Page contains infos about: Terms& Conditions, Privacy Policy and Google Data Processing Terms
Terms & Conditions
1. General
The following general terms and conditions apply to all contracts, deliveries and other services. We hereby expressly object to deviating provisions of the contractual partner. Lambretta-Lutz is entitled to amend or supplement these General Terms and Conditions, including any appendices, at any time with a reasonable period of notice. Orders received before that date will be processed according to the old General Terms and Conditions that are still valid at that time.
2. Quotation
Our offers are non-binding. Small deviations and technical changes compared to our illustrations or descriptions are possible.
3. For Race use only, TÜV / ABE
All parts in our range, unless separately marked, are for Race use only and not street leagal.
For Costumers in Germany it means, all parts are without TÜV/ABE and therefore not approved for use on public roads. Tuning parts are for display purposes only. All articles carried by us that are not expressly marked for road traffic and affect the StVZO require consultation or registration with TÜV/DEKRA before they are put into operation on public roads.
For tuning and electronic parts, the installation and operation is at your own risk, the parts are expressly intended only for use at exhibitions and not for use in the vehicles. Explicit reference is made to the considerable risks associated with the use of tuning and racing articles in the context of the operation of vehicles.
4. Warranty
Lambretta-Lutz warrants that the goods sold are free of material and manufacturing defects at the time of the transfer of risk and that they have the contractually guaranteed properties.
In the event of defects in the delivered goods, the customer is entitled to the statutory rights.
In the case of complaints, the date of purchase must be proven with an invoice. The item in question must be sent in together with a copy of the invoice, sufficiently postaged. The warranty does not cover normal wear and tear. The warranty expires if the customer changes the delivered goods. Lambretta-Lutz has the right to repair free of charge during the warranty period. Partial or full replacement of the item is permitted. If defects are not remedied within a reasonable period of time, the buyer is entitled to conversion or reduction. § 476a BGB applies.
5. Tuning Parts - Warranty - Guarantee
We would like to point out once again that tuning parts are intended for racing. These parts are not designed for use in daily road traffic, despite very high quality and state-of-the-art manufacturing methods. More power always means more wear and shorter service life of the engine with all components. All tuning manufacturers (e.g. Monza, AF Rayspeed, etc.) exclude any warranty after assembly, unless it is a demonstrable defect in materials or production. Since this can practically no longer be proven, we would like to point out that all tuning parts should be carefully examined for possible errors or defects BEFORE assembly. The complaint of a tuning part after assembly is therefore unfortunately almost impossible. At the customer's expense, the corresponding part would have to be sent to the manufacturer in Italy, for example. Here it would be clarified whether it is a material or assembly error. The return must be accompanied by the invoice of the master workshop that tuned the engine (proof of professional assembly, date of assembly). In particular, consequential damage caused by a defect, such as other affected engine components, repair and towing costs are completely excluded. We ask for your understanding for these limitations, which are actually self-evident for a racing part but include a limitation of the warranty / guarantee.
6. Engine machining, engine tuning, tuning parts - warranty - guarantee
A tuning part is a component that leads to an increase in performance or speed. More power always means more wear and shorter service life of the engine with all components. We therefore reject any warranty / guarantee as soon as only one tuning part is installed on the engine, as even the smallest changes to the engine lead to considerable changes in the engine characteristics - and thus the engine is no longer as stable as in its original condition. No liability is assumed for any consequential damages.
7. Disclaimer for engines, engine testing - also on the test bench
No liability is assumed for tuned engines (as soon as only one tuning part is installed, the engine is considered tuned) and their components, which are tested or tuned on the dynamometer or generally here. This applies in particular to cylinders, pistons, engine blocks, clutches, crankshafts and all parts belonging to the engine. Of course, this disclaimer also applies to driving in the time after voting (see text above).
8. Disclaimer for fully assembled and, if necessary, tuned motors
Motors that have a higher power, torque or speed (compared to the original engine) due to modifications are exposed to heavier loads. This applies to ABSOLUTELY ALL components. No liability is assumed for consequential problems or consequential damages. This applies in particular to premature leaks in the cylinder, exhaust, intake manifold and engine block in general and in all other characteristics (gear jumping, clutch slipping, starting behaviour, driving characteristics, engine noise, etc.). The additional power and thus the additional load on all components is often over 300% in motors. Therefore, liability CANNOT be assumed, it would be absolutely unreasonable.
9. Damage to the vehicle in the course of repair or maintenance
Lambretta-Lutz reserves the right to repair or repair any damage that may occur during repair or maintenance. The customer must report this damage to Lambretta-Lutz within 10 days. Costs for repairs by another company / workshop will not be reimbursed.
10. Disclaimer for Vehicles
No liability is assumed for vehicles / scooters that are temporarily or permanently discontinued here. This applies in particular to fire, theft and other liability damages.
11. Shipping costs
Shipping, postage and cash on delivery costs can be found in advance in the terms and conditions of delivery. Exact details will be provided in the SECOND EMAIL in a final compilation / invoice. We will send this final compilation / invoice by email in the form of a "pdf" file. If you pay in advance, the bank details will also be provided, if they have not already been taken from our shop or our homepage. Shipping is free of charge only by prior arrangement. Sending in a letter / maxi letter is generally not insured and is only done by prior arrangement and at the express request of the customer. If such a letter is lost in the mail, we will not provide a replacement free of charge - the customer bears 100% of the risk.
12. Delivery and payment
The terms and conditions of delivery and payment of Lambretta-Lutz are specified in more detail in the order form. There is no minimum order quantity. All our prices are quoted in EURO and include VAT. We reserve the right to make a partial delivery if this appears to be advantageous for speedy processing. Special forms of shipment requested by our customers will be charged with a local surcharge.
13. Delivery times
Goods that are in stock (we are not liable for transport problems) will be shipped within 2 days. If the goods are not in stock at the time of ordering, we will do our best to deliver them as quickly as possible. If the non-compliance with a delivery or performance deadline is due to force majeure, industrial disputes, unforeseeable obstacles or other circumstances for which we are not responsible, the deadline will be extended appropriately. In the event of non-compliance with the delivery deadline for reasons other than those mentioned above, the buyer is entitled to set a reasonable grace period in writing with the threat of rejection and, after its unsuccessful expiry, to withdraw from the contract with regard to the delivery or service contained in the contract. If the impossibility of delivery is due to the inability of the manufacturer or our supplier, both we and the buyer can withdraw from the contract if the agreed delivery date is exceeded by more than 2 months. Claims for damages due to delay or impossibility or non-performance, including those that have arisen up to the date of withdrawal from the contract, are excluded. Unless a legal representative of Lambretta-Lutz has acted intentionally or with gross negligence.
14. Cancellation policy
You have the right to withdraw from this contract within one month without giving reasons. The period is one month from the day on which you or a third party designated by you who is not the carrier took possession of the goods. In order to exercise your right of withdrawal, you must inform us - Lambretta-Lutz, Am Lochholz 28a, info@Lambretta-Lutz.de, 0151 - 11725085 of your decision to withdraw from this contract by means of an unambiguous statement (e.g. a letter sent by post, also by telephone, or e-mail). You can use the attached sample withdrawal form for this, but it is not mandatory. In order to comply with the withdrawal period, it is sufficient for you to send the notification of the exercise of the right of withdrawal before the expiry of the withdrawal period.
If you withdraw from this contract, we shall reimburse you for all payments we have received from you, including delivery costs (with the exception of additional costs resulting from the fact that you have chosen a type of delivery other than the cheapest standard delivery offered by us), without undue delay and at the latest within fourteen days from the day on which we received the notification of your withdrawal from this contract.
For this repayment, we will use the same means of payment that you used for the original transaction, unless otherwise expressly agreed with you; under no circumstances will you be charged any fees as a result of this repayment. We may withhold refund until we have received the goods back or until you have provided proof that you have returned the goods, whichever is earlier You have the goods without undue delay and in any event no later than one month from the day on which you notify us of the withdrawal from this contract, to us or to hand it over to us. The deadline is met if you send the goods before the expiry of the period of one month. We will bear the cost of returning the goods. You will only be liable for any loss in value of the Goods if such loss in value is due to handling of the Goods that is not necessary to check the nature, characteristics and functioning of the Goods.
If you wish to withdraw from the contract, please fill out this form and send it back to Lambretta-Lutz Lambretta-Lutz, Am Lochholz 28a, info@Lambretta-Lutz.de, or by phone at 0151 – 11725085.
I hereby withdraw from the contract concluded by me for the purchase of the following goods / the provision of the following service__________________________________________
Ordered on _________________________________________________________________
received on _________________________________________________________________
Name of the consumer _______________________________________________________
Address of the consumer _____________________________________________________
Consumer's signature __________________________________________________
Date_____________________________________________________________________
15. Shipping, Insurance, Transfer of Risk
(1) Unless expressly agreed otherwise, we will determine the appropriate method of shipment and carrier at our reasonable discretion.
(2) We only owe the timely and orderly delivery of the goods to the carrier and are not responsible for any delays caused by the carrier. A shipping time specified in the webshop is therefore non-binding.
(3) If the customer is a consumer, the risk of accidental loss, accidental damage or accidental loss of the delivered goods shall pass to the customer at the time when the goods are delivered to the customer or the customer is in default of acceptance. In all other cases, the risk is transferred to the customer when the goods are delivered to the transport company.
16. Severability
If any provision of these GTC is invalid, the remaining provisions shall remain unaffected. The invalid provision shall be deemed to have been replaced by one that comes closest to the meaning and purpose of the invalid provision in a legally effective manner. The same applies to any loopholes.
17. Retention of Title
Until full payment has been made, the goods remain the property of Lambretta-Lutz.
18. Data Retention
In accordance with § 28 of the Federal Data Protection Act (BDSG), we would like to draw your attention to the fact that the data required in the course of business transactions are processed and stored by means of an IT system in accordance with § 33 (BDSG). Personal data will of course be treated confidentially.
19. Contract legals
(1) Contracts between Lambretta-Lutz and the customers are exclusively governed by German law to the exclusion of the UN Convention on Contracts for the International Sale of Goods.
(2) In dealings with final consumers within the European Union, the law of the final consumer's domicile may also apply, provided that the provisions of consumer law are mandatory.
(3) If the private end consumer is not domiciled in the European Union, the place of jurisdiction shall be our place of business.
(4) If the customer is a merchant within the meaning of Section 1 (1) of the German Commercial Code (HGB), a legal entity under public law or a special fund under public law, the place of jurisdiction for all disputes arising out of or in connection with the relevant contractual relationship between the customer and Lambretta-Lutz is the registered office of Lambretta-Lutz. In all other cases, we or the customer may bring an action before any court of competent jurisdiction under the law.
20. Information on Online Dispute Resolution
In 2016, the EU Commission provided an internet platform for the online resolution of disputes - ODR platform. The ODR platform is intended to serve as a point of contact for out-of-court settlement of disputes regarding contractual obligations arising from sales contracts in the online sector.
The OS platform can be reached here:
http://ec.europa.eu/consumers/odr
21. Contractual storage
We do not store the text of the contract. You can save it by printing the offer via the print function of your browser. You would have to arrange for the text of the contract to be stored in a reproducible form yourself.
22. AGBs first
The text has been automatically translated. In case of doubt, the German terms and conditions apply (AGBs).
The following general terms and conditions apply to all contracts, deliveries and other services. We hereby expressly object to deviating provisions of the contractual partner. Lambretta-Lutz is entitled to amend or supplement these General Terms and Conditions, including any appendices, at any time with a reasonable period of notice. Orders received before that date will be processed according to the old General Terms and Conditions that are still valid at that time.
2. Quotation
Our offers are non-binding. Small deviations and technical changes compared to our illustrations or descriptions are possible.
3. For Race use only, TÜV / ABE
All parts in our range, unless separately marked, are for Race use only and not street leagal.
For Costumers in Germany it means, all parts are without TÜV/ABE and therefore not approved for use on public roads. Tuning parts are for display purposes only. All articles carried by us that are not expressly marked for road traffic and affect the StVZO require consultation or registration with TÜV/DEKRA before they are put into operation on public roads.
For tuning and electronic parts, the installation and operation is at your own risk, the parts are expressly intended only for use at exhibitions and not for use in the vehicles. Explicit reference is made to the considerable risks associated with the use of tuning and racing articles in the context of the operation of vehicles.
4. Warranty
Lambretta-Lutz warrants that the goods sold are free of material and manufacturing defects at the time of the transfer of risk and that they have the contractually guaranteed properties.
In the event of defects in the delivered goods, the customer is entitled to the statutory rights.
In the case of complaints, the date of purchase must be proven with an invoice. The item in question must be sent in together with a copy of the invoice, sufficiently postaged. The warranty does not cover normal wear and tear. The warranty expires if the customer changes the delivered goods. Lambretta-Lutz has the right to repair free of charge during the warranty period. Partial or full replacement of the item is permitted. If defects are not remedied within a reasonable period of time, the buyer is entitled to conversion or reduction. § 476a BGB applies.
5. Tuning Parts - Warranty - Guarantee
We would like to point out once again that tuning parts are intended for racing. These parts are not designed for use in daily road traffic, despite very high quality and state-of-the-art manufacturing methods. More power always means more wear and shorter service life of the engine with all components. All tuning manufacturers (e.g. Monza, AF Rayspeed, etc.) exclude any warranty after assembly, unless it is a demonstrable defect in materials or production. Since this can practically no longer be proven, we would like to point out that all tuning parts should be carefully examined for possible errors or defects BEFORE assembly. The complaint of a tuning part after assembly is therefore unfortunately almost impossible. At the customer's expense, the corresponding part would have to be sent to the manufacturer in Italy, for example. Here it would be clarified whether it is a material or assembly error. The return must be accompanied by the invoice of the master workshop that tuned the engine (proof of professional assembly, date of assembly). In particular, consequential damage caused by a defect, such as other affected engine components, repair and towing costs are completely excluded. We ask for your understanding for these limitations, which are actually self-evident for a racing part but include a limitation of the warranty / guarantee.
