La pagina contiene informazioni su:
Termini e Condizioni,
Politica sulla Privacy e
Termini di Elaborazione dei Dati di Google

Termini e Condizioni

1. GeneraleQuesto è un riassunto, di seguito è riportato il testo completo in inglese. Se hai bisogno di ulteriori modifiche, fammi sapere!
I seguenti termini e condizioni generali si applicano a tutti i contratti, consegne e altri servizi. Con la presente ci opponiamo espressamente a disposizioni divergenti da parte del partner contrattuale. Lambretta-Lutz ha il diritto di modificare o integrare questi Termini e Condizioni generali, comprese eventuali appendici, in qualsiasi momento con un preavviso ragionevole. Gli ordini ricevuti prima di tale data saranno elaborati secondo i vecchi Termini e Condizioni generali ancora validi in quel momento.
2. Offerta
Le nostre offerte non sono vincolanti. Sono possibili piccole deviazioni e modifiche tecniche rispetto alle nostre illustrazioni o descrizioni.
3. Uso esclusivamente per corse, TÜV / ABE
Tutti i pezzi nella nostra offerta, salvo diversa indicazione, sono destinati esclusivamente per l'uso in pista e non sono omologati per la strada.
Per i clienti in Germania, ciò significa che tutti i pezzi sono privi di TÜV/ABE e quindi non approvati per l'uso su strade pubbliche. I pezzi di tuning sono esclusivamente per scopi espositivi. Tutti gli articoli che trattiamo e che non sono espressamente contrassegnati per il traffico su strada e che riguardano la StVZO devono essere consultati o registrati con TÜV/DEKRA prima di essere messi in funzione su strade pubbliche.
Per i pezzi di tuning e le parti elettroniche, l'installazione e il funzionamento avvengono a rischio del cliente, le parti sono destinate esclusivamente per essere utilizzate in mostre e non per essere montate sui veicoli. Si fa esplicito riferimento ai rischi considerevoli associati all'uso di articoli da tuning e da corsa nel contesto dell'operazione dei veicoli.
4. Garanzia
Lambretta-Lutz garantisce che i beni venduti sono privi di difetti di materiale e di fabbricazione al momento del trasferimento del rischio e che possiedono le caratteristiche contrattualmente garantite.
In caso di difetti nei beni consegnati, il cliente ha diritto ai diritti statutari.
In caso di reclami, la data di acquisto deve essere provata con una fattura. L'articolo in questione deve essere inviato insieme a una copia della fattura, con adeguata affrancatura. La garanzia non copre l'usura normale. La garanzia decade se il cliente modifica i beni consegnati. Lambretta-Lutz ha il diritto di effettuare riparazioni gratuite durante il periodo di garanzia. È permesso il sostituto parziale o totale dell'articolo. Se i difetti non vengono corretti entro un periodo ragionevole, l'acquirente ha diritto alla conversione o alla riduzione. Si applica l'art. 476a del BGB.
5. Pezzi di Tuning - Garanzia - Garanzia
Desideriamo sottolineare ancora una volta che i pezzi di tuning sono destinati all'uso nelle corse. Questi pezzi non sono progettati per l'uso nel traffico stradale quotidiano, nonostante la loro qualità molto elevata e i metodi di fabbricazione all'avanguardia. Più potenza significa sempre maggiore usura e durata più breve del motore con tutti i componenti.
Tutti i produttori di tuning (ad esempio Monza, AF Rayspeed, ecc.) escludono qualsiasi garanzia dopo l'assemblaggio, a meno che non si tratti di un difetto dimostrabile nel materiale o nella fabbricazione. Poiché ciò non può praticamente più essere provato, desideriamo sottolineare che tutti i pezzi di tuning devono essere attentamente esaminati per eventuali difetti o errori PRIMA dell'assemblaggio. Il reclamo di un pezzo di tuning dopo l'assemblaggio è quindi praticamente impossibile. A spese del cliente, il pezzo corrispondente dovrà essere inviato al produttore in Italia, ad esempio. Qui verrà chiarito se si tratta di un errore nel materiale o di un errore nell'assemblaggio. Il reso deve essere accompagnato dalla fattura dell'officina che ha effettuato il tuning (prova dell'assemblaggio professionale, data di assemblaggio). In particolare, i danni indiretti causati da un difetto, come altri componenti del motore danneggiati, costi di riparazione e di traino sono esclusi in modo completo. Chiediamo la vostra comprensione per queste limitazioni, che sono di fatto autoevidenti per un pezzo da corsa ma comportano una limitazione della garanzia.
6. Lavorazioni e tuning del motore, pezzi di tuning - Garanzia - Garanzia
Un pezzo di tuning è un componente che porta a un aumento delle prestazioni o della velocità. Più potenza significa sempre maggiore usura e durata più breve del motore con tutti i componenti. Pertanto, rifiutiamo qualsiasi garanzia a partire dal momento in cui viene installato anche un solo pezzo di tuning sul motore, poiché anche la più piccola modifica al motore comporta cambiamenti considerevoli nelle caratteristiche del motore, e di conseguenza il motore non è più stabile come nel suo stato originale. Non si assume alcuna responsabilità per danni indiretti.
7. Esclusione di responsabilità per motori, prove del motore - anche sul banco di prova
Non si assume alcuna responsabilità per motori modificati (non appena viene installato un solo pezzo di tuning, il motore è considerato modificato) e per i loro componenti che vengono testati o modificati sul banco prova o generalmente qui. Questo vale in particolare per cilindri, pistoni, blocchi motore, frizioni, alberi motore e tutte le parti che appartengono al motore. Naturalmente, questa esclusione di responsabilità si applica anche alla guida nel periodo successivo alla votazione (vedi il testo sopra).
8. Esclusione di responsabilità per motori completamente assemblati e, se necessario, modificati
I motori che hanno una potenza, coppia o velocità superiori (rispetto al motore originale) a causa di modifiche sono sottoposti a carichi maggiori. Questo vale per ASSOLUTAMENTE TUTTI i componenti. Non si assume alcuna responsabilità per problemi o danni indiretti conseguenti. Questo vale in particolare per perdite premature nel cilindro, nello scarico, nel collettore di aspirazione e nel blocco motore in generale, nonché per tutte le altre caratteristiche (salto delle marce, slittamento della frizione, comportamento all'avviamento, caratteristiche di guida, rumore del motore, ecc.). L'ulteriore potenza e quindi il carico aggiuntivo su tutti i componenti è spesso superiore al 300% nei motori. Pertanto, la responsabilità NON PUÒ essere assunta, sarebbe assolutamente irragionevole.
9. Danno al veicolo durante riparazioni o manutenzione
Lambretta-Lutz si riserva il diritto di riparare eventuali danni che potrebbero verificarsi durante la riparazione o la manutenzione. Il cliente deve segnalare questo danno a Lambretta-Lutz entro 10 giorni. I costi per riparazioni effettuate da un'altra azienda / officina non saranno rimborsati.
10. Esclusione di responsabilità per veicoli
Non si assume alcuna responsabilità per veicoli / scooter che vengono temporaneamente o permanentemente dismessi qui. Questo vale in particolare per danni causati da incendio, furto e altri danni di responsabilità.
11. Costi di spedizione
I costi di spedizione, postali e in contrassegno sono indicati in anticipo nelle condizioni di consegna. I dettagli esatti saranno forniti nella SECONDA EMAIL in un riepilogo finale / fattura. Invieremo questo riepilogo finale / fattura tramite email in formato "pdf". Se si paga in anticipo, verranno forniti anche i dettagli bancari, se non sono già stati acquisiti dal nostro negozio o dal nostro sito web. La spedizione è gratuita solo previo accordo. L'invio tramite lettera / lettera maxi di solito non è assicurato e viene effettuato solo previo accordo e su espressa richiesta del cliente. Se tale lettera viene persa, non forniremo un risarcimento gratuito - il cliente si assume il 100% del rischio.
12. Consegna e pagamento
