicable Data Protection Laws or if Lucky Orange is required by applicable law to Process Customer Personal Data in a manner which violates those instructions, in which case Lucky Orange will inform Customer of such requirement before Processing unless that law prohibits such information on grounds of public interest. Lucky Orange shall not be required to comply with or observe Customer’s instructions if such instructions would violate Applicable Data Protection Laws.
Details and Scope of the Processing. The subject-matter of the Processing of Customer Personal Data by Lucky Orange is the performance of the Service pursuant to the Agreement. The duration of the Processing, the nature, and purpose of the Processing, the types of Customer Personal Data and categories of Data Subjects Processed, are further specified in Appendix 1 to the Standard Contractual Clauses.
3. RIGHTS OF DATA SUBJECTS
Data Subject Requests. To the extent legally permitted, Lucky Orange shall promptly notify Customer if it receives a request from a Data Subject to exercise the Data Subject’s right of access, right to rectification, restriction of Processing, erasure (“right to be forgotten”), data portability, object to the Processing, or its right not to be subject to an automated inpidual decision making (collectively, “Data Subject Request”). Taking into account the nature of the Processing, Lucky Orange shall assist Customer through appropriate commercially reasonable organizational and technical measures, insofar as this is possible, for the fulfillment of Customer’s obligation to respond to a Data Subject Request. To the extent legally permitted, Customer shall be responsible for any costs arising from Lucky Orange’s provision of such assistance.
4. LUCKY ORANGE PERSONNEL
Confidentiality. Lucky Orange shall ensure that its personnel engaged in the Processing of Customer Personal Data are informed of the confidential nature of the Personal Data and have executed written confidentiality agreements.
Reliability. Lucky Orange shall take commercially reasonable steps to ensure the reliability of any Lucky Orange personnel engaged in the Processing of Customer Personal Data.
Limitation. Lucky Orange shall ensure that Lucky Orange’s access to Customer Personal Data is limited to those personnel assisting in the provision of the Service in accordance with the Agreement.
5. SUBPROCESSORS
Lucky Orange’s Subprocessors. Lucky Orange has instructed or authorized the use of Subprocessors to assist Lucky Orange with respect to the performance of Lucky Orange’s obligations under the Agreement. A list of Lucky Orange’s Subprocessors shall be attached to this DPA as Appendix 3. Lucky Orange shall inform Customer of any intended changes concerning the addition or replacement of Subprocessors, thereby giving Customer the opportunity to reasonably object to such changes. Lucky Orange shall enter into a contract with the Subprocessor whereby Lucky Orange shall require the Subprocessor to comply with obligations no less onerous than Lucky Orange’s obligations under this DPA.
Liability for Subprocessors. Lucky Orange shall be liable for the acts and omissions of its Subprocessors to the same extent Lucky Orange would be liable if performing the services of each Subprocessor directly under the terms of this DPA, except as otherwise set forth in the Agreement.
6. CUSTOMER OBLIGATIONS
Compliance with Applicable Data Protection Laws. Customer shall, in its use of the Service, Process Customer Personal Data in accordance with Applicable Data Protection Laws. For the avoidance of doubt, Customer’s instructions for the Processing of Personal Data shall comply with Applicable Data Protection Laws, and Customer further acknowledges and agrees that its transfer of Customer Personal Data to Lucky Orange for Processing pursuant to this DPA and the Agreement shall comply with Applicable Data Protection Laws. Customer shall have sole responsibility for the accuracy, quality, and legality of Customer Personal Data and the means by which Customer acquired Customer Personal Data.
Nature of Personal Data. Customer acknowledges and agrees that, except as otherwise set forth in this Section 6 or as expressly set forth in Appendix 1 of the Standard Contractual Clauses, Customer Personal Data provided or made available to Lucky Orange for Processing in connection with the Service shall consist of information relating to Customer’s Traffic Data. Traffic Data contains the categories of data set forth in Appendix 1 of the Standard Contractual Clauses.