6. Engine machining, engine tuning, tuning parts - warranty - guarantee
A tuning part is a component that leads to an increase in performance or speed. More power always means more wear and shorter service life of the engine with all components. We therefore reject any warranty / guarantee as soon as only one tuning part is installed on the engine, as even the smallest changes to the engine lead to considerable changes in the engine characteristics - and thus the engine is no longer as stable as in its original condition. No liability is assumed for any consequential damages.
7. Disclaimer for engines, engine testing - also on the test bench
No liability is assumed for tuned engines (as soon as only one tuning part is installed, the engine is considered tuned) and their components, which are tested or tuned on the dynamometer or generally here. This applies in particular to cylinders, pistons, engine blocks, clutches, crankshafts and all parts belonging to the engine. Of course, this disclaimer also applies to driving in the time after voting (see text above).
8. Disclaimer for fully assembled and, if necessary, tuned motors
Motors that have a higher power, torque or speed (compared to the original engine) due to modifications are exposed to heavier loads. This applies to ABSOLUTELY ALL components. No liability is assumed for consequential problems or consequential damages. This applies in particular to premature leaks in the cylinder, exhaust, intake manifold and engine block in general and in all other characteristics (gear jumping, clutch slipping, starting behaviour, driving characteristics, engine noise, etc.). The additional power and thus the additional load on all components is often over 300% in motors. Therefore, liability CANNOT be assumed, it would be absolutely unreasonable.
9. Damage to the vehicle in the course of repair or maintenance
Lambretta-Lutz reserves the right to repair or repair any damage that may occur during repair or maintenance. The customer must report this damage to Lambretta-Lutz within 10 days. Costs for repairs by another company / workshop will not be reimbursed.
10. Disclaimer for Vehicles
No liability is assumed for vehicles / scooters that are temporarily or permanently discontinued here. This applies in particular to fire, theft and other liability damages.
11. Shipping costs
Shipping, postage and cash on delivery costs can be found in advance in the terms and conditions of delivery. Exact details will be provided in the SECOND EMAIL in a final compilation / invoice. We will send this final compilation / invoice by email in the form of a "pdf" file. If you pay in advance, the bank details will also be provided, if they have not already been taken from our shop or our homepage. Shipping is free of charge only by prior arrangement. Sending in a letter / maxi letter is generally not insured and is only done by prior arrangement and at the express request of the customer. If such a letter is lost in the mail, we will not provide a replacement free of charge - the customer bears 100% of the risk.
12. Delivery and payment
The terms and conditions of delivery and payment of Lambretta-Lutz are specified in more detail in the order form. There is no minimum order quantity. All our prices are quoted in EURO and include VAT. We reserve the right to make a partial delivery if this appears to be advantageous for speedy processing. Special forms of shipment requested by our customers will be charged with a local surcharge.
13. Delivery times
Goods that are in stock (we are not liable for transport problems) will be shipped within 2 days. If the goods are not in stock at the time of ordering, we will do our best to deliver them as quickly as possible. If the non-compliance with a delivery or performance deadline is due to force majeure, industrial disputes, unforeseeable obstacles or other circumstances for which we are not responsible, the deadline will be extended appropriately. In the event of non-compliance with the delivery deadline for reasons other than those mentioned above, the buyer is entitled to set a reasonable grace period in writing with the threat of rejection and, after its unsuccessful expiry, to withdraw from the contract with regard to the delivery or service contained in the contract. If the impossibility of delivery is due to the inability of the manufacturer or our supplier, both we and the buyer can withdraw from the contract if the agreed delivery date is exceeded by more than 2 months. Claims for damages due to delay or impossibility or non-performance, including those that have arisen up to the date of withdrawal from the contract, are excluded. Unless a legal representative of Lambretta-Lutz has acted intentionally or with gross negligence.
14. Cancellation policy
You have the right to withdraw from this contract within one month without giving reasons. The period is one month from the day on which you or a third party designated by you who is not the carrier took possession of the goods. In order to exercise your right of withdrawal, you must inform us - Lambretta-Lutz, Am Lochholz 28a, info@Lambretta-Lutz.de, 0151 - 11725085 of your decision to withdraw from this contract by means of an unambiguous statement (e.g. a letter sent by post, also by telephone, or e-mail). You can use the attached sample withdrawal form for this, but it is not mandatory. In order to comply with the withdrawal period, it is sufficient for you to send the notification of the exercise of the right of withdrawal before the expiry of the withdrawal period.
If you withdraw from this contract, we shall reimburse you for all payments we have received from you, including delivery costs (with the exception of additional costs resulting from the fact that you have chosen a type of delivery other than the cheapest standard delivery offered by us), without undue delay and at the latest within fourteen days from the day on which we received the notification of your withdrawal from this contract.
For this repayment, we will use the same means of payment that you used for the original transaction, unless otherwise expressly agreed with you; under no circumstances will you be charged any fees as a result of this repayment. We may withhold refund until we have received the goods back or until you have provided proof that you have returned the goods, whichever is earlier You have the goods without undue delay and in any event no later than one month from the day on which you notify us of the withdrawal from this contract, to us or to hand it over to us. The deadline is met if you send the goods before the expiry of the period of one month. We will bear the cost of returning the goods. You will only be liable for any loss in value of the Goods if such loss in value is due to handling of the Goods that is not necessary to check the nature, characteristics and functioning of the Goods.
If you wish to withdraw from the contract, please fill out this form and send it back to Lambretta-Lutz Lambretta-Lutz, Am Lochholz 28a, info@Lambretta-Lutz.de, or by phone at 0151 – 11725085.
I hereby withdraw from the contract concluded by me for the purchase of the following goods / the provision of the following service__________________________________________
Ordered on _________________________________________________________________
received on _________________________________________________________________
Name of the consumer _______________________________________________________
Address of the consumer _____________________________________________________
Consumer's signature __________________________________________________
Date_____________________________________________________________________
15. Shipping, Insurance, Transfer of Risk
(1) Unless expressly agreed otherwise, we will determine the appropriate method of shipment and carrier at our reasonable discretion.
(2) We only owe the timely and orderly delivery of the goods to the carrier and are not responsible for any delays caused by the carrier. A shipping time specified in the webshop is therefore non-binding.
(3) If the customer is a consumer, the risk of accidental loss, accidental damage or accidental loss of the delivered goods shall pass to the customer at the time when the goods are delivered to the customer or the customer is in default of acceptance. In all other cases, the risk is transferred to the customer when the goods are delivered to the transport company.
16. Severability
If any provision of these GTC is invalid, the remaining provisions shall remain unaffected. The invalid provision shall be deemed to have been replaced by one that comes closest to the meaning and purpose of the invalid provision in a legally effective manner. The same applies to any loopholes.
17. Retention of Title
Until full payment has been made, the goods remain the property of Lambretta-Lutz.
18. Data Retention
In accordance with § 28 of the Federal Data Protection Act (BDSG), we would like to draw your attention to the fact that the data required in the course of business transactions are processed and stored by means of an IT system in accordance with § 33 (BDSG). Personal data will of course be treated confidentially.
19. Contract legals
(1) Contracts between Lambretta-Lutz and the customers are exclusively governed by German law to the exclusion of the UN Convention on Contracts for the International Sale of Goods.
(2) In dealings with final consumers within the European Union, the law of the final consumer's domicile may also apply, provided that the provisions of consumer law are mandatory.
(3) If the private end consumer is not domiciled in the European Union, the place of jurisdiction shall be our place of business.
(4) If the customer is a merchant within the meaning of Section 1 (1) of the German Commercial Code (HGB), a legal entity under public law or a special fund under public law, the place of jurisdiction for all disputes arising out of or in connection with the relevant contractual relationship between the customer and Lambretta-Lutz is the registered office of Lambretta-Lutz. In all other cases, we or the customer may bring an action before any court of competent jurisdiction under the law.
20. Information on Online Dispute Resolution
In 2016, the EU Commission provided an internet platform for the online resolution of disputes - ODR platform. The ODR platform is intended to serve as a point of contact for out-of-court settlement of disputes regarding contractual obligations arising from sales contracts in the online sector.
The OS platform can be reached here:
http://ec.europa.eu/consumers/odr
21. Contractual storage
We do not store the text of the contract. You can save it by printing the offer via the print function of your browser. You would have to arrange for the text of the contract to be stored in a reproducible form yourself.
22. AGBs first
The text has been automatically translated. In case of doubt, the German terms and conditions apply (AGBs).
Updated November, 2023
This website (the “Site”) is owned and operated by Lambretta-Lutz.de (“COMPANY” “we” or “us”). By using the Site, you agree to be bound by these Terms and Conditions and to use the Site in accordance with these Terms and Conditions, our Privacy Policy, our Return Policy and any additional terms and conditions that may apply to specific sections of the Site or to products and services available through the Site or from COMPANY. Accessing the Site, in any manner, whether automated or otherwise, constitutes use of the Site and your agreement to be bound by these Terms & Conditions.
We reserve the right to change these Terms & Conditions or to impose new conditions on use of the Site, from time to time, in which case we will post the revised Terms & Conditions on this website. By continuing to use the Site after we post any such changes, you accept the Terms & Conditions, as modified.
Intellectual Property Rights
Our Limited License to You. This Site and all the materials available on the Site are the property of us and/or our affiliates or licensors, and are protected by copyright, trademark, and other intellectual property laws. The Site is provided solely for your personal noncommercial use. You may not use the Site or the materials available on the Site in a manner that constitutes an infringement of our rights or that has not been authorized by us. More specifically, unless explicitly authorized in these Terms of Service or by the owner of the materials, you may not modify, copy, reproduce, republish, upload, post, transmit, translate, sell, create derivative works, exploit, or distribute in any manner or medium (including by email or other electronic means) any material from the Site. You may, however, from time to time, download and/or print one copy of individual pages of the Site for your personal, non-commercial use, provided that you keep intact all copyright and other proprietary notices.
Your License to Us. By posting or submitting any material (including, without limitation, comments, blog entries, Facebook postings, photos and videos) to us via the Site, internet groups, social media venues, or to any of our staff via email, text or otherwise, you are representing: (i) that you are the owner of the material, or are making your posting or submission with the express consent of the owner of the material; and (ii) that you are thirteen years of age or older. In addition, when you submit, email, text or deliver or post any material, you are granting us, and anyone authorized by us, a royalty-free, perpetual, irrevocable, non-exclusive, unrestricted, worldwide license to use, copy, modify, transmit, sell, exploit, create derivative works from, distribute, and/or publicly perform or display such material, in whole or in part, in any manner or medium, now known or hereafter developed, for any purpose. The foregoing grant shall include the right to exploit any proprietary rights in such posting or submission, including, but not limited to, rights under copyright, trademark, service mark or patent laws under any relevant jurisdiction. Also, in connection with the exercise of such rights, you grant us, and anyone authorized by us, the right to identify you as the author of any of your postings or submissions by name, email address or screen name, as we deem appropriate.
You acknowledge that COMPANY has the right but not the obligation to use and display any postings or contributions of any kind and that COMPANY may elect to cease the use and display of any such materials (or any portion thereof), at any time for any reason whatsoever.
Limitations on Linking and Framing. You may establish a hypertext link to the Site so long as the link does not state or imply any sponsorship of your site by us or by the Site. However, you may not, without our prior written permission, frame or inline link any of the content of the Site, or incorporate into another website or other service any of our material, content or intellectual property.
Disclaimers
Throughout the Site, we may provide links and pointers to Internet sites maintained by third parties. Our linking to such third-party sites does not imply an endorsement or sponsorship of such sites, or the information, products or services offered on or through the sites. In addition, neither we nor affiliates operate or control in any respect any information, products or services that third parties may provide on or through the Site or on websites linked to by us on the site.
If applicable, any opinions, advice, statements, services, offers, or other information or content expressed or made available by third parties, including information providers, are those of the respective authors or distributors, and not COMPANY. Neither COMPANY nor any third-party provider of information guarantees the accuracy, completeness, or usefulness of any content. Furthermore, COMPANY neither endorses nor is responsible for the accuracy and reliability of any opinion, advice, or statement made on any of the Sites by anyone other than an authorized COMPANY representative while acting in his/her official capacity.
THE INFORMATION, PRODUCTS AND SERVICES OFFERED ON OR THROUGH THE SITE AND BY COMPANY AND ANY THIRD-PARTY SITES ARE PROVIDED “AS IS” AND WITHOUT WARRANTIES OF ANY KIND EITHER EXPRESS OR IMPLIED. TO THE FULLEST EXTENT PERMISSIBLE PURSUANT TO APPLICABLE LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. WE DO NOT WARRANT THAT THE SITE OR ANY OF ITS FUNCTIONS WILL BE UNINTERRUPTED OR ERROR-FREE, THAT DEFECTS WILL BE CORRECTED, OR THAT ANY PART OF THIS SITE, INCLUDING BULLETIN BOARDS, OR THE SERVERS THAT MAKE IT AVAILABLE, ARE FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS.
WE DO NOT WARRANT OR MAKE ANY REPRESENTATIONS REGARDING THE USE OR THE RESULTS OF THE USE OF THE SITE OR MATERIALS ON THIS SITE OR ON THIRD-PARTY SITES IN TERMS OF THEIR CORRECTNESS, ACCURACY, TIMELINESS, RELIABILITY OR OTHERWISE.
You agree at all times to defend, indemnify and hold harmless COMPANY its affiliates, their successors, transferees, assignees and licensees and their respective parent and subsidiary companies, agents, associates, officers, directors, shareholders and employees of each from and against any and all claims, causes of action, damages, liabilities, costs and expenses, including legal fees and expenses, arising out of or related to your breach of any obligation, warranty, representation or covenant set forth herein
Online Commerce
Certain sections of the Site may allow you to purchase many different types of products and services online that are provided by third parties. We are not responsible for the quality, accuracy, timeliness, reliability or any other aspect of these products and services. If you make a purchase from a merchant on the Site or on a site linked to by the Site, the information obtained during your visit to that merchant’s online store or site, and the information that you give as part of the transaction, such as your credit card number and contact information, may be collected by both the merchant and us. A merchant may have privacy and data collection practices that are different from ours. We have no responsibility or liability for these independent policies. In addition, when you purchase products or services on or through the Site, you may be subject to additional terms and conditions that specifically apply to your purchase or use of such products or services. For more information regarding a merchant, its online store, its privacy policies, and/or any additional terms and conditions that may apply, visit that merchant’s website and click on its information links or contact the merchant directly. You release us and our affiliates from any damages that you incur, and agree not to assert any claims against us or them, arising from your purchase or use of any products or services made available by third parties through the site.