Le condizioni di consegna e pagamento di Lambretta-Lutz sono specificate più dettagliatamente nel modulo d'ordine. Non ci sono quantità minime d'ordine. Tutti i nostri prezzi sono espressi in EURO e comprendono l'IVA. Ci riserviamo il diritto di effettuare una consegna parziale, se ciò sembra vantaggioso per un'elaborazione rapida. Le modalità di spedizione speciali richieste dai nostri clienti comportano un supplemento locale.
13. Tempi di consegna
I prodotti disponibili a magazzino (non rispondiamo dei problemi di trasporto) verranno spediti entro 2 giorni. Se la merce non è disponibile al momento dell'ordine, faremo del nostro meglio per consegnarla nel minor tempo possibile. Se il mancato rispetto di un termine di consegna o di prestazione è dovuto a cause di forza maggiore, conflitti industriali, ostacoli imprevisti o altre circostanze per le quali non siamo responsabili, il termine sarà prorogato di conseguenza. In caso di mancato rispetto del termine di consegna per motivi diversi da quelli sopra menzionati, l'acquirente ha il diritto di fissare una ragionevole scadenza per iscritto, con la minaccia di rifiuto, e dopo il suo esito negativo di ritirarsi dal contratto relativamente alla consegna o al servizio contenuto nel contratto. Se l'impossibilità di consegna dipende dall'incapacità del produttore o del nostro fornitore, sia noi che il cliente possiamo recedere dal contratto se la data di consegna concordata è superata di più di 2 mesi. Sono esclusi i reclami per danni derivanti da ritardo, impossibilità o mancata prestazione, compresi quelli verificatisi fino alla data del recesso dal contratto, a meno che un rappresentante legale di Lambretta-Lutz non abbia agito con dolo o grave negligenza.
14. Diritto di recesso
Hai il diritto di recedere da questo contratto entro un mese senza dover fornire alcuna motivazione. Il termine è di un mese a partire dal giorno in cui tu o un terzo da te designato, che non sia il vettore, prendi possesso della merce. Per esercitare il tuo diritto di recesso, devi informarci - Lambretta-Lutz, Am Lochholz 28a, info@Lambretta-Lutz.de, 0151 - 11725085 - della tua decisione di recedere da questo contratto mediante una dichiarazione chiara (ad esempio, una lettera inviata per posta, anche telefonicamente o via email). Puoi utilizzare il modulo di recesso allegato, ma non è obbligatorio. Per rispettare il termine di recesso, è sufficiente inviare la comunicazione prima della scadenza del termine di recesso.
Se recedi da questo contratto, ti rimborseremo tutti i pagamenti che abbiamo ricevuto da te, comprese le spese di consegna (eccetto i costi aggiuntivi derivanti dal fatto che tu abbia scelto un tipo di spedizione diverso da quello standard più economico che offriamo), senza indugi e al massimo entro quattordici giorni dal giorno in cui abbiamo ricevuto la notifica del tuo recesso.
Per questo rimborso, utilizzeremo lo stesso mezzo di pagamento che hai utilizzato per la transazione originale, salvo diverso accordo espresso con te; in nessun caso ti verranno addebitati costi a causa di questo rimborso. Possiamo trattenere il rimborso fino a quando non avremo ricevuto i beni indietro o fino a quando non avrai fornito la prova che hai restituito la merce, a seconda di quale delle due cose avvenga prima.
Devi restituirci la merce senza indugi e in ogni caso entro un mese dalla data in cui ci comunichi il recesso dal presente contratto. La scadenza è rispettata se invii la merce prima della scadenza di un mese. I costi per la restituzione della merce sono a nostro carico. Sarai responsabile solo per una perdita di valore dei beni se tale perdita di valore è dovuta a una gestione dei beni che non è necessaria per verificare la natura, le caratteristiche e il funzionamento dei beni.
Se desideri recedere dal contratto, compila questo modulo e invialo a Lambretta-Lutz:
Lambretta-Lutz, Am Lochholz 28a, info@Lambretta-Lutz.de, oppure telefonicamente al 0151 – 11725085.
Con la presente, recedo dal contratto concluso con me per l'acquisto dei seguenti beni / la prestazione dei seguenti servizi: ___________________________________________
Ordinato il _________________________________________________________________
Ricevuto il _________________________________________________________________
Nome del consumatore _______________________________________________________
Indirizzo del consumatore _____________________________________________________
Firma del consumatore __________________________________________________
Data ______________________________________________________________________
15. Spedizione, assicurazione, trasferimento del rischio
(1) Salvo diverso accordo, determinamo noi il metodo di spedizione e il vettore in base al nostro ragionevole giudizio.
(2) Dobbiamo solo garantire la consegna tempestiva e corretta dei beni al vettore e non siamo responsabili per eventuali ritardi causati dal vettore. Pertanto, un tempo di spedizione indicato nel negozio online non è vincolante.
(3) Se il cliente è un consumatore, il rischio di perdita accidentale, danni accidentali o perdita accidentale dei beni consegnati passa al cliente nel momento in cui i beni vengono consegnati al cliente o quando il cliente è in mora nell'accettazione. In tutti gli altri casi, il rischio passa al cliente quando i beni vengono consegnati alla compagnia di trasporto.
16. Clausola di salvaguardia
Se una disposizione di queste condizioni generali di contratto è invalida, le restanti disposizioni rimangono invariate. La disposizione invalida sarà considerata sostituita da una che rispecchia il significato e l'obiettivo della disposizione invalida in modo legalmente valido. Lo stesso vale per eventuali lacune.
17. Riserva di proprietà
Fino al completo pagamento, i beni rimangono di proprietà di Lambretta-Lutz.
18. Conservazione dei dati
In conformità con l'articolo 28 della Legge federale sulla protezione dei dati (BDSG), desideriamo informarti che i dati necessari per l'espletamento delle transazioni commerciali vengono elaborati e conservati mediante un sistema informatico in conformità con l'articolo 33 del BDSG. I dati personali saranno trattati con la massima riservatezza.
19. Legge applicabile al contratto
(1) I contratti tra Lambretta-Lutz e i clienti sono regolati esclusivamente dalla legge tedesca, con esclusione della Convenzione delle Nazioni Unite sui contratti di vendita internazionale di merci.
(2) Nei rapporti con i consumatori finali all'interno dell'Unione Europea, può applicarsi anche la legge del paese di residenza del consumatore finale, sempre che le disposizioni del diritto dei consumatori siano imperativi.
(3) Se il consumatore finale non risiede nell'Unione Europea, la giurisdizione competente sarà la nostra sede legale.
(4) Se il cliente è un commerciante ai sensi dell'articolo 1, comma 1 del Codice di Commercio tedesco (HGB), una persona giuridica di diritto pubblico o un fondo speciale di diritto pubblico, il foro competente per tutte le controversie derivanti da o in relazione al contratto tra il cliente e Lambretta-Lutz sarà la sede legale di Lambretta-Lutz. In tutti gli altri casi, noi o il cliente possiamo intentare causa presso qualsiasi tribunale competente secondo la legge.
20. Informazioni sulla risoluzione delle controversie online
Nel 2016, la Commissione dell'UE ha fornito una piattaforma internet per la risoluzione online delle controversie - la piattaforma ODR. La piattaforma ODR serve come punto di contatto per la risoluzione extragiudiziale delle controversie relative agli obblighi contrattuali derivanti dai contratti di vendita nel settore online.
La piattaforma ODR è raggiungibile qui:
http://ec.europa.eu/consumers/odr
21. Archiviazione del contratto
Non memorizziamo il testo del contratto. Puoi salvarlo stampando l'offerta tramite la funzione di stampa del tuo browser. È responsabilità del cliente archiviare il testo del contratto in una forma che consenta di essere facilmente riprodotto.
22. AGB prima di tutto
Il testo è stato tradotto automaticamente. In caso di dubbi, valgono le condizioni generali di contratto (AGB) in lingua tedesca.