Disclosure of Customer End User Information. To the extent Customer, in its sole discretion, deems it necessary to disclose or otherwise provide to Lucky Orange Customer Personal Data other than Traffic Data, Customer shall: (a) notify Lucky Orange in writing and in advance that it intends to disclose such Customer Personal Data to Lucky Orange, pursuant to a process as specified by Lucky Orange; and (b) ensure that such Customer Personal Data is encrypted in accordance with industry standard best practices.
Sensitive Data. Notwithstanding any provision to the contrary in this DPA, Customer shall not provide Lucky Orange with any high risk or Sensitive Data. In the event Customer does provide Sensitive Data, Customer shall comply with all Applicable Data Protection Laws, including without limitation applicable security and confidentiality measures in accordance with GDPR Article 32. Customer accepts full liability for any breaches of its responsibilities in this Section 6(d).
Lawful Basis. Customer warrants that it has a lawful basis (as defined under Article 6 of GDPR or, with respect to Sensitive Data, as additionally defined in Article 9 of GDPR) for all Customer Personal Data it provides to Lucky Orange. If at any time during the Term of this Agreement, Customer discovers that it does not have a lawful basis for providing Lucky Orange any Customer Personal Data, then it shall notify Lucky Orange in writing immediately, and Lucky Orange upon such notification will cease Processing that Customer Personal Data.
Indemnity. Customer shall defend, indemnify and hold Lucky Orange harmless from and against all losses, damages, costs, charges, fines, fees, awards or other expenses, (including, without limitation, fines imposed by any Supervisory Authority or other regulator under the GDPR), arising out of or in connection with any action, claim, proceeding or allegation related to (a) Customer’s disclosure of Customer Personal Data to Lucky Orange, or (b) Lucky Orange’s Processing of such Personal Data in accordance with the terms of this DPA.
7. SECURITY
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, both Lucky Orange and Customer will implement technical and organizational measures designed to ensure a level of security appropriate to the risk related to the Processing of the Personal Data and to protect Personal Data particularly against any accidental or unlawful destruction, loss, alteration or unauthorized disclosure or access (whether such Personal Data is on Lucky Orange’s or Customer’s systems or facilities, in transit or being disposed of). Lucky Orange shall ensure that Personal Data communicated by or obtained from Customer are properly isolated from Personal Data from other customers.
8. PERSONAL DATA BREACH
Lucky Orange shall take the following actions in the event of any Breach: (a) Lucky Orange shall notify the Customer about any Breach without undue delay, and in any event within seventy-two (72)hours, after becoming aware of it; (b) take all actions as may be required of a Processor by Applicable Data Protection Law, and more generally provide Customer with reasonable assistance in relation to Customer’s obligations to notify any Supervisory Authority of the Breach and to the Data Subjects as the case may be; (c) maintain any records relating to the Breach, including the results of its own investigations and authorities’ investigations; (d) cooperate with the Customer and take reasonable measures as necessary to prevent the Breach from occurring again; and (e) where Customer reasonably determines that a Breach notification is required under Applicable Data Protection Laws and to the extent the Breach was directly caused by Lucky Orange’s breach of Applicable Data Protection Laws, Lucky Orange shall, as its sole liability and Customer’s sole remedy under this DPA, reimburse Customer for the direct, verifiable, necessary and reasonably incurred third-party costs of the Customer in the (i) investigation of such Breach, (ii) preparation and mailing of notices to such Data Subjects and any Supervisory Authority as required by the GDPR and (iii) mitigation of any adverse effects of such infringement on a Data Subject.
9. AUDITS
Upon not less than thirty (30) days prior written notice by Customer, and not more than once in any twelve (12) month period, Lucky Orange shall permit Customer and/or its authorized agents to audit its written records to the extent reasonably required in order to confirm that Company is complying with its obligations under this DPA or any Applicable Data Protection Law.
10. RETENTION AND DELETION OF CUSTOMER PERSONAL DATA
At the Customer’s written election, Lucky Orange shall delete or return all Customer Personal Data, and, in any event, shall delete all copies of Customer Personal Data within ninety (90) days after Lucky Orange’s completion of the applicable Service, or unless otherwise required by Applicable Data Protection Law.