Your participation, correspondence or business dealings with any third party found on or through our Site, regarding payment and delivery of specific goods and services, and any other terms, conditions, representations or warranties associated with such dealings, are solely between you and such third party. You agree that COMPANY shall not be responsible or liable for any loss, damage, or other matters of any sort incurred as the result of such dealings.
You agree to be financially responsible for all purchases made by you or someone acting on your behalf through the Site. You agree to use the Site and to purchase services or products through the Site for legitimate, non-commercial purposes only. You also agree not to make any purchases for speculative, false or fraudulent purposes or for the purpose of anticipating demand for a particular product or service. You agree to only purchase goods or services for yourself or for another person for whom you are legally permitted to do so. When making a purchase for a third party that requires you to submit the third party’s personal information to us or a merchant, you represent that you have obtained the express consent of such third party to provide such third party’s personal information.
Interactive Features
This Site may include a variety of features, such as bulletin boards, web logs, chat rooms, and email services, which allow feedback to us and real-time interaction between users, and other features which allow users to communicate with others. Responsibility for what is posted on bulletin boards, web logs, chat rooms, and other public posting areas on the Site, or sent via any email services on the Site, lies with each user – you alone are responsible for the material you post or send. We do not control the messages, information or files that you or others may provide through the Site. It is a condition of your use of the Site that you do not:
Restrict or inhibit any other user from using and enjoying the Site.
Use the Site to impersonate any person or entity, or falsely state or otherwise misrepresent your affiliation with a person or entity.
Interfere with or disrupt any servers or networks used to provide the Site or its features, or disobey any requirements, procedures, policies or regulations of the networks we use to provide the Site.
Use the Site to instigate or encourage others to commit illegal activities or cause injury or property damage to any person.
Gain unauthorized access to the Site, or any account, computer system, or network connected to this Site, by means such as hacking, password mining or other illicit means.
Obtain or attempt to obtain any materials or information through any means not intentionally made available through this Site.
Use the Site to post or transmit any unlawful, threatening, abusive, libelous, defamatory, obscene, vulgar, pornographic, profane or indecent information of any kind, including without limitation any transmissions constituting or encouraging conduct that would constitute a criminal offense, give rise to civil liability or otherwise violate any local, state, national or international law.
Use the Site to post or transmit any information, software or other material that violates or infringes upon the rights of others, including material that is an invasion of privacy or publicity rights or that is protected by copyright, trademark or other proprietary right, or derivative works with respect thereto, without first obtaining permission from the owner or rights holder.
Use the Site to post or transmit any information, software or other material that contains a virus or other harmful component.
Use the Site to post, transmit or in any way exploit any information, software or other material for commercial purposes, or that contains advertising.
Use the Site to advertise or solicit to anyone to buy or sell products or services, or to make donations of any kind, without our express written approval.
Gather for marketing purposes any email addresses or other personal information that has been posted by other users of the Site.
COMPANY may host message boards, chats and other private/public forums on its Sites and on other platforms. Any user failing to comply with the terms and conditions of this Agreement may be expelled from and refused continued access to, the message boards, groups, chats or other such forums in the future. COMPANY or its designated agents may remove or alter any user-created content at any time for any reason. Message boards, chats and other public forums are intended to serve as discussion centers for users and subscribers. Information and content posted within these public forums may be provided by COMPANY staff, COMPANY’s outside contributors, or by users not connected with COMPANY, some of whom may employ anonymous user names. COMPANY expressly disclaims all responsibility and endorsement and makes no representation as to the validity of any opinion, advice, information or statement made or displayed in these forums by third parties, nor are we responsible for any errors or omissions in such postings, or for hyperlinks embedded in any messages. Under no circumstances will we, our affiliates, suppliers or agents be liable for any loss or damage caused by your reliance on information obtained through these forums. The opinions expressed in these forums are solely the opinions of the participants, and do not reflect the opinions of COMPANY or any of its subsidiaries or affiliates.
COMPANY has no obligation whatsoever to monitor any of the content or postings on the message boards, chat rooms or other public forums on the Sites. However, you acknowledge and agree that we have the absolute right to monitor the same at our sole discretion. In addition, we reserve the right to alter, edit, refuse to post or remove any postings or content, in whole or in part, for any reason and to disclose such materials and the circumstances surrounding their transmission to any third party in order to satisfy any applicable law, regulation, legal process or governmental request and to protect ourselves, our clients, sponsors, users and visitors.
Registration
To access certain features of the Site, we may ask you to provide certain demographic information including your gender, year of birth, zip code and country. In addition, if you elect to sign-up for a particular feature of the Site, such as chat rooms, web logs, or bulletin boards, you may also be asked to register with us on the form provided and such registration may require you to provide personally identifiable information such as your name and email address. You agree to provide true, accurate, current and complete information about yourself as prompted by the Site’s registration form. If we have reasonable grounds to suspect that such information is untrue, inaccurate, or incomplete, we have the right to suspend or terminate your account and refuse any and all current or future use of the Site (or any portion thereof). Our use of any personally identifiable information you provide to us as part of the registration process is governed by the terms of our Privacy Policy.
Passwords
To use certain features of the Site, you will need a username and password, which you will receive through the Site’s registration process. You are responsible for maintaining the confidentiality of the password and account, and are responsible for all activities (whether by you or by others) that occur under your password or account. You agree to notify us immediately of any unauthorized use of your password or account or any other breach of security, and to ensure that you exit from your account at the end of each session. We cannot and will not be liable for any loss or damage arising from your failure to protect your password or account information.
UNDER NO CIRCUMSTANCES, INCLUDING, BUT NOT LIMITED TO, NEGLIGENCE, SHALL WE, OUR SUBSIDIARY AND PARENT COMPANIES OR AFFILIATES BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES THAT RESULT FROM THE USE OF, OR THE INABILITY TO USE, THE SITE, INCLUDING OUR MESSAGING, BLOGS, COMMENTS OF OTHERS, BOOKS, EMAILS, PRODUCTS, OR SERVICES, OR THIRD-PARTY MATERIALS, PRODUCTS, OR SERVICES MADE AVAILABLE THROUGH THE SITE OR BY US IN ANY WAY, EVEN IF WE ARE ADVISED BEFOREHAND OF THE POSSIBILITY OF SUCH DAMAGES. (BECAUSE SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF CERTAIN CATEGORIES OF DAMAGES, THE ABOVE LIMITATION MAY NOT APPLY TO YOU. IN SUCH STATES, OUR LIABILITY AND THE LIABILITY OF OUR SUBSIDIARY AND PARENT COMPANIES OR AFFILIATES IS LIMITED TO THE FULLEST EXTENT PERMITTED BY SUCH STATE LAW.) YOU SPECIFICALLY ACKNOWLEDGE AND AGREE THAT WE ARE NOT LIABLE FOR ANY DEFAMATORY, OFFENSIVE OR ILLEGAL CONDUCT OF ANY USER. IF YOU ARE DISSATISFIED WITH THE SITE, ANY MATERIALS, PRODUCTS, OR SERVICES ON THE SITE, OR WITH ANY OF THE SITE’S TERMS AND CONDITIONS, YOUR SOLE AND EXCLUSIVE REMEDY IS TO DISCONTINUE USING THE SITE AND THE PRODUCTS, SERVICES AND/OR MATERIALS.
THIS SITE IS CONTINUALLY UNDER DEVELOPMENT AND COMPANY MAKES NO WARRANTY OF ANY KIND, IMPLIED OR EXPRESS, AS TO ITS ACCURACY, COMPLETENESS OR APPROPRIATENESS FOR ANY PURPOSE.
WITH REGARDS TO CONTENT RELATING TO HEALTH & WELLNESS ON THE SITE:
THIS SITE OFFERS HEALTH, WELLNESS, FITNESS AND NUTRITIONAL INFORMATION AND IS DESIGNED FOR EDUCATIONAL PURPOSES ONLY. YOU SHOULD NOT RELY ON THIS INFORMATION AS A SUBSTITUTE FOR, NOR DOES IT REPLACE, PROFESSIONAL MEDICAL ADVICE, DIAGNOSIS, OR TREATMENT. IF YOU HAVE ANY CONCERNS OR QUESTIONS ABOUT YOUR HEALTH, YOU SHOULD ALWAYS CONSULT WITH A PHYSICIAN OR OTHER HEALTH-CARE PROFESSIONAL. DO NOT DISREGARD, AVOID OR DELAY OBTAINING MEDICAL OR HEALTH RELATED ADVICE FROM YOUR HEALTH-CARE PROFESSIONAL BECAUSE OF SOMETHING YOU MAY HAVE READ ON THIS SITE. THE USE OF ANY INFORMATION PROVIDED ON THIS SITE IS SOLELY AT YOUR OWN RISK.
NOTHING STATED OR POSTED ON THIS SITE OR AVAILABLE THROUGH ANY SERVICES ARE INTENDED TO BE, AND MUST NOT BE TAKEN TO BE, THE PRACTICE OF MEDICAL OR COUNSELING CARE. FOR PURPOSES OF THIS AGREEMENT, THE PRACTICE OF MEDICINE AND COUNSELING INCLUDES, WITHOUT LIMITATION, PSYCHIATRY, PSYCHOLOGY, PSYCHOTHERAPY, OR PROVIDING HEALTH CARE TREATMENT, INSTRUCTIONS, DIAGNOSIS, PROGNOSIS OR ADVICE.
Liability
(1) COMPANY undertakes to perform all agreed services carefully and to the best of his/her knowledge. There is no guarantee for success in the provision of the service in coaching or in programs, events and/or trainings.
By making an appointment or registering for programs, events and trainings, the client confirms that he/she is acting on his/her own responsibility. He/she acknowledges that he/she is fully responsible for his/her own physical and mental health.
The COMPANY will only pay damages for whatever legal reason:
a. In the case of intent or fraudulent misrepresentation in the full amount; in the case of gross negligence or failure despite an assumed guarantee only in the amount of the foreseeable damage that should have been prevented by the duty of care or the guarantee;
b. In other cases only from breach of an essential obligation, if the purpose of the contract is endangered thereby, from delay and impossibility, always limited to typical direct damages foreseeable at the time of conclusion of the contract and limited in amount to the total remuneration of the contract. The COMPANY is not liable for consequential damages caused by slight negligence, other indirect damages and loss of profit.
The objection of contributory negligence remains open. Liability for all other damages is excluded, whereby the legal liability for personal injury remains unaffected.
Insofar as claims for damages are due according to this paragraph, these shall become statute-barred within one year from the statutory commencement of the limitation period. This shall not apply in the case of liability due to intent, gross negligence, injury to life, body or health or fraudulent concealment of a defect.
Informed Consent to Services & Coaching Practice
The intention of this section is to help the Client become better informed so that they may give or withhold consent to undergo the healthy lifestyle recommendations after having an opportunity to discuss health and wellbeing concerns - including potential benefits and risks, options and alternatives.
The COMPANY offers genetic, health, wellness, lifestyle, pre & perinatal, and nutritional information and is provided for informational purposes only. A coaching session nor the material of any of the COMPANY programs, events or trainings are not a substitute for, nor does it replace, professional medical advice, diagnosis, or treatment. The Client agreed to always speak with his/her primary healthcare provider before taking any medication or nutritional supplement or using any treatment for a health problem. The Client agree to maintain direct contact with a licensed health care provider that is appropriate for the patient’s age, gender and known or suspected health conditions. Nothing available through any services offered by the COMPANY is intended to be, and must not be taken to be, the practice of medicine.
The Client acknowledge the opportunity to read and inquire about this consent and all the items addressed herein and hereby authorize the COMPANY, in accordance and within the scope and limits of her Holistic Health Coaching competences to recommend procedures including but not limited to: laboratory, ultrasound, functional laboratory testing, dietary advice and guidelines and the promotion of wellness including, but not limited to, recommendations for sleep, exercise, stress management and reduction, balancing of work and self-care activities, and developing and nurturing healthy relationships and community relationships. Functional nutrition, nutritional supplementation and vitamin, mineral, amino acid, lipid, phytonutrient, and metabolite precursor and other nutrient. Botanical herbs and plant derivatives prescribed as loose teas, alcohol or glycerin tinctures, capsules, tablets, creams, suppositories, etc. Physical interventions, massage, stretching, exercises, contrast heat/cold applications and manual or instrument-assisted joint mobilizations. Lifestyle and Wellness Counseling to promote improved lifestyle strategies and wellness, but not including the specific treatment of known or suspected mental illness.
The Client acknowledges the right, opportunity and responsibility to ask questions and to become informed regarding the COMPANY´s recommendations to his or her satisfaction. The Client acknowledges that all questions asked have been fully answered by the COMPANY.
The Client acknowledges and accepts that there are risks to the measures that may include: unintended exacerbation of symptoms, new symptoms, allergic and other unintended side effects from exercise, lifestyle modifications, dietary modifications, herbal and nutritional supplements, adverse interactions with drugs, herbs and/or nutrients. The specific risks associated with the proposed procedures have been explained to the Client.
The Client acknowledges that treatment may result in the restoration of health and wellbeing as of optimal functional capacity, relief of pain and symptoms, and prevention or reversal or disease of a condition progression, but ALSO acknowledges that no expressed or implied guarantees or representations can or have been made by the COMPANY or any affiliated staff regarding the cure or improvement of a Client´s condition.
The Client acknowledges that the COMPANY cannot know or anticipate and explain every possible detailed information on the health lifestyle recommendations, and that the Client or representative willingly chooses to rely on the COMPANY to exercise their best judgment for any of the above.
The Client agrees to alert the COMPANY should she suspect that she is or may be pregnant in acknowledgement that some of the lifestyle interventions and recommendations could present risks to a pregnancy.