Avviso Importante:
Questi avvisi si riferiscono alle condizioni legali e di privacy descritte nella versione tedesca del sito. In caso di dubbi, fa fede il testo in tedesco.

Politica sulla Privacy
Diamo grande importanza alla protezione dei tuoi dati personali. Questa politica sulla privacy spiega come raccogliamo, utilizziamo e proteggiamo i tuoi dati. Acconsenti alla raccolta e al trattamento dei tuoi dati secondo questa politica quando utilizzi il nostro sito web.

Raccolta e Trattamento dei Dati
Raccogliamo informazioni personali, come nome, indirizzo e-mail e dati di pagamento, solo quando ci vengono fornite volontariamente.

Informazioni sulla protezione dei dati di Google
1. Termini Generali di Protezione dei Dati
In conformità alla legislazione europea sulla protezione dei dati, Google adotta le Clausole Contrattuali Standard (SCC) per garantire che i trasferimenti di dati personali al di fuori dello Spazio Economico Europeo (SEE) rispettino gli standard di protezione. Se i dati vengono trattati da Google e il cliente è situato in un Paese non adeguato, si applicano le SCCs in modalità "Processor-to-Controller" o "Controller-to-Processor".
2. Misure Supplementari
Google fornirà al Cliente informazioni rilevanti sui trasferimenti di dati personali nell'Unione Europea, incluse informazioni sulle misure supplementari per proteggere i dati personali del Cliente, come descritto nella Sezione 7.5 e nell'Allegato 2 (Misure di Sicurezza).
3. Diritto di Risoluzione del Contratto
Se il Cliente ritiene che le SCC o altre soluzioni di trasferimento non offrano protezioni adeguate per i dati personali del Cliente, può risolvere immediatamente il contratto con Google, previa notifica scritta.
4. Subappaltatori
Nel caso in cui Google utilizzi subappaltatori per trattare i dati personali, questi sono vincolati agli stessi obblighi di protezione dei dati previsti dal contratto tra Google e il Cliente. Ogni subappaltatore dovrà rispettare la legislazione europea sulla protezione dei dati.
5. Registrazioni del Trattamento dei Dati
Google è obbligata dalla GDPR a raccogliere e mantenere registrazioni relative ai trattamenti dei dati, inclusi i dettagli di contatto di eventuali subappaltatori. Il Cliente dovrà fornire a Google le informazioni richieste per garantire la conformità alla legislazione sulla protezione dei dati.
6. Obblighi del Cliente per le Leggi sulla Privacy degli Stati Uniti
Se i dati sono trattati in conformità con le leggi sulla privacy degli Stati Uniti (ad esempio, il CCPA per i dati di utenti della California), Google agirà come fornitore di servizi per il Cliente, e non venderà, cederà o utilizzerà i dati personali del Cliente al di fuori della relazione diretta tra Google e il Cliente.
Termini aggiuntivi per la Privacy degli Stati Uniti
1. Elaborazione dei Dati Sensibili
Google fornirà strumenti specifici per il trattamento dei dati sensibili in conformità con le leggi statali sulla privacy, come descritto nella documentazione di supporto disponibile su business.safety.google/rdp.
2. Responsabilità per la Sicurezza dei Dati
Il Cliente è responsabile per l'uso appropriato dei servizi di Google e per la protezione delle credenziali di accesso agli account. Inoltre, è responsabile di garantire che i dati personali siano trattati in modo sicuro.
3. Diritto di Audit
Il Cliente ha il diritto di audit per verificare la conformità di Google con gli obblighi contrattuali, tra cui la verifica delle certificazioni di sicurezza (ad esempio, SOC 2 o ISO/IEC 27001).
4. Subappaltatori
Google può coinvolgere altri subappaltatori, ma garantirà che siano soggetti agli stessi obblighi di protezione dei dati, come previsti da questo contratto. Il Cliente può opporsi all’utilizzo di nuovi subappaltatori in conformità con le leggi sulla privacy statale.
5. CCPA (California Consumer Privacy Act)
Se il CCPA si applica, Google agisce come fornitore di servizi e non venderà o condividerà i dati del Cliente. Google utilizzerà i dati personali solo per fornire i servizi richiesti dal Cliente.

Questa è una sintesi automatica e una traduzione. Di seguito, la versione in inglese è quella vincolante dal punto di vista del contenuto.

Updated November, 2023

This website (the “Site”) is owned and operated by Lambretta-Lutz.de (“COMPANY” “we” or “us”). By using the Site, you agree to be bound by these Terms and Conditions and to use the Site in accordance with these Terms and Conditions, our Privacy Policy, our Return Policy and any additional terms and conditions that may apply to specific sections of the Site or to products and services available through the Site or from COMPANY. Accessing the Site, in any manner, whether automated or otherwise, constitutes use of the Site and your agreement to be bound by these Terms & Conditions.

We reserve the right to change these Terms & Conditions or to impose new conditions on use of the Site, from time to time, in which case we will post the revised Terms & Conditions on this website. By continuing to use the Site after we post any such changes, you accept the Terms & Conditions, as modified.

Intellectual Property Rights

Our Limited License to You. This Site and all the materials available on the Site are the property of us and/or our affiliates or licensors, and are protected by copyright, trademark, and other intellectual property laws. The Site is provided solely for your personal noncommercial use. You may not use the Site or the materials available on the Site in a manner that constitutes an infringement of our rights or that has not been authorized by us. More specifically, unless explicitly authorized in these Terms of Service or by the owner of the materials, you may not modify, copy, reproduce, republish, upload, post, transmit, translate, sell, create derivative works, exploit, or distribute in any manner or medium (including by email or other electronic means) any material from the Site. You may, however, from time to time, download and/or print one copy of individual pages of the Site for your personal, non-commercial use, provided that you keep intact all copyright and other proprietary notices.

Your License to Us. By posting or submitting any material (including, without limitation, comments, blog entries, Facebook postings, photos and videos) to us via the Site, internet groups, social media venues, or to any of our staff via email, text or otherwise, you are representing: (i) that you are the owner of the material, or are making your posting or submission with the express consent of the owner of the material; and (ii) that you are thirteen years of age or older. In addition, when you submit, email, text or deliver or post any material, you are granting us, and anyone authorized by us, a royalty-free, perpetual, irrevocable, non-exclusive, unrestricted, worldwide license to use, copy, modify, transmit, sell, exploit, create derivative works from, distribute, and/or publicly perform or display such material, in whole or in part, in any manner or medium, now known or hereafter developed, for any purpose. The foregoing grant shall include the right to exploit any proprietary rights in such posting or submission, including, but not limited to, rights under copyright, trademark, service mark or patent laws under any relevant jurisdiction. Also, in connection with the exercise of such rights, you grant us, and anyone authorized by us, the right to identify you as the author of any of your postings or submissions by name, email address or screen name, as we deem appropriate.

You acknowledge that COMPANY has the right but not the obligation to use and display any postings or contributions of any kind and that COMPANY may elect to cease the use and display of any such materials (or any portion thereof), at any time for any reason whatsoever.

Limitations on Linking and Framing. You may establish a hypertext link to the Site so long as the link does not state or imply any sponsorship of your site by us or by the Site. However, you may not, without our prior written permission, frame or inline link any of the content of the Site, or incorporate into another website or other service any of our material, content or intellectual property.

Disclaimers

Throughout the Site, we may provide links and pointers to Internet sites maintained by third parties. Our linking to such third-party sites does not imply an endorsement or sponsorship of such sites, or the information, products or services offered on or through the sites. In addition, neither we nor affiliates operate or control in any respect any information, products or services that third parties may provide on or through the Site or on websites linked to by us on the site.

If applicable, any opinions, advice, statements, services, offers, or other information or content expressed or made available by third parties, including information providers, are those of the respective authors or distributors, and not COMPANY. Neither COMPANY nor any third-party provider of information guarantees the accuracy, completeness, or usefulness of any content. Furthermore, COMPANY neither endorses nor is responsible for the accuracy and reliability of any opinion, advice, or statement made on any of the Sites by anyone other than an authorized COMPANY representative while acting in his/her official capacity.

THE INFORMATION, PRODUCTS AND SERVICES OFFERED ON OR THROUGH THE SITE AND BY COMPANY AND ANY THIRD-PARTY SITES ARE PROVIDED “AS IS” AND WITHOUT WARRANTIES OF ANY KIND EITHER EXPRESS OR IMPLIED. TO THE FULLEST EXTENT PERMISSIBLE PURSUANT TO APPLICABLE LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. WE DO NOT WARRANT THAT THE SITE OR ANY OF ITS FUNCTIONS WILL BE UNINTERRUPTED OR ERROR-FREE, THAT DEFECTS WILL BE CORRECTED, OR THAT ANY PART OF THIS SITE, INCLUDING BULLETIN BOARDS, OR THE SERVERS THAT MAKE IT AVAILABLE, ARE FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS.

WE DO NOT WARRANT OR MAKE ANY REPRESENTATIONS REGARDING THE USE OR THE RESULTS OF THE USE OF THE SITE OR MATERIALS ON THIS SITE OR ON THIRD-PARTY SITES IN TERMS OF THEIR CORRECTNESS, ACCURACY, TIMELINESS, RELIABILITY OR OTHERWISE.

You agree at all times to defend, indemnify and hold harmless COMPANY its affiliates, their successors, transferees, assignees and licensees and their respective parent and subsidiary companies, agents, associates, officers, directors, shareholders and employees of each from and against any and all claims, causes of action, damages, liabilities, costs and expenses, including legal fees and expenses, arising out of or related to your breach of any obligation, warranty, representation or covenant set forth herein

Online Commerce

Certain sections of the Site may allow you to purchase many different types of products and services online that are provided by third parties. We are not responsible for the quality, accuracy, timeliness, reliability or any other aspect of these products and services. If you make a purchase from a merchant on the Site or on a site linked to by the Site, the information obtained during your visit to that merchant’s online store or site, and the information that you give as part of the transaction, such as your credit card number and contact information, may be collected by both the merchant and us. A merchant may have privacy and data collection practices that are different from ours. We have no responsibility or liability for these independent policies. In addition, when you purchase products or services on or through the Site, you may be subject to additional terms and conditions that specifically apply to your purchase or use of such products or services. For more information regarding a merchant, its online store, its privacy policies, and/or any additional terms and conditions that may apply, visit that merchant’s website and click on its information links or contact the merchant directly. You release us and our affiliates from any damages that you incur, and agree not to assert any claims against us or them, arising from your purchase or use of any products or services made available by third parties through the site.

Your participation, correspondence or business dealings with any third party found on or through our Site, regarding payment and delivery of specific goods and services, and any other terms, conditions, representations or warranties associated with such dealings, are solely between you and such third party. You agree that COMPANY shall not be responsible or liable for any loss, damage, or other matters of any sort incurred as the result of such dealings.

You agree to be financially responsible for all purchases made by you or someone acting on your behalf through the Site. You agree to use the Site and to purchase services or products through the Site for legitimate, non-commercial purposes only. You also agree not to make any purchases for speculative, false or fraudulent purposes or for the purpose of anticipating demand for a particular product or service. You agree to only purchase goods or services for yourself or for another person for whom you are legally permitted to do so. When making a purchase for a third party that requires you to submit the third party’s personal information to us or a merchant, you represent that you have obtained the express consent of such third party to provide such third party’s personal information.