11. AUTHORIZED AFFILIATES
Contractual Relationship. The parties acknowledge and agree that, by executing the Agreement, the Customer enters into the DPA on behalf of itself and, as applicable, in the name and on behalf of its Authorized Affiliates.
Communication. Customer shall remain responsible for coordinating all communication with Lucky Orange under this DPA and be entitled to make and receive any communication in relation to this DPA on behalf of its Authorized Affiliates.
Rights of Authorized Affiliates. Except where Applicable Data Protection Laws require an Authorized Affiliate to exercise a right or seek any remedy under this DPA against Lucky Orange directly by itself, the parties agree that Customer shall (a) exercise any such right or seek any such remedy on behalf of the Authorized Affiliate, and (b) exercise any such rights under this DPA in a combined manner for all of its Authorized Affiliates together.
12. INDEMNITY; LIMITATION OF LIABILITY
Indemnity. In the event a Data Subject brings a claim against either or both parties (under Article 79 of the GDPR or any other cause of action) for alleged infringement of the GDPR, each party shall at its own expense control the defense of any such claim (or its portion of the defense) and remain solely responsible for any costs, expenses and liabilities related thereto, including legal fees or any amounts awarded against it by a court or made by it in settlement; provided however, that where each party is responsible for a portion of the damages suffered by a Data Subject for the same incident or series of incidents, and the Data Subject has recovered full compensation from only one party (the “Compensating Party”) pursuant to Article 82(4) of the GDPR, then the Compensating Party shall be entitled to claim back from the other party that portion of the compensation corresponding to the damage caused by such other party.
Limitation of Liability. For the avoidance of doubt, except as set forth in this Section 12, neither party shall be liable to the other party resulting from such other party's infringement of the GDPR. By way of example and not of limitation, in the event a Supervisory Authority imposes any fines, penalties or other sanctions on or against a party (the “Infringing Party”), the non-infringing party shall not indemnify or otherwise hold the Infringing Party harmless and the Infringing Party shall not seek indemnification, contribution or other recovery from the non-infringing party in connection therewith.
13. CALIFORNIA SPECIFIC PROVISIONS
This Section 13 is applicable to California businesses only and is intended to provide guidance on Lucky Orange’s compliance with Cal. Civ. Code § 1798.100 et. seq., otherwise known as the “California Consumer Privacy Act of 2018” or “CCPA” in the performance of services. Capitalized terms used throughout this Section but undefined elsewhere shall have their respect meanings under CCPA. In performing the services, Lucky Orange operates as Customer’s service provider under the CCPA. As Customer’s service provider, Lucky Orange processes certain personal information, in accordance with Customer’s instructions, to fulfill a legitimate business purpose for Customer. The business purpose(s) for which Customer has retained Lucky Orange for include any one or more of the following activities: maintaining or servicing Lucky Orange accounts, providing customer service in connection with the Service, processing or fulfilling orders and transactions involving your website patrons, providing advertising or marketing services through the Lucky Orange proprietary tools, providing analytic services, or providing similar services on Customer’s behalf. Aside from fulfilling the business purpose for Customer, Lucky Orange does not disclose or resell Personal Information for any other commercial purpose, except in certain cases where the personal information has been pseudonymized or is considered aggregate consumer information. The CCPA provides California Consumers (“Consumers”) the right to request that Lucky Orange delete the Consumer’s personal information under certain conditions. When Lucky Orange receives a request to delete personal information from a Consumer, Lucky Orange will verify the identity of the Consumer and then, as applicable, direct its service providers to delete the Consumer’s personal information approved for deletion. Accordingly, in the event that Customer receives a verifiable Consumer request to delete personal information held by Lucky Orange (as determined in Customer’s sole discretion), Lucky Orange shall fulfill such request without delay, provided Customer makes such request using the form provided by Lucky Orange. Lucky Orange shall not respond to any other request made in any other manner by Customer so as to ensure the confidentiality, integrity, and security of the personal information it processes.