The Client understands that is free to discontinue participation in any and all aspects of the recommendations provided by the COMPANY at any time, and that the Client is responsible for informing the COMPANY of the adherence to or discontinuation of any and all aspects of recommendations and that the choice to discontinue healthy lifestyle interventions may create the risk of adverse effects for which the patient or representative bears full and sole responsibility.
The Client understands he/she bears full responsibility for any adverse effects experienced during or after the course of implementing lifestyle changes that were reasonably deemed to be caused or related to a deficit in the full, accurate and timely disclosure of symptoms and other medical information to the Coach to the best of the Client´s ability.
Confidentiality
Offers, invitations to tender, coaching and counselling concepts, personally produced CDs, MP3 files, e-books, online documents and other documents made available to the client by the COMPANY are protected by copyright.
All documents, videos, audios, PDFs, e-books etc. handed over or made available to the client are exclusively for personal use.
The customer is not permitted to reproduce the documents or parts thereof and/or make them accessible to third parties. Publication - even in part - is prohibited and may be prosecuted.
Data Protection
The COMPANY will only process or use personal data of the client for contractually agreed purposes.
The data will be treated confidentially.
In all other respects, the COMPANY´s data protection declaration, which can be accessed via the internet address www. Lambretta-Lutz.de/Legal shall apply.
The Client expressly consents to his/her health data being processed by the COMPANY within the framework of the service. The consent also extends to the forwarding of health samples (saliva, urine, faeces etc.) for evaluation to the corresponding laboratories.
The declaration of consent is voluntary. The Client can refuse it without giving reasons and without having to fear any disadvantages because of this.
The above consent is valid until the Client revokes it. The Client can declare this revocation at any later time by telephone, in writing or per e-mail without giving reasons. Furthermore, the Client is entitled to the other rights outlined in the data protection information of the COMPANY.
The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation. Insofar as there is another legal basis for the further processing of the Client's data, the Coach is entitled to do so. Otherwise, the Client's data will be deleted upon revocation of consent.
The Client agrees that records of the services provided will be kept for a minimum of three, but no more than ten years after the date of the last appointment or consultation. The Client understands that his/her records will be kept securely and confidentially and without release to others unless so directed by the Client, or as may be required by law or as necessary for insurance claim or other payment processing.
The Client accepts that the COMPANY or associated staff may contact the Client (e.g. by phone, email, voicemail, SMS text message) to consult or exchange information related to the Clients records and care.
The Client agrees that the COMPANY may consult with preceptors and colleagues related to the case and care provided, without disclose of the Clients identity.
Final Provisions
Place of performance is the COMPANY´s registered office in Munich.
The invalidity of one of the above conditions does not affect the validity of the remaining conditions. In such a case, the COMPANY and the Client are obliged to effectively replace an invalid provision with one that comes closest to the economic purpose of the invalid provision.
Amendments and additions to contractual provisions must be made in writing in order to be effective and must be signed by an authorized representative of each party. This also applies to all amendments or waivers of the written form requirement.
Right of Cancellation & Refund Policy
When concluding a distance selling transaction, consumers generally have a statutory right of withdrawal.
The Client the right to withdraw from this contract within fourteen days without giving any reason.
In order to exercise your right of withdrawal, you must inform [Lutz Höppner, Am Lochholz 28a, 80999 Munich, info@Lambretta-Lutz.de, of your decision to withdraw from this contract by means of a clear declaration (e.g. a letter sent by post, fax or e-mail). You may use the enclosed model withdrawal form for this purpose, which is, however, not mandatory.
The withdrawal period is fourteen days from the day of the conclusion of the contract.
In order to comply with the revocation period, it is sufficient that you send the notification of the exercise of the right of revocation before the expiry of the revocation period.
The Client accept to pay the corresponding amount of the services already provided up to the time of notification of the exercise of the right of withdrawal with regard to this contract compared to the total scope of the services provided for in the contract.
No given services provided but paid will be refunded minus a processing fee of 15%. Shipping fees are not refundable.
Due to the fees we incur after the order of a test is placed, we are unable to offer refunds, returns or exchanges on test orders of any kind.
The Supplier shall provide information on the model withdrawal form in accordance with the statutory provisions as follows:
Model withdrawal form:
- To Lutz Höppner Am Lochholz 28a, 80999 Munich:
- I/we (*) hereby revoke the contract concluded by me/us (*) for the purchase of the following goods (*) for the purchase of the following goods (*)/ the provision of the following service (*)
- Ordered on (*)/received on (*)
- Name of the consumer(s)
- Address of the consumer(s)
- Signature of consumer(s) (only in case of paper communication)
- Date(s)
(*) Delete where inapplicable.
Additionaly, the Client acknowledge that the purchase or products or services through affiliated links and any transactions conducted via these links are governed by the individual terms, refund policies, and cancellation procedures established by the respective vendors or merchants. It's crucial to understand that the procedures for refunds, cancellations, and terms of purchases made through affiliate links are directly managed by third-party vendors or merchants and may not align with the policies articulated in this withdrawal policy.
Digital Millennium Copyright Act
The Digital Millennium Copyright Act of 1998 (the “DMCA”) provides recourse for copyright owners who believe that material appearing on the Internet infringes their rights. If you believe in good faith that materials hosted by COMPANY infringe your copyright, you, or your agent may send to COMPANY a notice requesting that the material be removed or access to it be blocked. Any notification by a copyright owner or a person authorized to act on its behalf that fails to comply with requirements of the DMCA shall not be considered sufficient notice and shall not be deemed to confer upon COMPANY actual knowledge of facts or circumstances from which infringing material or acts are evident. If you believe in good faith that a notice of copyright infringement has been wrongly filed against you, the DMCA permits you to send to COMPANY a counter-notice. All notices and counter notices must meet the then current statutory requirements imposed by the DMCA; see www.loc.gov/copyright for details. COMPANY’s Copyright Agent for notice shall be admin@Lambretta-Lutz.de
Assignment
This Agreement shall be binding upon and inure to the benefit of COMPANY and our respective assigns, successors, heirs, and legal representatives. Neither this Agreement nor any rights hereunder may be assigned without the prior written consent of COMPANY Notwithstanding the foregoing, all rights and obligations under this Agreement may be freely assigned by COMPANY to any affiliated entity or any of its wholly owned subsidiaries.
Dispute Resolution
The law of the Federal Republic of Germany shall apply to the exclusion of the UN Convention on Contracts for the International Sale of Goods. If the customer is a consumer and has his habitual residence in another country at the time of his order, the application of mandatory legal provisions of this country shall remain unaffected by the choice of law.
2) If the Customer is a merchant, the exclusive place of jurisdiction for all disputes arising directly or indirectly from the contractual relationship shall be the registered office of COMPANY in Munich. However, the COMPANY is also entitled to take legal action at the Customer's place of business.
Class Action Waiver
You may only resolve disputes with us on an individual basis, and may not bring a claim as a plaintiff or a class member in a class, consolidated, or representative action. Class arbitrations, class actions, private attorney general actions, and consolidation with other arbitrations aren’t allowed.
The arbitrator may not consolidate more than one person’s claims, and may not otherwise preside over any form of a class or representative proceeding or claims (such as a class action, consolidated action or private attorney general action) unless all relevant parties specifically agree to do so following initiation of the arbitration.
Severability
If any clause within these Terms of Service (other than the Class Action Waiver clause above) is found to be illegal or unenforceable, that clause will be severed from these Terms of Service, and the remainder of these Terms of Service will be given full force and effect. If the Class Action Waiver clause is found to be illegal or unenforceable, this entire Provision will be unenforceable and the dispute will be decided by a court
Privacy Policy
Updated January, 2021
The following Privacy Policy governs the online information collection practices of Lambretta-Lutz.de (“Lutz” “we” or “us”). Specifically, it outlines the types of information that we gather about you while you are using the www.Lambretta-Lutz.de website (the “Site”), and the ways in which we use this information. This Privacy Policy, including our children’s privacy statement, does not apply to any information you may provide to us or that we may collect offline and/or through other means (for example, at a live event, via telephone, or through the mail).
Please read this Privacy Policy carefully. By visiting and using the Site, you agree that your use of our Site, and any dispute over privacy, is governed by this Privacy Policy. Because the Web is an evolving medium, we may need to change our Privacy Policy at some point in the future, in which case we’ll post the changes to this Privacy Policy on this website and update the Effective Date of the policy to reflect the date of the changes. By continuing to use the Site after we post any such changes, you accept the Privacy Policy as modified.
How We Collect and Use Information
We may collect and store personal or other information that you voluntarily supply to us online while using the Site (e.g., while on the Site or in responding via email to a feature provided on the Site). The Site only contacts individuals who specifically request that we do so or in the event that they have signed up to receive our messaging, attended one of our events, or have purchased one of our products. The Site collects personally identifying information from our users during online registration and online purchasing. Generally, this information includes name and e-mail address for registration or opt-in purposes and name, postal address, and credit card information when registering for our events or purchasing our products. All of this information is provided to us by you.
We also collect and store information that is generated automatically as you navigate online through the Site. For example, we may collect information about your computer’s connection to the Internet, which allows us, among other things, to improve the delivery of our web pages to you and to measure traffic on the Site. We also may use a standard feature found in browser software called a “cookie” to enhance your experience with the Site. Cookies are small files that your web browser places on your hard drive for record-keeping purposes. By showing how and when visitors use the Site, cookies help us deliver advertisements, identify how many unique users visit us, and track user trends and patterns. They also prevent you from having to re-enter your preferences on certain areas of the Site where you may have entered preference information before. The Site also may use web beacons (single-pixel graphic files also known as “transparent GIFs”) to access cookies and to count users who visit the Site or open HTML-formatted email messages.
We use the information we collect from you while you are using the Site in a variety of ways, including using the information to customize features; advertising that appear on the Site; and, making other offers available to you via email, direct mail or otherwise. We also may provide your information to third parties, such as service providers, contractors and third-party publishers and advertisers for a variety of purposes. Unless you inform us in accordance with the process described below, we reserve the right to use, and to disclose to third parties, all of the information collected from and about you while you are using the Site in any way and for any purpose, such as to enable us or a third party to provide you with information about products and services. If you do not wish your information to be used for these purposes, you must send a letter to the Online Privacy Coordinator whose address is listed at the end of this Privacy Policy requesting to be taken off any lists of information that may be used for these purposes or that may be given or sold to third-parties.
Please keep in mind that whenever you voluntarily make your personal information available for viewing by third parties online – for example on message boards, web logs, through email, or in chat areas – that information can be seen, collected and used by others besides us. We cannot be responsible for any unauthorized third-party use of such information.
Be aware that we may occasionally release information about our visitors when release is appropriate to comply with law or to protect the rights, property or safety of users of the Site or the public.
Please also note that as our business grows, we may buy or sell various assets. In the unlikely event that we sell some or all of our assets, or one or more of our websites is acquired by another company, information about our users may be among the transferred assets.
Google Analytics
We also use Google Analytics Advertiser Features to optimize our business. Advertiser features include:
Remarketing with Google Analytics
Google Display Network Impression Reporting
DoubleClick Platform integrations
Google Analytics Demographics and Interest Reporting
By enabling these Google Analytics Display features, we are required to notify our visitors by disclosing the use of these features and that we and third-party vendors use first-party cookies (such as the Google Analytics cookie) or other first-party identifiers, and third-party cookies (such as the DoubleClick cookie) or other third-party identifiers together to gather data about your activities on our Site. Among other uses, this allows us to contact you if you begin to fill out our check-out form but abandon it before completion with an email reminding you to complete your order. The “Remarketing” feature allows us to reach people who previously visited our Site, and match the right audience with the right advertising message.
You can opt out of Google’s use of cookies by visiting Google’s ad settings and/or you may opt out of a third-party vendor’s use of cookies by visiting the Network Advertising Initiative opt-out page.
General Data Privacy Regulation (GDPR)
The GDPR took effect on May 25, 2018, and is intended to protect the data of European Union (EU) citizens.
If the data that you provide to us in the course of your use of our site, content, products and/or services is governed by GDPR, we will abide by the relevant portions of the Regulation.
If you are a resident of the European Economic Area (EEA), or are accessing this site from within the EEA, you may have the right to request: access to, correction of, deletion of; portability of; and restriction or objection to processing, of your personal data, from us. This includes the “right to be forgotten.”
To make any of these requests, please contact our GDPR contact: admin@Lambretta-Lutz.de
California Consumer Privacy Act (CCPA)
The CCPA took effect on January 1, 2020, and is intended to protect the personal information of California residents.
The CCPA has certain threshold requirements which a company must meet in order to be required to comply with its provisions. Upon information and belief, our company does not meet those thresholds. In the event of a change in our status, and if the data that you provide in the course of your use of our site, content, products and/or services is governed by CCPA, we will abide by the relevant portions of the Act.
If you are a resident of the state of California, you may have the right to: request disclosure of the personal information we have collected about you and the types of third parties with whom it has been shared; request a portable copy of your information; opt out from marketing messages or the sale of your information to third parties; and request deletion of your personal information.
To make these requests, please contact our CCPA contact at admin@Lambretta-Lutz.de
Children's Privacy Statement
This children’s privacy statement explains our practices with respect to the online collection and use of personal information from children, and provides important information regarding their rights under federal law with respect to such information.
This Site is not directed to children and we do NOT knowingly collect personally identifiable information from children as part of the Site. If we become aware that we have inadvertently received personally identifiable information from a user under age as part of the Site, we will delete such information from our records. If we change our practices in the future, we will obtain prior, verifiable parental consent before collecting any personally identifiable information from children as part of the Site.
Because we do not collect any personally identifiable information from children as part of the Site, we also do NOT knowingly distribute such information to third parties.
Because we do not collect any personally identifiable information from children as part of the Site, we do NOT condition the participation of a child in the Site’s online activities on providing personally identifiable information.
Confidentiality
Offers, invitations to tender, coaching and counselling concepts, personally produced CDs, MP3 files, e-books, online documents and other documents made available to the client by the COMPANY are protected by copyright.
All documents, videos, audios, PDFs, e-books etc. handed over or made available to the client are exclusively for personal use.
The customer is not permitted to reproduce the documents or parts thereof and/or make them accessible to third parties. Publication - even in part - is prohibited and may be prosecuted.