Interactive Features

This Site may include a variety of features, such as bulletin boards, web logs, chat rooms, and email services, which allow feedback to us and real-time interaction between users, and other features which allow users to communicate with others. Responsibility for what is posted on bulletin boards, web logs, chat rooms, and other public posting areas on the Site, or sent via any email services on the Site, lies with each user – you alone are responsible for the material you post or send. We do not control the messages, information or files that you or others may provide through the Site. It is a condition of your use of the Site that you do not:

Restrict or inhibit any other user from using and enjoying the Site.

Use the Site to impersonate any person or entity, or falsely state or otherwise misrepresent your affiliation with a person or entity.

Interfere with or disrupt any servers or networks used to provide the Site or its features, or disobey any requirements, procedures, policies or regulations of the networks we use to provide the Site.

Use the Site to instigate or encourage others to commit illegal activities or cause injury or property damage to any person.

Gain unauthorized access to the Site, or any account, computer system, or network connected to this Site, by means such as hacking, password mining or other illicit means.

Obtain or attempt to obtain any materials or information through any means not intentionally made available through this Site.

Use the Site to post or transmit any unlawful, threatening, abusive, libelous, defamatory, obscene, vulgar, pornographic, profane or indecent information of any kind, including without limitation any transmissions constituting or encouraging conduct that would constitute a criminal offense, give rise to civil liability or otherwise violate any local, state, national or international law.

Use the Site to post or transmit any information, software or other material that violates or infringes upon the rights of others, including material that is an invasion of privacy or publicity rights or that is protected by copyright, trademark or other proprietary right, or derivative works with respect thereto, without first obtaining permission from the owner or rights holder.

Use the Site to post or transmit any information, software or other material that contains a virus or other harmful component.

Use the Site to post, transmit or in any way exploit any information, software or other material for commercial purposes, or that contains advertising.

Use the Site to advertise or solicit to anyone to buy or sell products or services, or to make donations of any kind, without our express written approval.

Gather for marketing purposes any email addresses or other personal information that has been posted by other users of the Site.

COMPANY may host message boards, chats and other private/public forums on its Sites and on other platforms. Any user failing to comply with the terms and conditions of this Agreement may be expelled from and refused continued access to, the message boards, groups, chats or other such forums in the future. COMPANY or its designated agents may remove or alter any user-created content at any time for any reason. Message boards, chats and other public forums are intended to serve as discussion centers for users and subscribers. Information and content posted within these public forums may be provided by COMPANY staff, COMPANY’s outside contributors, or by users not connected with COMPANY, some of whom may employ anonymous user names. COMPANY expressly disclaims all responsibility and endorsement and makes no representation as to the validity of any opinion, advice, information or statement made or displayed in these forums by third parties, nor are we responsible for any errors or omissions in such postings, or for hyperlinks embedded in any messages. Under no circumstances will we, our affiliates, suppliers or agents be liable for any loss or damage caused by your reliance on information obtained through these forums. The opinions expressed in these forums are solely the opinions of the participants, and do not reflect the opinions of COMPANY or any of its subsidiaries or affiliates.

COMPANY has no obligation whatsoever to monitor any of the content or postings on the message boards, chat rooms or other public forums on the Sites. However, you acknowledge and agree that we have the absolute right to monitor the same at our sole discretion. In addition, we reserve the right to alter, edit, refuse to post or remove any postings or content, in whole or in part, for any reason and to disclose such materials and the circumstances surrounding their transmission to any third party in order to satisfy any applicable law, regulation, legal process or governmental request and to protect ourselves, our clients, sponsors, users and visitors.

Registration

To access certain features of the Site, we may ask you to provide certain demographic information including your gender, year of birth, zip code and country. In addition, if you elect to sign-up for a particular feature of the Site, such as chat rooms, web logs, or bulletin boards, you may also be asked to register with us on the form provided and such registration may require you to provide personally identifiable information such as your name and email address. You agree to provide true, accurate, current and complete information about yourself as prompted by the Site’s registration form. If we have reasonable grounds to suspect that such information is untrue, inaccurate, or incomplete, we have the right to suspend or terminate your account and refuse any and all current or future use of the Site (or any portion thereof). Our use of any personally identifiable information you provide to us as part of the registration process is governed by the terms of our Privacy Policy.

Passwords

To use certain features of the Site, you will need a username and password, which you will receive through the Site’s registration process. You are responsible for maintaining the confidentiality of the password and account, and are responsible for all activities (whether by you or by others) that occur under your password or account. You agree to notify us immediately of any unauthorized use of your password or account or any other breach of security, and to ensure that you exit from your account at the end of each session. We cannot and will not be liable for any loss or damage arising from your failure to protect your password or account information.

UNDER NO CIRCUMSTANCES, INCLUDING, BUT NOT LIMITED TO, NEGLIGENCE, SHALL WE, OUR SUBSIDIARY AND PARENT COMPANIES OR AFFILIATES BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES THAT RESULT FROM THE USE OF, OR THE INABILITY TO USE, THE SITE, INCLUDING OUR MESSAGING, BLOGS, COMMENTS OF OTHERS, BOOKS, EMAILS, PRODUCTS, OR SERVICES, OR THIRD-PARTY MATERIALS, PRODUCTS, OR SERVICES MADE AVAILABLE THROUGH THE SITE OR BY US IN ANY WAY, EVEN IF WE ARE ADVISED BEFOREHAND OF THE POSSIBILITY OF SUCH DAMAGES. (BECAUSE SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF CERTAIN CATEGORIES OF DAMAGES, THE ABOVE LIMITATION MAY NOT APPLY TO YOU. IN SUCH STATES, OUR LIABILITY AND THE LIABILITY OF OUR SUBSIDIARY AND PARENT COMPANIES OR AFFILIATES IS LIMITED TO THE FULLEST EXTENT PERMITTED BY SUCH STATE LAW.) YOU SPECIFICALLY ACKNOWLEDGE AND AGREE THAT WE ARE NOT LIABLE FOR ANY DEFAMATORY, OFFENSIVE OR ILLEGAL CONDUCT OF ANY USER. IF YOU ARE DISSATISFIED WITH THE SITE, ANY MATERIALS, PRODUCTS, OR SERVICES ON THE SITE, OR WITH ANY OF THE SITE’S TERMS AND CONDITIONS, YOUR SOLE AND EXCLUSIVE REMEDY IS TO DISCONTINUE USING THE SITE AND THE PRODUCTS, SERVICES AND/OR MATERIALS.

THIS SITE IS CONTINUALLY UNDER DEVELOPMENT AND COMPANY MAKES NO WARRANTY OF ANY KIND, IMPLIED OR EXPRESS, AS TO ITS ACCURACY, COMPLETENESS OR APPROPRIATENESS FOR ANY PURPOSE.

WITH REGARDS TO CONTENT RELATING TO HEALTH & WELLNESS ON THE SITE:

THIS SITE OFFERS HEALTH, WELLNESS, FITNESS AND NUTRITIONAL INFORMATION AND IS DESIGNED FOR EDUCATIONAL PURPOSES ONLY. YOU SHOULD NOT RELY ON THIS INFORMATION AS A SUBSTITUTE FOR, NOR DOES IT REPLACE, PROFESSIONAL MEDICAL ADVICE, DIAGNOSIS, OR TREATMENT. IF YOU HAVE ANY CONCERNS OR QUESTIONS ABOUT YOUR HEALTH, YOU SHOULD ALWAYS CONSULT WITH A PHYSICIAN OR OTHER HEALTH-CARE PROFESSIONAL. DO NOT DISREGARD, AVOID OR DELAY OBTAINING MEDICAL OR HEALTH RELATED ADVICE FROM YOUR HEALTH-CARE PROFESSIONAL BECAUSE OF SOMETHING YOU MAY HAVE READ ON THIS SITE. THE USE OF ANY INFORMATION PROVIDED ON THIS SITE IS SOLELY AT YOUR OWN RISK.

NOTHING STATED OR POSTED ON THIS SITE OR AVAILABLE THROUGH ANY SERVICES ARE INTENDED TO BE, AND MUST NOT BE TAKEN TO BE, THE PRACTICE OF MEDICAL OR COUNSELING CARE. FOR PURPOSES OF THIS AGREEMENT, THE PRACTICE OF MEDICINE AND COUNSELING INCLUDES, WITHOUT LIMITATION, PSYCHIATRY, PSYCHOLOGY, PSYCHOTHERAPY, OR PROVIDING HEALTH CARE TREATMENT, INSTRUCTIONS, DIAGNOSIS, PROGNOSIS OR ADVICE.

Liability

(1) COMPANY undertakes to perform all agreed services carefully and to the best of his/her knowledge. There is no guarantee for success in the provision of the service in coaching or in programs, events and/or trainings.