14. EUROPEAN SPECIFIC PROVISIONS
Data Protection Impact Assessment. Taking into account the nature of the Processing, upon Customer’s reasonable request and at Customer’s cost, Lucky Orange shall provide Customer with reasonable cooperation and assistance needed to fulfill Customer’s obligations under the GDPR to carry out a data protection impact assessment related to Customer’s use of the Service, to the extent Customer does not otherwise have access to the relevant information, and to the extent such information is available to Lucky Orange. Lucky Orange shall provide reasonable assistance to Customer in the cooperation or prior consultation with the Supervisory Authority in the performance of its tasks related to this Section, to the extent required under the GDPR and taking into account the nature of the Processing and the information available to Lucky Orange.
Standard Contractual Clauses. The Standard Contractual Clauses apply to: (a) the legal entity that has executed the Standard Contractual Clauses as the data exporter and its Authorized Affiliates and, (b) the Affiliates of Customer established within the European Economic Area, Switzerland and the United Kingdom, which have signed an applicable Attachment for the Service. For the purpose of the Standard Contractual Clauses, the aforementioned entities shall be deemed “data exporters.”
15. ORDER OF PRECEDENCE
This DPA is incorporated into and forms part of the Agreement. In the event of a conflict between the terms of the Agreement and this DPA, the terms of this DPA will control. In the event of a conflict between the terms of the DPA and Standard Contractual Clauses, the Standard Contractual Clauses will prevail.
Exhibit A-1
STANDARD CONTRACTUAL CLAUSES (PROCESSORS)
For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection.
Name of the data exporting organization: _____________________
Address: _____________________________
Tel.: ______________; fax: ______________; e-mail: ______________
(the “data exporter”)
And
Name of the data importing organization: Lucky Orange LLC
Address: 8665 W 96th St Suite #100, Overland Park, KS 66212
Tel.: ______________; fax: ______________; e-mail: support@luckyorange.com
(the “data importer”)
each a “party”; together “the parties”,
HAVE AGREED on the following Contractual Clauses (the Clauses) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of inpiduals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.
Background
The data exporter has entered into a data processing addendum (“DPA”) with the data importer. Pursuant to the terms of the DPA, it is contemplated that services provided by the data importer will involve the transfer of personal data to data importer. Data importer is located in a country not ensuring an adequate level of data protection. To ensure compliance with Directive 95/46/EC and applicable data protection law, the controller agrees to the provision of such Service, including the processing of personal data incidental thereto, subject to the data importer’s execution of, and compliance with, the terms of these Clauses.
Clause 1
DefinitionsFor the purposes of the Clauses:
'personal data', 'special categories of data', 'process/processing', 'controller', 'processor', 'data subject' and 'supervisory authority' shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of inpiduals with regard to the processing of personal data and on the free movement of such data;
'the data exporter' means the controller who transfers the personal data;
'the data importer' means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country's system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;
'the subprocessor' means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with their instructions, the terms of the Clauses and the terms of the written subcontract;
'the applicable data protection law' means the legislation protecting the fundamental rights and freedoms of inpiduals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data exporter is established;
'technical and organisational security measures' means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.
Clause 2
Details of the transferThe details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 which forms an integral part of the Clauses.
Clause 3
Third-party beneficiary clauseThe data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.
The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.
The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.
Clause 4
Obligations of the data exporterThe data exporter agrees and warrants:
that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;
that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter's behalf and in accordance with the applicable data protection law and the Clauses;
that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this contract;
that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;
that it will ensure compliance with the security measures;
that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;
to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;
to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;
that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and
that it will ensure compliance with Clause 4(a) to (i).
Clause 5
Obligations of the data importerThe data importer agrees and warrants:
to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
that it has implemented the technical and organisational security measures specified in Appendix 2 before processing the personal data transferred;
that it will promptly notify the data exporter about:
any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation,
any accidental or unauthorised access, and
any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;
to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;
at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;
to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;
that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent;
that the processing services by the subprocessor will be carried out in accordance with Clause 11;
to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data exporter.
Clause 6
LiabilityThe parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensation from the data exporter for the damage suffered.
If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity.
The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities.
If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the subprocessor agrees that the data subject may issue a claim against the data subprocessor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the subprocessor shall be limited to its own processing operations under the Clauses.