Data Protection
The COMPANY will only process or use personal data of the client for contractually agreed purposes.
The data will be treated confidentially.
In all other respects, the COMPANY´s data protection declaration, which can be accessed via the internet address www. Lambretta-Lutz.de/privacypolicy shall apply.
The Client expressly consents to his/her health data being processed by the COMPANY within the framework of the service. The consent also extends to the forwarding of health samples (saliva, urine, faeces etc.) for evaluation to the corresponding laboratories.
The declaration of consent is voluntary. The Client can refuse it without giving reasons and without having to fear any disadvantages because of this.
The above consent is valid until the Client revokes it. The Client can declare this revocation at any later time by telephone, in writing or per e-mail without giving reasons. Furthermore, the Client is entitled to the other rights outlined in the data protection information of the COMPANY.
The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation. Insofar as there is another legal basis for the further processing of the Client's data, the Coach is entitled to do so. Otherwise, the Client's data will be deleted upon revocation of consent.
The Client agrees that records of the services provided will be kept for a minimum of three, but no more than ten years after the date of the last appointment or consultation. The Client understands that his/her records will be kept securely and confidentially and without release to others unless so directed by the Client, or as may be required by law or as necessary for insurance claim or other payment processing.
The Client accepts that the COMPANY or associated staff may contact the Client (e.g. by phone, email, voicemail, SMS text message) to consult or exchange information related to the Clients records and care.
The Client agrees that the COMPANY may consult with preceptors and colleagues related to the case and care provided, without disclose of the Clients identity.
Disclaimer
This policy may be changed at any time at our discretion. If we should update this policy, we will post the updates to this page on our Website.
If you have any questions or concerns regarding our privacy policy please direct them to: admin@Lambretta-Lutz.de
Google Data Processing Terms
Updated September, 2023
Google and the counterparty agreeing to these terms (“Customer”) have entered into an agreement for the provision of the Processor Services (as amended from time to time, the “Agreement”).
These Google Ads Data Processing Terms (including the appendices, “Data Processing Terms”) are entered into by Google and Customer and supplement the Agreement. These Data Processing Terms will be effective, and replace any previously applicable terms relating to their subject matter (including any data processing amendment or data processing addendum relating to the Processor Services), from the Terms Effective Date.
If you are accepting these Data Processing Terms on behalf of Customer, you warrant that: (a) you have full legal authority to bind Customer to these Data Processing Terms; (b) you have read and understand these Data Processing Terms; and (c) you agree, on behalf of Customer, to these Data Processing Terms. If you do not have the legal authority to bind Customer, please do not accept these Data Processing Terms.
Introduction
These Data Processing Terms reflect the parties’ agreement on the terms governing the processing of Customer Personal Data.
2.Definitions and Interpretation
2.1In these Data Processing Terms:
“Additional Product” means a product, service or application provided by Google or a third party that: (a) is not part of the Processor Services; and (b) is accessible for use within the user interface of the Processor Services or is otherwise integrated with the Processor Services.
“Additional Terms” means the additional terms referred to in Appendix 3, which reflect the parties’ agreement on the terms governing the processing of Customer Personal Data in connection with certain Applicable Data Protection Legislation.
“Affiliate” means an entity that directly or indirectly controls, is controlled by, or is under common control with, a party.
“Applicable Data Protection Legislation” means, as applicable to the processing of Customer Personal Data, any national, federal, EU, state, provincial or other privacy, data security or data protection law or regulation including European Data Protection Legislation, the LGPD and US State Privacy Laws.
“Customer Personal Data” means personal data that is processed by Google on behalf of Customer in Google’s provision of the Processor Services.
“Data Incident” means a breach of Google’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data on systems managed by or otherwise controlled by Google. “Data Incidents” will not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.
“Data Subject Tool” means a tool (if any) made available by a Google Entity to data subjects that enables Google to respond directly and in a standardised manner to certain requests from data subjects in relation to Customer Personal Data (for example, online advertising settings or an opt-out browser plugin).
“EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
“European Data Protection Legislation” means, as applicable: (a) the GDPR; and/or (b) the Swiss FDPA.
“GDPR” means, as applicable: (a) the EU GDPR; and/or (b) the UK GDPR.
“Google” means the Google Entity that is party to the Agreement.
“Google Entity” means Google LLC, Google Ireland Limited or any other Affiliate of Google LLC.
“Instructions” has the meaning given in Section 5.2 (Customer’s Instructions).
“ISO 27001 Certification” means ISO/IEC 27001:2013 certification or a comparable certification for the Processor Services.
“LGPD” means the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais).
“New Subprocessor” has the meaning given in Section 11.1 (Consent to Subprocessor Engagement).
“Notification Email Address” means the email address designated by Customer, via the user interface of the Processor Services or such other means provided by Google, to receive certain notifications from Google relating to these Data Processing Terms.
“Processor Services” means the applicable services listed at business.safety.google/adsservices.
“Security Documentation” means the certificate issued for the ISO 27001 Certification and any other security certifications or documentation that Google may make available in respect of the Processor Services.
“Security Measures” has the meaning given in Section 7.1.1 (Google’s Security Measures).
“Subprocessors” means third parties authorised under these Data Processing Terms to have logical access to and process Customer Personal Data in order to provide parts of the Processor Services and any related technical support.
“Swiss FDPA” means, as applicable, the Federal Data Protection Act of 19 June 1992 (Switzerland) (with the Ordinance to the Federal Data Protection Act of 14 June 1993), or the revised Federal Data Protection Act of 25 September 2020 (with the Ordinance to the Federal Data Protection Act of 31 August 2022).
“Term” means the period from the Terms Effective Date until the end of Google’s provision of the Processor Services under the Agreement.
“Terms Effective Date” means the date on which Customer clicked to accept or the parties otherwise agreed to these Data Processing Terms.
“UK GDPR” means the EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018, and applicable secondary legislation made under that Act.
“US State Privacy Laws” means, as applicable: (i) the California Consumer Privacy Act of 2018 (including as amended by the California Privacy Rights Act of 2020), together with all implementing regulations (“CCPA”); (ii) Virginia’s Consumer Data Protection Act, Va. Code Ann. § 59.1-571 et seq.; and (iii) the Colorado Privacy Act, Colo. Rev. Stat. § 6-1-1301 et seq.; (iv) Connecticut’s Act Concerning Data Privacy and Online Monitoring, Pub. Act No. 22015; and (v) the Utah Consumer Privacy Act, Utah Code Ann. § 13-61-101 et seq.
2.2The terms “controller”, “data subject”, “personal data”, “processing” and “processor” as used in these Data Processing Terms have the meanings given by either (a) Applicable Data Protection Legislation; or (b) absent any such meaning or law, the GDPR.
2.3The words “include” and “including” mean “including but not limited to”. Any examples in these Data Processing Terms are illustrative and not the sole examples of a particular concept.
2.4Any reference to a legal framework, statute or other legislative enactment is a reference to it as amended or re-enacted from time to time.
2.5To the extent any translated version of these Data Processing Terms is inconsistent with the English version, the English version will govern.
3.Duration of these Data Processing Terms
These Data Processing Terms will take effect on the Terms Effective Date. Regardless of whether the Agreement has terminated or expired, these Data Processing Terms will remain in effect until, and automatically expire when, Google deletes all Customer Personal Data as described in these Data Processing Terms.
4.Application of these Data Processing Terms
4.1General. These Data Processing Terms will only apply to the Processor Services for which the parties agreed to these Data Processing Terms, for example: (a) the Processor Services for which Customer clicked to accept these Data Processing Terms; or (b) if the Agreement incorporates these Data Processing Terms by reference, the Processor Services that are the subject of the Agreement.
4.2Incorporation of Additional Terms. The Additional Terms supplement these Data Processing Terms.
5.Processing of Data
5.1Roles and Regulatory Compliance; Authorisation.
5.1.1Processor and Controller Responsibilities. The parties acknowledge and agree that:
(a)Appendix 1 describes the subject matter and details of the processing of Customer Personal Data;
(b)Google is a processor of Customer Personal Data;
(c)Customer is a controller or processor, as applicable, of Customer Personal Data; and
(d)each party will comply with the obligations applicable to it under Applicable Data Protection Legislation with respect to the processing of Customer Personal Data.
5.1.2Processor Customers. If Customer is a processor:
(a)Customer warrants on an ongoing basis that the relevant controller has authorised: (i) the Instructions, (ii) Customer’s appointment of Google as another processor, and (iii) Google’s engagement of Subprocessors as described in Section 11 (Subprocessors);
(b)Customer will forward to the relevant controller promptly and without undue delay any notice provided by Google under Sections 7.2.1 (Incident Notification) or 11.4 (Opportunity to Object to Subprocessor Changes); and
(c)Customer may make available to the relevant controller any information made available by Google under Sections 7.4 (Security Certification), 10.2 (Data Centre Information) and 11.2 (Information about Subprocessors).
5.2Customer’s Instructions. By entering into these Data Processing Terms, Customer instructs Google to process Customer Personal Data only in accordance with applicable law: (a) to provide the Processor Services and any related technical support; (b) as further specified via Customer’s use of the Processor Services (including in the settings and other functionality of the Processor Services) and any related technical support; (c) as documented in the form of the Agreement (including these Data Processing Terms); and (d) as further documented in any other written instructions given by Customer and acknowledged by Google as constituting instructions for purposes of these Data Processing Terms (collectively, the “Instructions”).
5.3Google’s Compliance with Instructions. Google will comply with the Instructions unless prohibited by applicable laws, or such applicable laws require other processing.
5.4Additional Products. If Customer uses any Additional Product, the Processor Services may allow that Additional Product to access Customer Personal Data as required for the interoperation of the Additional Product with the Processor Services. For clarity, these Data Processing Terms do not apply to the processing of personal data in connection with the provision of any Additional Product used by Customer, including personal data transmitted to or from that Additional Product.
6.Data Deletion
6.1Deletion During Term.
6.1.1Processor Services With Deletion Functionality. During the Term, if:
(a)the functionality of the Processor Services includes the option for Customer to delete Customer Personal Data;
(b)Customer uses the Processor Services to delete certain Customer Personal Data; and
(c)the deleted Customer Personal Data cannot be recovered by Customer (for example, from the “trash”),
then Google will delete such Customer Personal Data from its systems as soon as reasonably practicable and within a maximum period of 180 days, unless applicable laws require storage.
6.1.2Processor Services Without Deletion Functionality. During the Term, if the functionality of the Processor Services does not include the option for Customer to delete Customer Personal Data, then Google will comply with:
(a)any reasonable request from Customer to facilitate such deletion, insofar as this is possible taking into account the nature and functionality of the Processor Services and unless applicable laws require storage; and
(b)the data retention practices described at policies.google.com/technologies/ads.
Google may charge a fee (based on Google’s reasonable costs) for any data deletion under Section 6.1.2(a). Google will provide Customer with further details of any applicable fee, and the basis of its calculation, in advance of any such data deletion.
6.2Deletion on Term Expiry. Customer instructs Google to delete all remaining Customer Personal Data (including existing copies) from Google’s systems at the end of the Term in accordance with applicable law. Google will comply with this instruction as soon as reasonably practicable and within a maximum period of 180 days, unless applicable laws require storage.
7.Data Security
7.1Google’s Security Measures and Assistance.
7.1.1Google’s Security Measures. Google will implement and maintain technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access as described in Appendix 2 (the “Security Measures”). As described in Appendix 2, the Security Measures include measures: (a) to encrypt personal data; (b) to help ensure the ongoing confidentiality, integrity, availability and resilience of Google’s systems and services; (c) to help restore timely access to personal data following an incident; and (d) for regular testing of effectiveness. Google may update or modify the Security Measures from time to time, provided that such updates and modifications do not result in the degradation of the overall security of the Processor Services.
7.1.2Access and Compliance. Google will: (a) authorise its employees, contractors and Subprocessors to access Customer Personal Data only as strictly necessary to comply with the Instructions; (b) take appropriate steps to ensure compliance with the Security Measures by its employees, contractors and Subprocessors to the extent applicable to their scope of performance; and (c) ensure that all persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
7.1.3Google’s Security Assistance. Google will (taking into account the nature of the processing of Customer Personal Data and the information available to Google) assist Customer in ensuring compliance with Customer’s (or, where Customer is a processor, the relevant controller’s) obligations relating to security of personal data and personal data breaches under Applicable Data Protection Legislation, by:
(a)implementing and maintaining the Security Measures in accordance with Section 7.1.1 (Google’s Security Measures);
(b)complying with the terms of Section 7.2 (Data Incidents); and
(c)providing Customer with the Security Documentation in accordance with Section 7.5 (Verifying Compliance) and the information contained in these Data Processing Terms.
7.2Data Incidents.
7.2.1Incident Notification. If Google becomes aware of a Data Incident, Google will:
(a)notify Customer of the Data Incident promptly and without undue delay; and
(b)promptly take reasonable steps to minimise harm and secure Customer Personal Data.
7.2.2Details of Data Incident. Notifications made under Section 7.2.1 (Incident Notification) will describe: the nature of the Data Incident including the Customer resources impacted; the measures Google has taken, or plans to take, to address the Data Incident and mitigate its potential risk; the measures, if any, Google recommends that Customer take to address the Data Incident; and details of a contact point where more information can be obtained. If it is not possible to provide all such information at the same time, Google’s initial notification will contain the information then available and further information will be provided without undue delay as it becomes available.
7.2.3Delivery of Notification. Google will deliver its notification of any Data Incident to the Notification Email Address or, at Google’s discretion (including if Customer has not provided a Notification Email Address), by other direct communication (for example, by phone call or an in-person meeting). Customer is solely responsible for providing the Notification Email Address and ensuring that the Notification Email Address is current and valid.
7.2.4Third Party Notifications. Customer is solely responsible for complying with incident notification laws applicable to Customer and fulfilling any third party notification obligations related to any Data Incident.
7.2.5No Acknowledgement of Fault by Google. Google’s notification of or response to a Data Incident under this Section 7.2 (Data Incidents) will not be construed as an acknowledgement by Google of any fault or liability with respect to the Data Incident.