By making an appointment or registering for programs, events and trainings, the client confirms that he/she is acting on his/her own responsibility. He/she acknowledges that he/she is fully responsible for his/her own physical and mental health.

The COMPANY will only pay damages for whatever legal reason:

a. In the case of intent or fraudulent misrepresentation in the full amount; in the case of gross negligence or failure despite an assumed guarantee only in the amount of the foreseeable damage that should have been prevented by the duty of care or the guarantee;

b. In other cases only from breach of an essential obligation, if the purpose of the contract is endangered thereby, from delay and impossibility, always limited to typical direct damages foreseeable at the time of conclusion of the contract and limited in amount to the total remuneration of the contract. The COMPANY is not liable for consequential damages caused by slight negligence, other indirect damages and loss of profit.

The objection of contributory negligence remains open. Liability for all other damages is excluded, whereby the legal liability for personal injury remains unaffected.

Insofar as claims for damages are due according to this paragraph, these shall become statute-barred within one year from the statutory commencement of the limitation period. This shall not apply in the case of liability due to intent, gross negligence, injury to life, body or health or fraudulent concealment of a defect.

Informed Consent to Services & Coaching Practice

The intention of this section is to help the Client become better informed so that they may give or withhold consent to undergo the healthy lifestyle recommendations after having an opportunity to discuss health and wellbeing concerns - including potential benefits and risks, options and alternatives.

The COMPANY offers genetic, health, wellness, lifestyle, pre & perinatal, and nutritional information and is provided for informational purposes only. A coaching session nor the material of any of the COMPANY programs, events or trainings are not a substitute for, nor does it replace, professional medical advice, diagnosis, or treatment. The Client agreed to always speak with his/her primary healthcare provider before taking any medication or nutritional supplement or using any treatment for a health problem. The Client agree to maintain direct contact with a licensed health care provider that is appropriate for the patient’s age, gender and known or suspected health conditions. Nothing available through any services offered by the COMPANY is intended to be, and must not be taken to be, the practice of medicine.

The Client acknowledge the opportunity to read and inquire about this consent and all the items addressed herein and hereby authorize the COMPANY, in accordance and within the scope and limits of her Holistic Health Coaching competences to recommend procedures including but not limited to: laboratory, ultrasound, functional laboratory testing, dietary advice and guidelines and the promotion of wellness including, but not limited to, recommendations for sleep, exercise, stress management and reduction, balancing of work and self-care activities, and developing and nurturing healthy relationships and community relationships. Functional nutrition, nutritional supplementation and vitamin, mineral, amino acid, lipid, phytonutrient, and metabolite precursor and other nutrient. Botanical herbs and plant derivatives prescribed as loose teas, alcohol or glycerin tinctures, capsules, tablets, creams, suppositories, etc. Physical interventions, massage, stretching, exercises, contrast heat/cold applications and manual or instrument-assisted joint mobilizations. Lifestyle and Wellness Counseling to promote improved lifestyle strategies and wellness, but not including the specific treatment of known or suspected mental illness.

The Client acknowledges the right, opportunity and responsibility to ask questions and to become informed regarding the COMPANY´s recommendations to his or her satisfaction. The Client acknowledges that all questions asked have been fully answered by the COMPANY.

The Client acknowledges and accepts that there are risks to the measures that may include: unintended exacerbation of symptoms, new symptoms, allergic and other unintended side effects from exercise, lifestyle modifications, dietary modifications, herbal and nutritional supplements, adverse interactions with drugs, herbs and/or nutrients. The specific risks associated with the proposed procedures have been explained to the Client.

The Client acknowledges that treatment may result in the restoration of health and wellbeing as of optimal functional capacity, relief of pain and symptoms, and prevention or reversal or disease of a condition progression, but ALSO acknowledges that no expressed or implied guarantees or representations can or have been made by the COMPANY or any affiliated staff regarding the cure or improvement of a Client´s condition.

The Client acknowledges that the COMPANY cannot know or anticipate and explain every possible detailed information on the health lifestyle recommendations, and that the Client or representative willingly chooses to rely on the COMPANY to exercise their best judgment for any of the above.

The Client agrees to alert the COMPANY should she suspect that she is or may be pregnant in acknowledgement that some of the lifestyle interventions and recommendations could present risks to a pregnancy.

The Client understands that is free to discontinue participation in any and all aspects of the recommendations provided by the COMPANY at any time, and that the Client is responsible for informing the COMPANY of the adherence to or discontinuation of any and all aspects of recommendations and that the choice to discontinue healthy lifestyle interventions may create the risk of adverse effects for which the patient or representative bears full and sole responsibility.

The Client understands he/she bears full responsibility for any adverse effects experienced during or after the course of implementing lifestyle changes that were reasonably deemed to be caused or related to a deficit in the full, accurate and timely disclosure of symptoms and other medical information to the Coach to the best of the Client´s ability.

Confidentiality

Offers, invitations to tender, coaching and counselling concepts, personally produced CDs, MP3 files, e-books, online documents and other documents made available to the client by the COMPANY are protected by copyright.

All documents, videos, audios, PDFs, e-books etc. handed over or made available to the client are exclusively for personal use.

The customer is not permitted to reproduce the documents or parts thereof and/or make them accessible to third parties. Publication - even in part - is prohibited and may be prosecuted.

Data Protection

The COMPANY will only process or use personal data of the client for contractually agreed purposes.

The data will be treated confidentially.

In all other respects, the COMPANY´s data protection declaration, which can be accessed via the internet address Lambretta-Lutz.de/Legal shall apply.

The Client expressly consents to his/her health data being processed by the COMPANY within the framework of the service. The consent also extends to the forwarding of health samples (saliva, urine, faeces etc.) for evaluation to the corresponding laboratories.

The declaration of consent is voluntary. The Client can refuse it without giving reasons and without having to fear any disadvantages because of this.

The above consent is valid until the Client revokes it. The Client can declare this revocation at any later time by telephone, in writing or per e-mail without giving reasons. Furthermore, the Client is entitled to the other rights outlined in the data protection information of the COMPANY.

The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation. Insofar as there is another legal basis for the further processing of the Client's data, the Coach is entitled to do so. Otherwise, the Client's data will be deleted upon revocation of consent.

The Client agrees that records of the services provided will be kept for a minimum of three, but no more than ten years after the date of the last appointment or consultation. The Client understands that his/her records will be kept securely and confidentially and without release to others unless so directed by the Client, or as may be required by law or as necessary for insurance claim or other payment processing.

The Client accepts that the COMPANY or associated staff may contact the Client (e.g. by phone, email, voicemail, SMS text message) to consult or exchange information related to the Clients records and care.

The Client agrees that the COMPANY may consult with preceptors and colleagues related to the case and care provided, without disclose of the Clients identity.

Final Provisions

Place of performance is the COMPANY´s registered office in Munich.

The invalidity of one of the above conditions does not affect the validity of the remaining conditions. In such a case, the COMPANY and the Client are obliged to effectively replace an invalid provision with one that comes closest to the economic purpose of the invalid provision.

Amendments and additions to contractual provisions must be made in writing in order to be effective and must be signed by an authorized representative of each party. This also applies to all amendments or waivers of the written form requirement.

Right of Cancellation & Refund Policy

When concluding a distance selling transaction, consumers generally have a statutory right of withdrawal.

The Client the right to withdraw from this contract within fourteen days without giving any reason.

In order to exercise your right of withdrawal, you must inform [Lutz Höppner, Am Lochholz 28a, 80999 Munich, info@Lambretta-Lutz.de, of your decision to withdraw from this contract by means of a clear declaration (e.g. a letter sent by post, fax or e-mail). You may use the enclosed model withdrawal form for this purpose, which is, however, not mandatory.

The withdrawal period is fourteen days from the day of the conclusion of the contract.

In order to comply with the revocation period, it is sufficient that you send the notification of the exercise of the right of revocation before the expiry of the revocation period.

The Client accept to pay the corresponding amount of the services already provided up to the time of notification of the exercise of the right of withdrawal with regard to this contract compared to the total scope of the services provided for in the contract.

No given services provided but paid will be refunded minus a processing fee of 15%. Shipping fees are not refundable.

Due to the fees we incur after the order of a test is placed, we are unable to offer refunds, returns or exchanges on test orders of any kind.

The Supplier shall provide information on the model withdrawal form in accordance with the statutory provisions as follows:

Model withdrawal form:

- To Lutz Höppner Am Lochholz 28a, 80999 Munich:

- I/we (*) hereby revoke the contract concluded by me/us (*) for the purchase of the following goods (*) for the purchase of the following goods (*)/ the provision of the following service (*)

- Ordered on (*)/received on (*)

- Name of the consumer(s)

- Address of the consumer(s)

- Signature of consumer(s) (only in case of paper communication)

- Date(s)

(*) Delete where inapplicable.

Additionaly, the Client acknowledge that the purchase or products or services through affiliated links and any transactions conducted via these links are governed by the individual terms, refund policies, and cancellation procedures established by the respective vendors or merchants. It's crucial to understand that the procedures for refunds, cancellations, and terms of purchases made through affiliate links are directly managed by third-party vendors or merchants and may not align with the policies articulated in this withdrawal policy.