Clause 7
Mediation and jurisdictionThe data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject:
to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;
to refer the dispute to the courts in the Member State in which the data exporter is established.
The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.
Clause 8
Cooperation with supervisory authoritiesThe data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.
The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.
The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any subprocessor preventing the conduct of an audit of the data importer, or any subprocessor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5 (b).
Clause 9
Governing LawThe Clauses shall be governed by the law of the Member State in which the data exporter is established.
Clause 10
Variation of the contractThe parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.
Clause 11
SubprocessingThe data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on the data importer under the Clauses. Where the subprocessor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the subprocessor's obligations under such agreement.
The prior written contract between the data importer and the subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the data exporter is established.
The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5 (j), which shall be updated at least once a year. The list shall be available to the data exporter's data protection supervisory authority.
Clause 12
Obligation after the termination of personal data processing servicesThe parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.
The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1.
On behalf of the data exporter: Name (written out in full):
Position:
Address:
Signature ______________
On behalf of the data importer: Name: Lucky Orange LLC
Name: Danny Wajcman
Position: Chief Operating Officer
Address: 8665 W 96th St Suite #100, Overland Park, KS 66212
Signature ______________
APPENDIX 1 TO THE STANDARD CONTRACTUAL CLAUSES
This Appendix forms part of the Clauses and must be completed and signed by the parties
The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix.
Data exporterThe data exporter is:____________________________
The legal entity that has executed the Data Processing Addendum based on the Standard Contractual Clauses as a Data Exporter established within the European Economic Area and Switzerland that have purchased the Service on the basis of one or more Work Order(s).
Data importerThe data importer is: Lucky Orange LLC
Data subjects
The personal data transferred concern the following categories of data subjects:
Customer’s employees, agents, and visitors of its website(s)
Categories of data
The personal data transferred concern the following categories of data:
Traffic data (e.g., the pages visited, the visitor’s mouse movements and clicks, keystroke data, and HTML data on a page visited by a visitor (if such HTML data includes Personal Information))
IP address and header information (e.g., browser type, referring URL)
Processing operations
The personal data transferred will be subject to the following basic processing activities:
The objective of Processing of Personal Data by the data importer is the performance of the Service pursuant to the Terms of Service Agreement, in particular to provide Lucky Orange’s Service. The Processing of Personal Data will be performed in the United States.
DATA EXPORTER
Name: ______________
Authorized Signature ______________
DATA IMPORTER
Name: Danny Wajcman
Authorized Signature ______________
APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES
This Appendix forms part of the Clauses and must be completed and signed by the parties.
Lucky Orange shall maintain administrative, physical and technical safeguards for protection of the security, confidentiality and integrity of Customer Personal Data. Lucky Orange regularly monitors compliance with these safeguards. Lucky Orange will not materially decrease the overall security of the Service during the term of the Service.
DATA EXPORTER
Name: ______________
Authorized Signature ______________
DATA IMPORTER
Name: Danny Wajcman
Authorized Signature ______________
APPENDIX 3 TO THE STANDARD CONTRACTUAL CLAUSES
This Appendix forms part of the Clauses and must be completed and signed by the parties.
The list of subprocessors approved by the data importer as of the effective date of the DPA is as set forth below:| Subprocessor | Purpose |
|---|---|
| Amazon Web Services | Cloud Infrastructure Hosting |
| Google Inc. | Cloud Infrastructure Hosting |
| Elastic Cloud | Database Management |
| MailerLite | Email Newsletter Service Provider |
| Vero | Marketing Campaign Automated Email Distribution |
| Help Scout | Customer Support and Communication |
| Google Analytics | Website Analytics and Reporting |
| Cloud Flare | Content distribution, security and DNS services for web traffic |
| Q Box | Database Management |
| Webinar Ninja | Webinar Service Provider |
| Brain Tree (owned by PayPal) | Credit Card Payment Processing System |
| One Page CRM | Customer Relationship and Account Management Tool |
| Mail Gun | Transactional and report delivery email distribution system |
DATA EXPORTER
Name: ______________
Authorized Signature ______________
DATA IMPORTER
Name: Danny Wajcman
Authorized Signature ______________