7.3Customer’s Security Responsibilities and Assessment.
7.3.1Customer’s Security Responsibilities. Customer agrees that, without prejudice to Google’s obligations under Sections 7.1 (Google’s Security Measures and Assistance) and 7.2 (Data Incidents):
(a)Customer is responsible for its use of the Processor Services, including:
(i)making appropriate use of the Processor Services to ensure a level of security appropriate to the risk in respect of Customer Personal Data; and
(ii)securing the account authentication credentials, systems and devices Customer uses to access the Processor Services; and
(b)Google has no obligation to protect Customer Personal Data that Customer elects to store or transfer outside of Google’s and its Subprocessors’ systems.
7.3.2Customer’s Security Assessment. Customer acknowledges and agrees that the Security Measures implemented and maintained by Google as set out in Section 7.1.1 (Google’s Security Measures) provide a level of security appropriate to the risk in respect of Customer Personal Data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing of Customer Personal Data as well as the risks to individuals.
7.4Security Certification. To evaluate and help ensure the continued effectiveness of the Security Measures, Google will maintain the ISO 27001 Certification.
7.5Verifying Compliance. To demonstrate compliance by Google with its obligations under these Data Processing Terms, and to assist Customer in verifying Google’s compliance with (i) Customer’s Instructions; (ii) its obligations under these Data Processing Terms; and (iii) its obligations under Applicable Data Protection Legislation, Google will:
(a)make the Security Documentation available for review by Customer;
(b)provide the information contained in the Data Processing Terms; and
(c)provide or otherwise make available, in accordance with Google’s standard practices, other materials concerning the nature of the Processor Services and the processing of Customer Personal Data (for example, help centre materials). Customer may also verify Google’s compliance with its obligations under these Data Processing Terms by reviewing the certificate issued for the ISO 27001 Certification (which reflects the outcome of an audit conducted by a third party auditor).
8.Impact Assessments and Consultations
Google will (taking into account the nature of the processing and the information available to Google) assist Customer in ensuring compliance with Customer’s (or, where Customer is a processor, the relevant controller’s) obligations relating to data protection impact assessments and prior regulatory consultations under Applicable Data Protection Legislation, by:
(a)providing the Security Documentation in accordance with Section 7.5 (Verifying Compliance);
(b)providing the information contained in the Agreement (including these Data Processing Terms); and
(c)providing or otherwise making available, in accordance with Google’s standard practices, other materials concerning the nature of the Processor Services and the processing of Customer Personal Data (for example, help centre materials).
9.Data Subject Rights
9.1Responses to Data Subject Requests. If Google receives a request from a data subject in relation to Customer Personal Data, Customer authorises Google to, and Google hereby notifies Customer that it will:
(a)respond directly to the data subject’s request in accordance with the standard functionality of the Data Subject Tool (if the request is made via a Data Subject Tool); or
(b)advise the data subject to submit their request to Customer, and Customer will be responsible for responding to such request (if the request is not made via a Data Subject Tool).
9.2Google’s Data Subject Request Assistance. Google will assist Customer in fulfilling its (or, where Customer is a processor, the relevant controller’s) obligations under Applicable Data Protection Legislation to respond to requests for exercising the data subject’s rights, in all cases taking into account the nature of the processing of Customer Personal Data and, if applicable, Article 11 of the GDPR, by:
(a)providing the functionality of the Processor Services;
(b)complying with the commitments set out in Section 9.1 (Responses to Data Subject Requests); and
(c)if applicable to the Processor Services, making available Data Subject Tools.
9.3Rectification. If Customer becomes aware that any Customer Personal Data is inaccurate or outdated, Customer will be responsible for rectifying or deleting that data if required by Applicable Data Protection Legislation, including (where available) by using the functionality of the Processor Services.
10.Data Transfers
10.1Data Storage and Processing Facilities. Subject to any provisions applicable to data transfers set out in the Additional Terms, Google may process Customer Personal Data in any country in which Google or its Subprocessors maintain facilities.
10.2Data Centre Information. Information about the locations of Google data centres is available at www.google.com/about/datacenters/locations/.
11.Subprocessors
11.1Consent to Subprocessor Engagement. Customer specifically authorises the engagement as Subprocessors of those entities listed as of the Terms Effective Date at the URL specified in Section 11.2 (Information about Subprocessors). In addition, without prejudice to Section 11.4 (Opportunity to Object to Subprocessor Changes) Customer generally authorises the engagement of any other third parties as Subprocessors (“New Subprocessors”).
11.2Information about Subprocessors. Information about Subprocessors is available at business.safety.google/adssubprocessors.
11.3Requirements for Subprocessor Engagement. When engaging any Subprocessor, Google will:
(a)ensure via a written contract that the Subprocessor only accesses and uses Customer Personal Data to the extent required to perform the obligations subcontracted to it, and does so in accordance with the Agreement (including these Data Processing Terms); and
(b)remain fully liable for all obligations subcontracted to, and all acts and omissions of, the Subprocessor.
11.4Opportunity to Object to Subprocessor Changes.
(a)When any New Subprocessor is engaged during the Term, Google will, at least 30 days before the New Subprocessor processes any Customer Personal Data, inform Customer of the engagement (including the name and location of the relevant New Subprocessor and the activities it will perform) by sending an email to the Notification Email Address.
(b)Customer may object to any New Subprocessor by terminating the Agreement for convenience immediately upon written notice to Google, on condition that Customer provides such notice within 90 days of being informed of the engagement of the New Subprocessor as described in Section 11.4(a).
12.Contacting Google; Processing Records
12.1Contacting Google. Customer may contact Google in relation to the exercise of its rights under these Data Processing Terms via the methods described at privacy.google.com/businesses/processorsupport or via such other means as may be provided by Google from time to time. Google will provide prompt and reasonable assistance with Customer queries Google receives via such means, and that relate to the processing of Customer Personal Data under the Agreement.
12.2Google’s Processing Records. Google will keep appropriate documentation of its processing activities as required by Applicable Data Protection Legislation.
12.3Controller Requests. If Google receives a request or instruction via the methods described in Section 12.1 (or any other method) from a third party purporting to be a controller of Customer Personal Data, Google will advise the third party to contact Customer.
13.Liability
If the Agreement is governed by the laws of:
(a)a state of the United States of America, then, regardless of anything else in the Agreement, the total liability of either party towards the other party under or in connection with these Data Processing Terms will be limited to the maximum monetary or payment-based amount at which that party’s liability is capped under the Agreement (and therefore, any exclusion of indemnification claims from the Agreement’s limitation of liability will not apply to indemnification claims under the Agreement relating to the Applicable Data Protection Legislation); or
(b)a jurisdiction that is not a state of the United States of America, then the liability of the parties under or in connection with these Data Processing Terms will be subject to the exclusions and limitations of liability in the Agreement.
14.Effect of these Data Processing Terms
14.1Order of Precedence. If there is any conflict or inconsistency between the Additional Terms, the remainder of these Data Processing Terms and/or the remainder of the Agreement, then the following order of precedence will apply:
(a)the Additional Terms (if applicable);
(b)the remainder of these Data Processing Terms; and
(c)the remainder of the Agreement.
Subject to the amendments in these Data Processing Terms, the Agreement remains in full force and effect.
14.2No Effect on Controller Terms. These Data Processing Terms will not affect any separate terms between Google and Customer reflecting a controller-controller relationship for a service other than the Processor Services.
15.Changes to these Data Processing Terms
15.1Changes to URLs. From time to time, Google may change any URL referenced in these Data Processing Terms and the content at any such URL, except that Google may only change the list of potential Processor Services at business.safety.google/adsservices:
(a)to reflect a change to the name of a service;
(b)to add a new service; or
(c)to remove a service (or a feature of a service) where either: (i) all contracts for the provision of that service are terminated; (ii) Google has Customer’s consent; or (iii) the service, or a certain feature of the service, has been recategorised as a controller service.
15.2Changes to Data Processing Terms. Google may change these Data Processing Terms if the change:
(a)is expressly permitted by these Data Processing Terms, including as described in Section 15.1 (Changes to URLs);
(b)reflects a change in the name or form of a legal entity;
(c)is required to comply with applicable law, applicable regulation, a court order or guidance issued by a governmental regulator or agency, or reflects Google’s adoption of an Alternative Transfer Solution (as defined in Appendix 3A); or
(d)does not: (i) result in a degradation of the overall security of the Processor Services; (ii) expand the scope of, or remove any restrictions on, (x) in the case of the Additional Terms, Google’s rights to use or otherwise process the data in scope of the Additional Terms or (y) in the case of the remainder of these Data Processing Terms, Google’s processing of Customer Personal Data, as described in Section 5.3 (Google’s Compliance with Instructions); and (iii) otherwise have a material adverse impact on Customer’s rights under these Data Processing Terms, as reasonably determined by Google.
15.3Notification of Changes. If Google intends to change these Data Processing Terms under Section 15.2(c) or (d), Google will inform Customer at least 30 days (or such shorter period as may be required to comply with applicable law, applicable regulation, a court order or guidance issued by a governmental regulator or agency) before the change will take effect by either: (a) sending an email to the Notification Email Address; or (b) alerting Customer via the user interface for the Processor Services. If Customer objects to any such change, Customer may immediately terminate the Agreement for convenience by giving written notice to Google within 90 days of being informed by Google of the change.
Appendix 1: Subject Matter and Details of the Data Processing
Subject Matter
Google’s provision of the Processor Services and any related technical support to Customer.
Duration of the Processing
The Term plus the period from the end of the Term until deletion of all Customer Personal Data by Google in accordance with these Data Processing Terms.
Nature and Purpose of the Processing
Google will process (including, as applicable to the Processor Services and the Instructions collecting, recording, organising, structuring, storing, altering, retrieving, using, disclosing, combining, erasing and destroying) Customer Personal Data for the purpose of providing the Processor Services and any related technical support to Customer in accordance with these Data Processing Terms.
Types of Personal Data
Customer Personal Data may include the types of personal data described at business.safety.google/adsservices.
Categories of Data Subjects
Customer Personal Data will concern the following categories of data subjects:
data subjects about whom Google collects personal data in its provision of the Processor Services; and/or
data subjects about whom personal data is transferred to Google in connection with the Processor Services by, at the direction of, or on behalf of Customer.
Depending on the nature of the Processor Services, these data subjects may include individuals: (a) to whom online advertising has been, or will be, directed; (b) who have visited specific websites or applications in respect of which Google provides the Processor Services; and/or (c) who are customers or users of Customer’s products or services.
Appendix 2: Security Measures
As from the Terms Effective Date, Google will implement and maintain the Security Measures set out in this Appendix 2. Google may update or modify such Security Measures from time to time, provided that such updates and modifications do not result in the degradation of the overall security of the Processor Services.
1.Data Centre & Network Security
(a)Data Centres.
Infrastructure. Google maintains geographically distributed data centres. Google stores all production data in physically secure data centres.
Redundancy. Infrastructure systems have been designed to eliminate single points of failure and minimise the impact of anticipated environmental risks. Dual circuits, switches, networks or other necessary devices help provide this redundancy. The Processor Services are designed to allow Google to perform certain types of preventative and corrective maintenance without interruption. All environmental equipment and facilities have documented preventative maintenance procedures that detail the process for and frequency of performance in accordance with the manufacturer's or internal specifications. Preventative and corrective maintenance of the data centre equipment is scheduled through a standard process according to documented procedures.
Power. The data centre electrical power systems are designed to be redundant and maintainable without impact to continuous operations, 24 hours a day, and 7 days a week. In most cases, a primary as well as an alternate power source, each with equal capacity, is provided for critical infrastructure components in the data centre. Backup power is provided by various mechanisms such as uninterruptible power supply (UPS) batteries, which supply consistently reliable power protection during utility brownouts, blackouts, over voltage, under voltage, and out-of-tolerance frequency conditions. If utility power is interrupted, backup power is designed to provide transitory power to the data centre, at full capacity, for up to 10 minutes until the backup generator systems take over. The backup generators are capable of automatically starting up within seconds to provide enough emergency electrical power to run the data centre at full capacity typically for a period of days.
Server Operating Systems. Google servers use hardened operating systems which are customised for the unique server needs of the business. Data is stored using proprietary algorithms to augment data security and redundancy. Google employs a code review process to increase the security of the code used to provide the Processor Services and enhance the security products in production environments.
Business Continuity. Google replicates data over multiple systems to help to protect against accidental destruction or loss. Google has designed and regularly plans and tests its business continuity planning/disaster recovery programs.
Encryption Technologies. Google’s security policies mandate encryption at rest for all user data, including personal data. Data is often encrypted at multiple levels in Google’s production storage stack in data centres, including at the hardware level, without requiring any action by customers. Using multiple layers of encryption adds redundant data protection and allows Google to select the optimal approach based on application requirements. All personal data is encrypted at the storage level, generally using AES256. Google uses common cryptographic libraries which incorporate Google’s FIPS 140-2 validated module, to implement encryption consistently across the Processor Services.
(b)Networks & Transmission.
Data Transmission. Data centres are typically connected via high-speed private links to provide secure and fast data transfer between data centres. Further, Google encrypts data transmitted between data centres. This is designed to prevent data from being read, copied, altered or removed without authorisation during electronic transport. Google transfers data via Internet standard protocols.
External Attack Surface. Google employs multiple layers of network devices and intrusion detection to protect its external attack surface. Google considers potential attack vectors and incorporates appropriate purpose built technologies into external facing systems.
Intrusion Detection. Intrusion detection is intended to provide insight into ongoing attack activities and provide adequate information to respond to incidents. Google’s intrusion detection involves:
1.Tightly controlling the size and make-up of Google’s attack surface through preventative measures;
2.Employing intelligent detection controls at data entry points; and
3.Employing technologies that automatically remedy certain dangerous situations.
Incident Response. Google monitors a variety of communication channels for security incidents, and Google’s security personnel will react promptly to known incidents.
Encryption Technologies. Google makes HTTPS encryption (also referred to as TLS connection) available. Google servers support ephemeral elliptic curve Diffie Hellman cryptographic key exchange signed with RSA and ECDSA. These perfect forward secrecy (PFS) methods help protect traffic and minimise the impact of a compromised key, or a cryptographic breakthrough.