Digital Millennium Copyright Act

The Digital Millennium Copyright Act of 1998 (the “DMCA”) provides recourse for copyright owners who believe that material appearing on the Internet infringes their rights. If you believe in good faith that materials hosted by COMPANY infringe your copyright, you, or your agent may send to COMPANY a notice requesting that the material be removed or access to it be blocked. Any notification by a copyright owner or a person authorized to act on its behalf that fails to comply with requirements of the DMCA shall not be considered sufficient notice and shall not be deemed to confer upon COMPANY actual knowledge of facts or circumstances from which infringing material or acts are evident. If you believe in good faith that a notice of copyright infringement has been wrongly filed against you, the DMCA permits you to send to COMPANY a counter-notice. All notices and counter notices must meet the then current statutory requirements imposed by the DMCA; see www.loc.gov/copyright for details. COMPANY’s Copyright Agent for notice shall be admin@Lambretta-Lutz.de

Assignment

This Agreement shall be binding upon and inure to the benefit of COMPANY and our respective assigns, successors, heirs, and legal representatives. Neither this Agreement nor any rights hereunder may be assigned without the prior written consent of COMPANY Notwithstanding the foregoing, all rights and obligations under this Agreement may be freely assigned by COMPANY to any affiliated entity or any of its wholly owned subsidiaries.

Dispute Resolution

The law of the Federal Republic of Germany shall apply to the exclusion of the UN Convention on Contracts for the International Sale of Goods. If the customer is a consumer and has his habitual residence in another country at the time of his order, the application of mandatory legal provisions of this country shall remain unaffected by the choice of law.

2) If the Customer is a merchant, the exclusive place of jurisdiction for all disputes arising directly or indirectly from the contractual relationship shall be the registered office of COMPANY in Munich. However, the COMPANY is also entitled to take legal action at the Customer's place of business.

Class Action Waiver

You may only resolve disputes with us on an individual basis, and may not bring a claim as a plaintiff or a class member in a class, consolidated, or representative action. Class arbitrations, class actions, private attorney general actions, and consolidation with other arbitrations aren’t allowed.

The arbitrator may not consolidate more than one person’s claims, and may not otherwise preside over any form of a class or representative proceeding or claims (such as a class action, consolidated action or private attorney general action) unless all relevant parties specifically agree to do so following initiation of the arbitration.

Severability

If any clause within these Terms of Service (other than the Class Action Waiver clause above) is found to be illegal or unenforceable, that clause will be severed from these Terms of Service, and the remainder of these Terms of Service will be given full force and effect. If the Class Action Waiver clause is found to be illegal or unenforceable, this entire Provision will be unenforceable and the dispute will be decided by a court

Privacy Policy

Updated January, 2021

The following Privacy Policy governs the online information collection practices of Lambretta-Lutz.de (“Lutz” “we” or “us”). Specifically, it outlines the types of information that we gather about you while you are using the Lambretta-Lutz.de website (the “Site”), and the ways in which we use this information. This Privacy Policy, including our children’s privacy statement, does not apply to any information you may provide to us or that we may collect offline and/or through other means (for example, at a live event, via telephone, or through the mail).

Please read this Privacy Policy carefully. By visiting and using the Site, you agree that your use of our Site, and any dispute over privacy, is governed by this Privacy Policy. Because the Web is an evolving medium, we may need to change our Privacy Policy at some point in the future, in which case we’ll post the changes to this Privacy Policy on this website and update the Effective Date of the policy to reflect the date of the changes. By continuing to use the Site after we post any such changes, you accept the Privacy Policy as modified.

How We Collect and Use Information

We may collect and store personal or other information that you voluntarily supply to us online while using the Site (e.g., while on the Site or in responding via email to a feature provided on the Site). The Site only contacts individuals who specifically request that we do so or in the event that they have signed up to receive our messaging, attended one of our events, or have purchased one of our products. The Site collects personally identifying information from our users during online registration and online purchasing. Generally, this information includes name and e-mail address for registration or opt-in purposes and name, postal address, and credit card information when registering for our events or purchasing our products. All of this information is provided to us by you.

We also collect and store information that is generated automatically as you navigate online through the Site. For example, we may collect information about your computer’s connection to the Internet, which allows us, among other things, to improve the delivery of our web pages to you and to measure traffic on the Site. We also may use a standard feature found in browser software called a “cookie” to enhance your experience with the Site. Cookies are small files that your web browser places on your hard drive for record-keeping purposes. By showing how and when visitors use the Site, cookies help us deliver advertisements, identify how many unique users visit us, and track user trends and patterns. They also prevent you from having to re-enter your preferences on certain areas of the Site where you may have entered preference information before. The Site also may use web beacons (single-pixel graphic files also known as “transparent GIFs”) to access cookies and to count users who visit the Site or open HTML-formatted email messages.

We use the information we collect from you while you are using the Site in a variety of ways, including using the information to customize features; advertising that appear on the Site; and, making other offers available to you via email, direct mail or otherwise. We also may provide your information to third parties, such as service providers, contractors and third-party publishers and advertisers for a variety of purposes. Unless you inform us in accordance with the process described below, we reserve the right to use, and to disclose to third parties, all of the information collected from and about you while you are using the Site in any way and for any purpose, such as to enable us or a third party to provide you with information about products and services. If you do not wish your information to be used for these purposes, you must send a letter to the Online Privacy Coordinator whose address is listed at the end of this Privacy Policy requesting to be taken off any lists of information that may be used for these purposes or that may be given or sold to third-parties.

Please keep in mind that whenever you voluntarily make your personal information available for viewing by third parties online – for example on message boards, web logs, through email, or in chat areas – that information can be seen, collected and used by others besides us. We cannot be responsible for any unauthorized third-party use of such information.

Be aware that we may occasionally release information about our visitors when release is appropriate to comply with law or to protect the rights, property or safety of users of the Site or the public.

Please also note that as our business grows, we may buy or sell various assets. In the unlikely event that we sell some or all of our assets, or one or more of our websites is acquired by another company, information about our users may be among the transferred assets.

Google Analytics

We also use Google Analytics Advertiser Features to optimize our business. Advertiser features include:

Remarketing with Google Analytics

Google Display Network Impression Reporting

DoubleClick Platform integrations

Google Analytics Demographics and Interest Reporting

By enabling these Google Analytics Display features, we are required to notify our visitors by disclosing the use of these features and that we and third-party vendors use first-party cookies (such as the Google Analytics cookie) or other first-party identifiers, and third-party cookies (such as the DoubleClick cookie) or other third-party identifiers together to gather data about your activities on our Site. Among other uses, this allows us to contact you if you begin to fill out our check-out form but abandon it before completion with an email reminding you to complete your order. The “Remarketing” feature allows us to reach people who previously visited our Site, and match the right audience with the right advertising message.

You can opt out of Google’s use of cookies by visiting Google’s ad settings and/or you may opt out of a third-party vendor’s use of cookies by visiting the Network Advertising Initiative opt-out page.

General Data Privacy Regulation (GDPR)

The GDPR took effect on May 25, 2018, and is intended to protect the data of European Union (EU) citizens.

If the data that you provide to us in the course of your use of our site, content, products and/or services is governed by GDPR, we will abide by the relevant portions of the Regulation.

If you are a resident of the European Economic Area (EEA), or are accessing this site from within the EEA, you may have the right to request: access to, correction of, deletion of; portability of; and restriction or objection to processing, of your personal data, from us. This includes the “right to be forgotten.”

To make any of these requests, please contact our GDPR contact: admin@Lambretta-Lutz.de

California Consumer Privacy Act (CCPA)

The CCPA took effect on January 1, 2020, and is intended to protect the personal information of California residents.

The CCPA has certain threshold requirements which a company must meet in order to be required to comply with its provisions. Upon information and belief, our company does not meet those thresholds. In the event of a change in our status, and if the data that you provide in the course of your use of our site, content, products and/or services is governed by CCPA, we will abide by the relevant portions of the Act.

If you are a resident of the state of California, you may have the right to: request disclosure of the personal information we have collected about you and the types of third parties with whom it has been shared; request a portable copy of your information; opt out from marketing messages or the sale of your information to third parties; and request deletion of your personal information.

To make these requests, please contact our CCPA contact at admin@Lambretta-Lutz.de

Children's Privacy Statement

This children’s privacy statement explains our practices with respect to the online collection and use of personal information from children, and provides important information regarding their rights under federal law with respect to such information.

This Site is not directed to children and we do NOT knowingly collect personally identifiable information from children as part of the Site. If we become aware that we have inadvertently received personally identifiable information from a user under age as part of the Site, we will delete such information from our records. If we change our practices in the future, we will obtain prior, verifiable parental consent before collecting any personally identifiable information from children as part of the Site.

Because we do not collect any personally identifiable information from children as part of the Site, we also do NOT knowingly distribute such information to third parties.

Because we do not collect any personally identifiable information from children as part of the Site, we do NOT condition the participation of a child in the Site’s online activities on providing personally identifiable information.

Confidentiality

All documents, videos, audios, PDFs, e-books etc. handed over or made available to the client are exclusively for personal use.

The customer is not permitted to reproduce the documents or parts thereof and/or make them accessible to third parties. Publication - even in part - is prohibited and may be prosecuted.

Data Protection

The COMPANY will only process or use personal data of the client for contractually agreed purposes.

The data will be treated confidentially.

In all other respects, the COMPANY´s data protection declaration, which can be accessed via the internet address Lambretta-Lutz.de/privacypolicy shall apply.

The declaration of consent is voluntary. The Client can refuse it without giving reasons and without having to fear any disadvantages because of this.

The Client agrees that the COMPANY may consult with preceptors and colleagues related to the case and care provided, without disclose of the Clients identity.

Disclaimer

This policy may be changed at any time at our discretion. If we should update this policy, we will post the updates to this page on our Website.

If you have any questions or concerns regarding our privacy policy please direct them to: admin@Lambretta-Lutz.de

Google Data Processing Terms

Updated September, 2023

Google and the counterparty agreeing to these terms (“Customer”) have entered into an agreement for the provision of the Processor Services (as amended from time to time, the “Agreement”).

These Google Ads Data Processing Terms (including the appendices, “Data Processing Terms”) are entered into by Google and Customer and supplement the Agreement. These Data Processing Terms will be effective, and replace any previously applicable terms relating to their subject matter (including any data processing amendment or data processing addendum relating to the Processor Services), from the Terms Effective Date.

If you are accepting these Data Processing Terms on behalf of Customer, you warrant that: (a) you have full legal authority to bind Customer to these Data Processing Terms; (b) you have read and understand these Data Processing Terms; and (c) you agree, on behalf of Customer, to these Data Processing Terms. If you do not have the legal authority to bind Customer, please do not accept these Data Processing Terms.

Introduction

These Data Processing Terms reflect the parties’ agreement on the terms governing the processing of Customer Personal Data.

2.Definitions and Interpretation

2.1In these Data Processing Terms:

“Additional Product” means a product, service or application provided by Google or a third party that: (a) is not part of the Processor Services; and (b) is accessible for use within the user interface of the Processor Services or is otherwise integrated with the Processor Services.

“Additional Terms” means the additional terms referred to in Appendix 3, which reflect the parties’ agreement on the terms governing the processing of Customer Personal Data in connection with certain Applicable Data Protection Legislation.

“Affiliate” means an entity that directly or indirectly controls, is controlled by, or is under common control with, a party.

“Applicable Data Protection Legislation” means, as applicable to the processing of Customer Personal Data, any national, federal, EU, state, provincial or other privacy, data security or data protection law or regulation including European Data Protection Legislation, the LGPD and US State Privacy Laws.

“Customer Personal Data” means personal data that is processed by Google on behalf of Customer in Google’s provision of the Processor Services.

“Data Incident” means a breach of Google’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data on systems managed by or otherwise controlled by Google. “Data Incidents” will not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.

“Data Subject Tool” means a tool (if any) made available by a Google Entity to data subjects that enables Google to respond directly and in a standardised manner to certain requests from data subjects in relation to Customer Personal Data (for example, online advertising settings or an opt-out browser plugin).

“EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

“European Data Protection Legislation” means, as applicable: (a) the GDPR; and/or (b) the Swiss FDPA.

“GDPR” means, as applicable: (a) the EU GDPR; and/or (b) the UK GDPR.

“Google” means the Google Entity that is party to the Agreement.

“Google Entity” means Google LLC, Google Ireland Limited or any other Affiliate of Google LLC.

“Instructions” has the meaning given in Section 5.2 (Customer’s Instructions).

“ISO 27001 Certification” means ISO/IEC 27001:2013 certification or a comparable certification for the Processor Services.

“LGPD” means the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais).

“New Subprocessor” has the meaning given in Section 11.1 (Consent to Subprocessor Engagement).

“Notification Email Address” means the email address designated by Customer, via the user interface of the Processor Services or such other means provided by Google, to receive certain notifications from Google relating to these Data Processing Terms.

“Processor Services” means the applicable services listed at business.safety.google/adsservices.

“Security Documentation” means the certificate issued for the ISO 27001 Certification and any other security certifications or documentation that Google may make available in respect of the Processor Services.

“Security Measures” has the meaning given in Section 7.1.1 (Google’s Security Measures).

“Subprocessors” means third parties authorised under these Data Processing Terms to have logical access to and process Customer Personal Data in order to provide parts of the Processor Services and any related technical support.

“Swiss FDPA” means, as applicable, the Federal Data Protection Act of 19 June 1992 (Switzerland) (with the Ordinance to the Federal Data Protection Act of 14 June 1993), or the revised Federal Data Protection Act of 25 September 2020 (with the Ordinance to the Federal Data Protection Act of 31 August 2022).

“Term” means the period from the Terms Effective Date until the end of Google’s provision of the Processor Services under the Agreement.

“Terms Effective Date” means the date on which Customer clicked to accept or the parties otherwise agreed to these Data Processing Terms.

“UK GDPR” means the EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018, and applicable secondary legislation made under that Act.

“US State Privacy Laws” means, as applicable: (i) the California Consumer Privacy Act of 2018 (including as amended by the California Privacy Rights Act of 2020), together with all implementing regulations (“CCPA”); (ii) Virginia’s Consumer Data Protection Act, Va. Code Ann. § 59.1-571 et seq.; and (iii) the Colorado Privacy Act, Colo. Rev. Stat. § 6-1-1301 et seq.; (iv) Connecticut’s Act Concerning Data Privacy and Online Monitoring, Pub. Act No. 22015; and (v) the Utah Consumer Privacy Act, Utah Code Ann. § 13-61-101 et seq.

2.2The terms “controller”, “data subject”, “personal data”, “processing” and “processor” as used in these Data Processing Terms have the meanings given by either (a) Applicable Data Protection Legislation; or (b) absent any such meaning or law, the GDPR.

2.3The words “include” and “including” mean “including but not limited to”. Any examples in these Data Processing Terms are illustrative and not the sole examples of a particular concept.

2.4Any reference to a legal framework, statute or other legislative enactment is a reference to it as amended or re-enacted from time to time.

2.5To the extent any translated version of these Data Processing Terms is inconsistent with the English version, the English version will govern.

3.Duration of these Data Processing Terms

These Data Processing Terms will take effect on the Terms Effective Date. Regardless of whether the Agreement has terminated or expired, these Data Processing Terms will remain in effect until, and automatically expire when, Google deletes all Customer Personal Data as described in these Data Processing Terms.

4.Application of these Data Processing Terms

4.1General. These Data Processing Terms will only apply to the Processor Services for which the parties agreed to these Data Processing Terms, for example: (a) the Processor Services for which Customer clicked to accept these Data Processing Terms; or (b) if the Agreement incorporates these Data Processing Terms by reference, the Processor Services that are the subject of the Agreement.

4.2Incorporation of Additional Terms. The Additional Terms supplement these Data Processing Terms.

5.Processing of Data

5.1Roles and Regulatory Compliance; Authorisation.

5.1.1Processor and Controller Responsibilities. The parties acknowledge and agree that:

(a)Appendix 1 describes the subject matter and details of the processing of Customer Personal Data;

(b)Google is a processor of Customer Personal Data;

(c)Customer is a controller or processor, as applicable, of Customer Personal Data; and

(d)each party will comply with the obligations applicable to it under Applicable Data Protection Legislation with respect to the processing of Customer Personal Data.

5.1.2Processor Customers. If Customer is a processor:

(a)Customer warrants on an ongoing basis that the relevant controller has authorised: (i) the Instructions, (ii) Customer’s appointment of Google as another processor, and (iii) Google’s engagement of Subprocessors as described in Section 11 (Subprocessors);

(b)Customer will forward to the relevant controller promptly and without undue delay any notice provided by Google under Sections 7.2.1 (Incident Notification) or 11.4 (Opportunity to Object to Subprocessor Changes); and

(c)Customer may make available to the relevant controller any information made available by Google under Sections 7.4 (Security Certification), 10.2 (Data Centre Information) and 11.2 (Information about Subprocessors).

5.2Customer’s Instructions. By entering into these Data Processing Terms, Customer instructs Google to process Customer Personal Data only in accordance with applicable law: (a) to provide the Processor Services and any related technical support; (b) as further specified via Customer’s use of the Processor Services (including in the settings and other functionality of the Processor Services) and any related technical support; (c) as documented in the form of the Agreement (including these Data Processing Terms); and (d) as further documented in any other written instructions given by Customer and acknowledged by Google as constituting instructions for purposes of these Data Processing Terms (collectively, the “Instructions”).

5.3Google’s Compliance with Instructions. Google will comply with the Instructions unless prohibited by applicable laws, or such applicable laws require other processing.