2.Access and Site Controls
(a)Site Controls.
On-site Data Centre Security Operation. Google’s data centres maintain an on-site security operation responsible for all physical data centre security functions 24 hours a day, 7 days a week. The on-site security operations personnel monitor Closed Circuit TV (“CCTV”) cameras and all alarm systems. On-site security operation personnel perform internal and external patrols of the data centre regularly.
Data Centre Access Procedures. Google maintains formal access procedures for allowing physical access to the data centres. The data centres are housed in facilities that require electronic card key access, with alarms that are linked to the on-site security operation. All entrants to the data centre are required to identify themselves as well as show proof of identity to on-site security operations. Only authorised employees, contractors and visitors are allowed entry to the data centres. Only authorised employees and contractors are permitted to request electronic card key access to these facilities. Data centre electronic card key access requests must be made in advance and in writing, and require the approval of authorised data centre personnel. All other entrants requiring temporary data centre access must: (i) obtain approval in advance from authorised data centre personnel for the specific data centre and internal areas they wish to visit; (ii) sign in at on-site security operations; and (iii) reference an approved data centre access record identifying the individual as approved.
On-site Data Centre Security Devices. Google’s data centres employ an electronic card key and biometric access control system that is linked to a system alarm. The access control system monitors and records each individual’s electronic card key and when they access perimeter doors, shipping and receiving, and other critical areas. Unauthorised activity and failed access attempts are logged by the access control system and investigated, as appropriate. Authorised access throughout the business operations and data centres is restricted based on zones and the individual’s job responsibilities. The fire doors at the data centres are alarmed. CCTV cameras are in operation both inside and outside the data centres. The positioning of the cameras has been designed to cover strategic areas including, among others, the perimeter, doors to the data centre building, and shipping/receiving. On-site security operations personnel manage the CCTV monitoring, recording and control equipment. Secure cables throughout the data centres connect the CCTV equipment. Cameras record on-site via digital video recorders 24 hours a day, 7 days a week. The surveillance records are retained for at least 7 days based on activity.
(b)Access Control.
Infrastructure Security Personnel. Google has, and maintains, a security policy for its personnel, and requires security training as part of the training package for its personnel. Google’s infrastructure security personnel are responsible for the ongoing monitoring of Google’s security infrastructure, the review of the Processor Services, and responding to security incidents.
Access Control and Privilege Management. Customer's administrators and users must authenticate themselves via a central authentication system or via a single sign on system in order to use the Processor Services.
Internal Data Access Processes and Policies – Access Policy. Google’s internal data access processes and policies are designed to prevent unauthorised persons and/or systems from gaining access to systems used to process personal data. Google aims to design its systems to: (i) only allow authorised persons to access data they are authorised to access; and (ii) ensure that personal data cannot be read, copied, altered or removed without authorisation during processing, use and after recording. The systems are designed to detect any inappropriate access. Google employs a centralised access management system to control personnel access to production servers, and only provides access to a limited number of authorised personnel. LDAP, Kerberos and a proprietary system utilising digital certificates are designed to provide Google with secure and flexible access mechanisms. These mechanisms are designed to grant only approved access rights to site hosts, logs, data and configuration information. Google requires the use of unique user IDs, strong passwords, two factor authentication and carefully monitored access lists to minimise the potential for unauthorised account use. The granting or modification of access rights is based on: the authorised personnel’s job responsibilities; job duty requirements necessary to perform authorised tasks; and a need to know basis. The granting or modification of access rights must also be in accordance with Google’s internal data access policies and training. Approvals are managed by workflow tools that maintain audit records of all changes. Access to systems is logged to create an audit trail for accountability. Where passwords are employed for authentication (e.g. login to workstations), password policies that follow at least industry standard practices are implemented. These standards include restrictions on password reuse and sufficient password strength.
3.Data
(a)Data Storage, Isolation & Authentication.
Google stores data in a multi-tenant environment on Google-owned servers. Data, the Processor Services database and file system architecture are replicated between multiple geographically dispersed data centres. Google logically isolates each customer's data. A central authentication system is used across all Processor Services to increase uniform security of data.
(b)Decommissioned Disks and Disk Destruction Guidelines.
Certain disks containing data may experience performance issues, errors or hardware failure that lead them to be decommissioned (“Decommissioned Disk”). Every Decommissioned Disk is subject to a series of data destruction processes (the “Data Destruction Guidelines”) before leaving Google’s premises either for reuse or destruction. Decommissioned Disks are erased in a multi-step process and verified complete by at least two independent validators. The erase results are logged by the Decommissioned Disk’s serial number for tracking. Finally, the erased Decommissioned Disk is released to inventory for reuse and redeployment. If, due to hardware failure, the Decommissioned Disk cannot be erased, it is securely stored until it can be destroyed. Each facility is audited regularly to monitor compliance with the Data Destruction Guidelines.
(c)Pseudonymous Data.
Online advertising data are commonly associated with online identifiers which on their own are considered ’pseudonymous’ (i.e. they cannot be attributed to a specific individual without the use of additional information). Google has a robust set of policies and technical and organisational controls in place to ensure the separation between pseudonymous data and personally identifiable user information (i.e. information that could be used on its own to directly identify, contact, or precisely locate an individual), such as a user’s Google account data. Google policies only allow for information flows between pseudonymous and personally identifiable data in strictly limited circumstances.
(d)Launch reviews.
Google conducts launch reviews for new products and features prior to launch. This includes a privacy review conducted by specially trained privacy engineers. In privacy reviews, privacy engineers ensure that all applicable Google policies and guidelines are followed, including but not limited to policies relating to pseudonymisation and data retention and deletion.
4.Personnel Security
Google personnel are required to conduct themselves in a manner consistent with the company’s guidelines regarding confidentiality, business ethics, appropriate usage, and professional standards. Google conducts reasonably appropriate background checks to the extent legally permissible and in accordance with applicable local labor law and statutory regulations.
Personnel are required to execute a confidentiality agreement and must acknowledge receipt of, and compliance with, Google’s confidentiality and privacy policies. Personnel are provided with security training. Personnel handling Customer Personal Data are required to complete additional requirements appropriate to their role. Google’s personnel will not process Customer Personal Data without authorisation.
5.Subprocessor Security
Before onboarding Subprocessors, Google conducts an audit of the security and privacy practices of Subprocessors to ensure Subprocessors provide a level of security and privacy appropriate to their access to data and the scope of the services they are engaged to provide. Once Google has assessed the risks presented by the Subprocessor, the Subprocessor is required to enter into appropriate security, confidentiality and privacy contract terms, subject to the requirements set out in Section 11.3 (Requirements for Subprocessor Engagement).
Appendix 3: Additional Terms for Applicable Data Protection Legislation
PART A - ADDITIONAL TERMS FOR EUROPEAN DATA PROTECTION LEGISLATION
1.Introduction
This Appendix 3A will only apply to the extent that the European Data Protection Legislation applies to the processing of Customer Personal Data.
2.Additional Definitions
2.1In this Appendix 3A:
“Adequate Country” means:
(a)for data processed subject to the EU GDPR: the EEA, or a country or territory recognized as ensuring adequate protection under the EU GDPR;
(b)for data processed subject to the UK GDPR: the UK, or a country or territory recognized as ensuring adequate protection under the UK GDPR and the Data Protection Act 2018; and/or
(c)for data processed subject to the Swiss FDPA: Switzerland, or a country or territory that is: (i) included in the list of the states whose legislation ensures adequate protection as published by the Swiss Federal Data Protection and Information Commissioner, or (ii) recognized as ensuring adequate protection by the Swiss Federal Council under the Swiss FDPA,
in each case, other than on the basis of an optional data protection framework.
“Alternative Transfer Solution” means a solution, other than SCCs, that enables the lawful transfer of personal data to a third country in accordance with European Data Protection Legislation, for example a data protection framework recognized as ensuring that participating entities provide adequate protection.
“Customer SCCs” means the SCCs (Controller-to-Processor), the SCCs (Processor-to-Controller), and/or the SCCs (Processor-to-Processor), as applicable.
“EEA” means the European Economic Area.
“European Laws” means, as applicable: (a) EU or EU Member State law (if the EU GDPR applies to the processing of Customer Personal Data); (b) the law of the UK or a part of the UK (if the UK GDPR applies to the processing of Customer Personal Data); and (c) the law of Switzerland (if the Swiss FDPA applies to the processing of Customer Personal Data).
“SCCs” means the Customer SCCs and/or SCCs (Processor-to-Processor, Google Exporter), as applicable.
“SCCs (Controller-to-Processor)” means the terms at business.safety.google/adsprocessorterms/sccs/c2p.
“SCCs (Processor-to-Controller)” means the terms at business.safety.google/adsprocessorterms/sccs/p2c.
“SCCs (Processor-to-Processor)” means the terms at business.safety.google/adsprocessorterms/sccs/p2p.
“SCCs (Processor-to-Processor, Google Exporter)” means the terms at business.safety.google/adsprocessorterms/sccs/p2p-intra-group.
“Supervisory Authority” means, as applicable: (a) a “supervisory authority” as defined in the EU GDPR; and/or (b) the “Commissioner” as defined in the UK GDPR and/or the Swiss FDPA.
2.2The terms “data importer” and “data exporter” have the meanings given in the applicable SCCs.
3.Processor Customers. If Customer is a processor, Customer will forward to the relevant controller promptly and without undue delay, any notice that refers to any SCCs.
4.European Laws. Where European Data Protection Legislation applies to Google’s processing of Customer Personal Data, references to “applicable laws” in Sections 5.3 (Google’s Compliance with Instructions), 6.1.1 (Processor Services with Deletion Functionality), 6.1.2(a) (Processor Services without Deletion Functionality) and Section 6.2 (Deletion on Term Expiry), means “European Laws.”
5.Instruction Notifications. Google will immediately notify Customer if, in Google’s opinion: (a) European Laws prohibit Google from complying with an Instruction; (b) an Instruction does not comply with European Data Protection Legislation; or (c) Google is otherwise unable to comply with an Instruction, in each case unless such notice is prohibited by European Law. If Customer is a processor, Customer will immediately forward to the relevant controller any notice provided by Google under this paragraph. This paragraph 5 (Instruction Notifications) does not reduce either party’s rights and obligations elsewhere in the Agreement.
6.Audits of Compliance
6.1Customer’s Audit Rights.
(a)Google will allow Customer or a third party auditor appointed by Customer to conduct audits (including inspections) to verify Google’s compliance with its obligations under these Data Processing Terms in accordance with paragraph 6.2 (Additional Business Terms for Audits) of this Appendix 3A. During an audit, Google will make available all information necessary to demonstrate such compliance and contribute to the audits as described in Section 7.4 (Security Certification) and paragraph 6 (Audits of Compliance) of this Appendix 3A.
(b)If the SCCs apply under paragraph 7.1 (Restricted European Transfers) of this Appendix 3A, Google will allow Customer (or a third-party auditor appointed by Customer) to conduct audits as described in the SCCs and, during the audit, make available all information required by the SCCs, each in accordance with paragraph 6.2 (Additional Business Terms for Audits) of this Appendix 3A .
6.2Additional Business Terms for Audits.
(a)Customer will send any request for an audit under paragraph 6.1(a) or 6.1(b) of this Appendix 3A to Google as described in Section 12.1 (Contacting Google).
(b)Following receipt by Google of a request under paragraph 6.2(a) of this Appendix 3A, Google and Customer will discuss and agree in advance on the reasonable start date, scope and duration of, and security and confidentiality controls applicable to, any audit under paragraphs 6.1(a) or 6.1(b) of this Appendix 3A.
(c)Google may charge a fee (based on Google’s reasonable costs) for any audit under paragraphs 6.1(a) or 6.1(b) of this Appendix 3A. Google will provide Customer with further details of any applicable fee, and the basis of its calculation, in advance of any such audit. Customer will be responsible for any fees charged by any third party auditor appointed by Customer to execute any such audit.
(d)Google may object to any third party auditor appointed by Customer to conduct any audit under paragraph 6.1(a) or 6.1(b) of this Appendix 3A if the auditor is, in Google’s reasonable opinion, not suitably qualified or independent, a competitor of Google or otherwise manifestly unsuitable. Any such objection by Google will require Customer to appoint another auditor or conduct the audit itself.
(e)Nothing in these Data Processing Terms will require Google either to disclose to Customer or its third party auditor, or to allow Customer or its third party auditor to access: (i) any data of any other customer of a Google Entity; (ii) any Google Entity’s internal accounting or financial information; (iii) any trade secret of a Google Entity; (iv) any information that, in Google's reasonable opinion, could: (A) compromise the security of any Google Entity’s systems or premises; or (B) cause any Google Entity to breach its obligations under the European Data Protection Legislation or its security and/or privacy obligations to Customer or any third party; or (v) any information that Customer or its third party auditor seeks to access for any reason other than the good faith fulfilment of Customer’s obligations under the European Data Protection Legislation.
7.Data Transfers
7.1Restricted European Transfers. The parties acknowledge that European Data Protection Legislation does not require SCCs or an Alternative Transfer Solution in order to process Customer Personal Data in or transfer it to an Adequate Country. If Customer Personal Data is transferred to any other country, and European Data Protection Legislation applies to the transfers (“Restricted European Transfers”), then:
(a)if Google has adopted an Alternative Transfer Solution for any Restricted European Transfers, then Google will inform Customer of the relevant solution and ensure that such Restricted European Transfers are made in accordance with that solution; and/or
(b)if Google has not adopted, or informs Customer that Google is no longer adopting an Alternative Transfer Solution for any Restricted European Transfers, then:
(i)if Google’s address is in an Adequate Country:
(A)the SCCs (Processor-to-Processor, Google Exporter) will apply with respect to such Restricted European Transfers from Google to Subprocessors; and
(B)in addition, if Customer’s address is not in an Adequate Country, the SCCs (Processor-to-Controller) will apply with respect to Restricted European Transfers between Google and Customer (regardless of whether Customer is a controller and/or a processor); or
(ii)if Google’s address is not in an Adequate Country, the SCCs (Controller-to-Processor) and/or SCCs (Processor-to-Processor) will apply (according to whether Customer is a controller and/or processor) with respect to such Restricted European Transfers between Customer and Google.
7.2Supplementary Measures and Information. Google will provide Customer with information relevant to Restricted European Transfers, including information about supplementary measures to protect Customer Personal Data, as described in Section 7.5 (Verifying Compliance), Appendix 2 (Security Measures) and other materials concerning the nature of the Processor Services and the processing of Customer Personal Data (for example, help centre articles).
7.3Termination. If Customer concludes, based on its current or intended use of the Processor Services, that the Alternative Transfer Solution and/or SCCs, as applicable, do not provide appropriate safeguards for Customer Personal Data, then Customer may immediately terminate the Agreement for convenience by notifying Google in writing.
7.4Alternative Transfer Solution Adoption and Certification. Information about Google and/or its Affiliates’ adoption of, or certification under, any Alternative Transfer Solutions can be found at https://business.safety.google/adsdatatransfers.
8.Subprocessors. When engaging any Subprocessor, Google will ensure via a written contract that if the processing of Customer Personal Data is subject to European Data Protection Legislation, the data protection obligations in these Data Processing Terms (as referred to in Article 28(3) of the GDPR, if applicable) are imposed on the Subprocessor.
9.Google’s Processing Records.
Customer acknowledges that Google is required under the GDPR to:
(a)collect and maintain records of certain information, including: (i) the name and contact details of each processor and/or controller on behalf of which Google is acting and (if applicable) of such processor’s or controller's local representative and data protection officer, and (ii) if applicable under the Customer SCCs, Customer’s Supervisory Authority; and
(b)make such information available to any Supervisory Authority. Accordingly, Customer will, where requested and as applicable to Customer, provide such information to Google via the user interface of the Processor Services or via such other means as may be provided by Google, and will use such user interface or other means to ensure that all information provided is kept accurate and up-to-date.
10.SCCs
10.1Order of Precedence. If there is any conflict or inconsistency between the Customer SCCs and this Appendix 3A, the remainder of these Data Processing Terms or the remainder of the Agreement, then the Customer SCCs will prevail.
10.2No Modification of SCCs. Nothing in the Agreement (including these Data Processing Terms) is intended to modify or contradict any SCCs or prejudice the fundamental rights or freedoms of data subjects under the European Data Protection Legislation.
11.Changes to SCCs. Google may only change the SCCs in accordance with Sections 15.2(b) - 15.2(d) (Changes to Data Processing Terms) or to incorporate any new version of the SCCs that may be adopted under the European Data Protection Legislation, in each case in a manner that does not affect the validity of the SCCs under the European Data Protection Legislation.
PART B - ADDITIONAL TERMS FOR US STATE PRIVACY LAWS
1.Introduction
Google may offer and Customer may enable certain in-product settings, configurations or other functionality for the Processor Services relating to restricted data processing, as described in supporting documentation available at business.safety.google/rdp, as updated from time to time (“Restricted Data Processing”). This Appendix 3B reflects the parties’ agreement on the processing of Customer Personal Data and Deidentified Data (as defined below) pursuant to the Agreement in connection with the US State Privacy Laws, and is effective solely to the extent each US State Privacy Law applies.
2.Additional Definitions and Interpretation
In this Appendix 3B:
(a)“Deidentified Data” means data information that is “deidentified” (as that term is defined by the CCPA) and “de-identified data” (as defined by other US State Privacy Laws), when disclosed by one party to the other.
(b)“RDP Instructions” means, collectively, the Instructions (as defined in these Data Processing Terms) and Customer’s instructions to Google to process Customer Personal Data as permitted under US State Privacy Laws for service providers and processors.
(c)“RDP Services” means Processor Services operating under Restricted Data Processing.
(d)the terms “business”, “consumer”, “personal information”, “sale(s)”, “sell”, “service provider”, and “share” as used in this Appendix 3B have the meanings given in the applicable US State Privacy Laws.
(e)Customer is solely liable for its compliance with each of the US State Privacy Laws in its use of Google services, including Restricted Data Processing.
3.Applicable State Privacy Law Terms (under Restricted Data Processing).
3.1With respect to Customer Personal Data processed under Restricted Data Processing, and to the extent that one or more of the US State Privacy Laws applies to the processing of Customer Personal Data:
3.1.1Roles and Regulatory Compliance; Authorization.
(a)Processor and Controller Responsibilities.The parties acknowledge and agree that:
(i)Appendix 1 of these Data Processing Terms describes the subject matter and details of the processing of Customer Personal Data, subject to the following modifications:
(1)All references to “Processor Services” are replaced with “RDP Services”; and
(2)The “Types of Personal Data” section is replaced with the following language: “Customer Personal Data may include the types of personal data described under the US State Privacy Laws.”
(ii)Google is a service provider and processor of Customer Personal Data under the US State Privacy Laws; and
(iii)Customer is a controller or processor, as applicable, of Customer Personal Data under the US State Privacy Laws.
(b)Processor Customers. If Customer is a processor:
(i)Customer warrants on an ongoing basis that the relevant controller has authorized: (A) the Instructions, (B) Customer’s appointment of Google as another processor, and (C) Google’s engagement of subcontractors as described in paragraph 3.4 (Subcontractors) of this Appendix 3B.
(ii)Customer will immediately forward to the relevant controller any notice provided by Google under Section 7.2.1 (Incident Notification) of these Data Protection Terms and paragraph 3.4 (Subcontractors) of this Appendix 3B.
(iii)Customer may make available to the relevant controller any information made available by Google under paragraphs 3.2(b) (Customer’s Audit Rights) and 3.4 (Subcontractors) of this Appendix 3B.
3.1.2Customer’s Instructions for RDP Services. By entering into this Appendix 3B, and with respect to the RDP Services, Customer instructs Google to process Customer Personal Data only in accordance with the RDP Instructions.
3.1.3Google’s Compliance with RDP Instructions. With respect to the RDP Services, Google will comply with the RDP Instructions unless prohibited under the US State Privacy Laws.
3.1.4Additional Products. If Customer uses any product, service or application provided by Google or a third party that: (a) is not part of the RDP Services; and (b) is accessible for use within the user interface of the RDP Services or is otherwise integrated with the RDP Services (an “Additional Product”), the RDP Services may allow that Additional Product to access Customer Personal Data as required for the interoperation of the Additional Product with the RDP Services. For clarity, this Appendix 3B does not apply to the processing of personal data in connection with the provision of any Additional Product used by Customer, including personal data transmitted to or from that Additional Product.
3.2Data Security
3.2.1Customer’s Security Responsibilities and Assessment.
(a)Customer’s Security Responsibilities. In addition to Customer’s security responsibilities under Section 7.3.1 of these Data Processing Terms, Customer agrees that, without prejudice to Google’s obligations under Sections 7.1 (Google’s Security Measures and Assistance) and 7.2 (Data Incidents) of these Data Processing Terms, Customer is responsible for its use of the RDP Services, including: (1) making appropriate use of the RDP Services to ensure a level of security appropriate to the risk in respect of Customer Personal Data; and (2) securing the account authentication credentials, systems and devices Customer uses to access the RDP Services.
(b)Customer’s Audit Rights.
(i)Customer may conduct an audit to verify Google’s compliance with its obligations under this Appendix 3B by requesting and reviewing (1) a certificate issued for security verification reflecting the outcome of an audit conducted by a third party auditor (e.g., SOC 2 Type II or ISO/IEC 27001 certification or a comparable certification or other security certification of an audit conducted by a third-party auditor agreed by Customer and Google) within 12 months as of the date of Customer’s request and (2) any other information Google determines is reasonably necessary for Customer to verify such compliance.
(ii)Alternatively, Google may, at its sole discretion and in response to a request by Customer, initiate a third-party audit to verify Google’s compliance with its obligations under this Appendix 3B. During such an audit, Google will make available to the third-party auditor all information necessary to demonstrate such compliance. Where Customer requests such an audit, Google may charge a fee (based on Google’s reasonable costs) for any audit. Google will provide Customer with further details of any applicable fee, and the basis of its calculation, in advance of any such audit. Customer will be responsible for any fees charged by any third-party auditor appointed by Customer to execute any such audit.
(iii)Nothing in this Appendix 3B will require Google either to disclose to Customer or its third-party auditor, or to allow Customer or its third-party auditor to access:
(1)any data of any other customer of a Google Entity;
(2)any Google Entity’s internal accounting or financial information;
(3)any trade secret of a Google Entity;
(4)any information that, in Google's reasonable opinion, could: (A) compromise the security of any Google Entity’s systems or premises; or (B) cause any Google Entity to breach its obligations under the US State Privacy Laws or its security and/or privacy obligations to Customer or any third party; or
(5)any information that Customer or its third party auditor seeks to access for any reason other than the good faith fulfillment of Customer’s obligations under the US State Privacy Laws.
3.3Data Subject Rights. For the purposes of this Appendix 3B, Google will adhere to the procedures set forth under Section 9 (Data Subject Requests) to the extent such requests, requests for assistance, or rectification is applicable to the RDP Services.
3.4Subcontractors.
(a)Customer generally authorizes Google to engage other entities as subcontractors in connection with the provision of the RDP Services. When engaging any subcontractor, Google will:
(i)ensure via a written contract that: (A) the subcontractor only accesses and uses Customer Personal Data to the extent required to perform the obligations subcontracted to it, and does so in accordance with the Agreement (including this Appendix 3B); and (B) if the processing of Customer Personal Data is subject to the US State Privacy Laws, ensure that the data protection obligations in this Appendix 3B are imposed on the subcontractor;
(ii)when engaging any new subcontractors, provide notice of such new subcontractors where required by US State Privacy Laws, and, where required by US State Privacy Laws, further provide an opportunity for Customer to object to such subcontractors; and
(iii)remain fully liable for all obligations subcontracted to, and all acts and omissions of, the subcontractor.
(b)Customer may object to any new subcontractor by terminating the Agreement for convenience immediately upon written notice to Google, on condition that Customer provides such notice within 90 days of being informed of the engagement of the new subcontractor as described in paragraph 3.4(a)(ii) herein.
4.US State Privacy Law Terms
4.1Deidentified Data. With respect to Customer Personal Data processed with or without Restricted Data Processing enabled, and to the extent that one or more of the US State Privacy Laws applies to the processing of Customer Personal Data, each party will comply with the requirements for processing Deidentified Data set out in the US State Privacy Laws, with respect to any Deidentified Data it receives from the other party pursuant to the Agreement. For purposes of this paragraph 4.1 (Deidentified Data), Customer Personal Data means any personal data that is processed by a party under the Agreement in connection with its provision or use of the Processor Services.
5.Google’s CCPA Obligations.
5.1With respect to Customer Personal Data processed under Restricted Data Processing and to the extent that CCPA applies to such processing of Customer Personal Data, Google will act as Customer’s service provider, and as such, unless otherwise permitted for service providers under CCPA, as reasonably determined by Google:
(i)Google will not sell or share any Customer Personal Data that it obtains from Customer in connection with the Agreement;
(ii)Google will not retain, use or disclose Customer Personal Data (including outside of the direct business relationship between Google and Customer), other than for a business purpose under the CCPA on behalf of Customer and the specific purpose of performing the RDP Services, as further described in supporting documentation available at business.safety.google/rdp, as updated from time to time;
(iii)Google will not combine Customer Personal Data that Google receives from, or on behalf of, Customer with (a) personal information that Google receives from, or on behalf of, another person or persons or (b) personal information collected from Google’s own interaction with a consumer, as further described in supporting documentation available at business.safety.google/rdp except to the extent permitted under CCPA;
(iv)Google will process such Customer Personal Data for the specific purpose of performing the RDP Services, as further described in the Agreement and supporting documentation (e.g., help center articles), or as otherwise permitted under the CCPA, and the parties agree that Customer is making such Customer Personal Data available to Google for such purposes;
(v)Google will allow audits to verify Google’s compliance with its obligations under this Appendix 3B in accordance with paragraph 3.2.1(b) (Customer’s Audit Rights) of this Appendix 3B;
(vi)Google will notify Customer if Google makes a determination that it can no longer meet its obligations under the CCPA. This paragraph 5.1(vi) does not reduce either party’s rights and obligations elsewhere in the Agreement;
(vii)If Customer reasonably believes that Google is processing Customer Personal Data in an unauthorized manner, Customer has the right to notify Google of such belief via the methods described at privacy.google.com/businesses/processorsupport, and the parties will work together in good faith to remediate the allegedly violative processing activities, if necessary; and
(viii)Google will comply with applicable obligations under CCPA and will provide the same level of privacy protection as is required by CCPA.
5.2With respect to Customer Personal Data processed without Restricted Data Processing enabled, and to the extent that CCPA applies to the processing of Customer Personal Data:
(i)Google will process such Customer Personal Data for the specific purpose of performing the Processor Services, as further described in the Agreement and supporting documentation (e.g., help center articles), or as otherwise permitted under the CCPA, and the parties agree that Customer is making such Customer Personal Data available to Google for such purposes;
(ii)Google will allow audits to verify Google’s compliance with its obligations under this Appendix 3B in accordance with paragraph 3.2.1(b) (Customer’s Audit Rights) herein.
(iii)Google will notify Customer if Google makes a determination that it can no longer meet its obligations under the CCPA;
(iv)If Customer reasonably believes that Google is processing Customer Personal Data in an unauthorized manner, Customer has the right to notify Google of such belief via the methods described at privacy.google.com/businesses/processorsupport, and the parties will work together in good faith to remediate the allegedly violative processing activities, if necessary; and
(v)Google will comply with applicable obligations under CCPA and will provide the same level of privacy protection as is required by CCPA.
6.Changes to this Appendix 3B. In addition to Section 15 of the Data Processing Terms (Changes to these Data Processing Terms), Google may change this Appendix 3B without notice if the change (a) is based on applicable law, applicable regulation, a court order, or guidance issued by a governmental regulator or agency or (b) does not have a material adverse impact on Customer under the US State Privacy Laws, as reasonably determined by Google.
Google Ads Data Processing Terms, Version 7.0
1 September 2023