5.4Additional Products. If Customer uses any Additional Product, the Processor Services may allow that Additional Product to access Customer Personal Data as required for the interoperation of the Additional Product with the Processor Services. For clarity, these Data Processing Terms do not apply to the processing of personal data in connection with the provision of any Additional Product used by Customer, including personal data transmitted to or from that Additional Product.

6.Data Deletion

6.1Deletion During Term.

6.1.1Processor Services With Deletion Functionality. During the Term, if:

(a)the functionality of the Processor Services includes the option for Customer to delete Customer Personal Data;

(b)Customer uses the Processor Services to delete certain Customer Personal Data; and

(c)the deleted Customer Personal Data cannot be recovered by Customer (for example, from the “trash”),

then Google will delete such Customer Personal Data from its systems as soon as reasonably practicable and within a maximum period of 180 days, unless applicable laws require storage.

6.1.2Processor Services Without Deletion Functionality. During the Term, if the functionality of the Processor Services does not include the option for Customer to delete Customer Personal Data, then Google will comply with:

(a)any reasonable request from Customer to facilitate such deletion, insofar as this is possible taking into account the nature and functionality of the Processor Services and unless applicable laws require storage; and

(b)the data retention practices described at policies.google.com/technologies/ads.

Google may charge a fee (based on Google’s reasonable costs) for any data deletion under Section 6.1.2(a). Google will provide Customer with further details of any applicable fee, and the basis of its calculation, in advance of any such data deletion.

6.2Deletion on Term Expiry. Customer instructs Google to delete all remaining Customer Personal Data (including existing copies) from Google’s systems at the end of the Term in accordance with applicable law. Google will comply with this instruction as soon as reasonably practicable and within a maximum period of 180 days, unless applicable laws require storage.

7.Data Security

7.1Google’s Security Measures and Assistance.

7.1.1Google’s Security Measures. Google will implement and maintain technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access as described in Appendix 2 (the “Security Measures”). As described in Appendix 2, the Security Measures include measures: (a) to encrypt personal data; (b) to help ensure the ongoing confidentiality, integrity, availability and resilience of Google’s systems and services; (c) to help restore timely access to personal data following an incident; and (d) for regular testing of effectiveness. Google may update or modify the Security Measures from time to time, provided that such updates and modifications do not result in the degradation of the overall security of the Processor Services.

7.1.2Access and Compliance. Google will: (a) authorise its employees, contractors and Subprocessors to access Customer Personal Data only as strictly necessary to comply with the Instructions; (b) take appropriate steps to ensure compliance with the Security Measures by its employees, contractors and Subprocessors to the extent applicable to their scope of performance; and (c) ensure that all persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

7.1.3Google’s Security Assistance. Google will (taking into account the nature of the processing of Customer Personal Data and the information available to Google) assist Customer in ensuring compliance with Customer’s (or, where Customer is a processor, the relevant controller’s) obligations relating to security of personal data and personal data breaches under Applicable Data Protection Legislation, by:

(a)implementing and maintaining the Security Measures in accordance with Section 7.1.1 (Google’s Security Measures);

(b)complying with the terms of Section 7.2 (Data Incidents); and

(c)providing Customer with the Security Documentation in accordance with Section 7.5 (Verifying Compliance) and the information contained in these Data Processing Terms.

7.2Data Incidents.

7.2.1Incident Notification. If Google becomes aware of a Data Incident, Google will:

(a)notify Customer of the Data Incident promptly and without undue delay; and

(b)promptly take reasonable steps to minimise harm and secure Customer Personal Data.

7.2.2Details of Data Incident. Notifications made under Section 7.2.1 (Incident Notification) will describe: the nature of the Data Incident including the Customer resources impacted; the measures Google has taken, or plans to take, to address the Data Incident and mitigate its potential risk; the measures, if any, Google recommends that Customer take to address the Data Incident; and details of a contact point where more information can be obtained. If it is not possible to provide all such information at the same time, Google’s initial notification will contain the information then available and further information will be provided without undue delay as it becomes available.

7.2.3Delivery of Notification. Google will deliver its notification of any Data Incident to the Notification Email Address or, at Google’s discretion (including if Customer has not provided a Notification Email Address), by other direct communication (for example, by phone call or an in-person meeting). Customer is solely responsible for providing the Notification Email Address and ensuring that the Notification Email Address is current and valid.

7.2.4Third Party Notifications. Customer is solely responsible for complying with incident notification laws applicable to Customer and fulfilling any third party notification obligations related to any Data Incident.

7.2.5No Acknowledgement of Fault by Google. Google’s notification of or response to a Data Incident under this Section 7.2 (Data Incidents) will not be construed as an acknowledgement by Google of any fault or liability with respect to the Data Incident.

7.3Customer’s Security Responsibilities and Assessment.

7.3.1Customer’s Security Responsibilities. Customer agrees that, without prejudice to Google’s obligations under Sections 7.1 (Google’s Security Measures and Assistance) and 7.2 (Data Incidents):

(a)Customer is responsible for its use of the Processor Services, including:

(i)making appropriate use of the Processor Services to ensure a level of security appropriate to the risk in respect of Customer Personal Data; and

(ii)securing the account authentication credentials, systems and devices Customer uses to access the Processor Services; and

(b)Google has no obligation to protect Customer Personal Data that Customer elects to store or transfer outside of Google’s and its Subprocessors’ systems.

7.3.2Customer’s Security Assessment. Customer acknowledges and agrees that the Security Measures implemented and maintained by Google as set out in Section 7.1.1 (Google’s Security Measures) provide a level of security appropriate to the risk in respect of Customer Personal Data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing of Customer Personal Data as well as the risks to individuals.

7.4Security Certification. To evaluate and help ensure the continued effectiveness of the Security Measures, Google will maintain the ISO 27001 Certification.

7.5Verifying Compliance. To demonstrate compliance by Google with its obligations under these Data Processing Terms, and to assist Customer in verifying Google’s compliance with (i) Customer’s Instructions; (ii) its obligations under these Data Processing Terms; and (iii) its obligations under Applicable Data Protection Legislation, Google will:

(a)make the Security Documentation available for review by Customer;

(b)provide the information contained in the Data Processing Terms; and

(c)provide or otherwise make available, in accordance with Google’s standard practices, other materials concerning the nature of the Processor Services and the processing of Customer Personal Data (for example, help centre materials). Customer may also verify Google’s compliance with its obligations under these Data Processing Terms by reviewing the certificate issued for the ISO 27001 Certification (which reflects the outcome of an audit conducted by a third party auditor).

8.Impact Assessments and Consultations

Google will (taking into account the nature of the processing and the information available to Google) assist Customer in ensuring compliance with Customer’s (or, where Customer is a processor, the relevant controller’s) obligations relating to data protection impact assessments and prior regulatory consultations under Applicable Data Protection Legislation, by:

(a)providing the Security Documentation in accordance with Section 7.5 (Verifying Compliance);

(b)providing the information contained in the Agreement (including these Data Processing Terms); and

(c)providing or otherwise making available, in accordance with Google’s standard practices, other materials concerning the nature of the Processor Services and the processing of Customer Personal Data (for example, help centre materials).

9.Data Subject Rights

9.1Responses to Data Subject Requests. If Google receives a request from a data subject in relation to Customer Personal Data, Customer authorises Google to, and Google hereby notifies Customer that it will:

(a)respond directly to the data subject’s request in accordance with the standard functionality of the Data Subject Tool (if the request is made via a Data Subject Tool); or

(b)advise the data subject to submit their request to Customer, and Customer will be responsible for responding to such request (if the request is not made via a Data Subject Tool).

9.2Google’s Data Subject Request Assistance. Google will assist Customer in fulfilling its (or, where Customer is a processor, the relevant controller’s) obligations under Applicable Data Protection Legislation to respond to requests for exercising the data subject’s rights, in all cases taking into account the nature of the processing of Customer Personal Data and, if applicable, Article 11 of the GDPR, by:

(a)providing the functionality of the Processor Services;

(b)complying with the commitments set out in Section 9.1 (Responses to Data Subject Requests); and

(c)if applicable to the Processor Services, making available Data Subject Tools.

9.3Rectification. If Customer becomes aware that any Customer Personal Data is inaccurate or outdated, Customer will be responsible for rectifying or deleting that data if required by Applicable Data Protection Legislation, including (where available) by using the functionality of the Processor Services.

10.Data Transfers

10.1Data Storage and Processing Facilities. Subject to any provisions applicable to data transfers set out in the Additional Terms, Google may process Customer Personal Data in any country in which Google or its Subprocessors maintain facilities.

10.2Data Centre Information. Information about the locations of Google data centres is available at www.google.com/about/datacenters/locations/.

11.Subprocessors

11.1Consent to Subprocessor Engagement. Customer specifically authorises the engagement as Subprocessors of those entities listed as of the Terms Effective Date at the URL specified in Section 11.2 (Information about Subprocessors). In addition, without prejudice to Section 11.4 (Opportunity to Object to Subprocessor Changes) Customer generally authorises the engagement of any other third parties as Subprocessors (“New Subprocessors”).

11.2Information about Subprocessors. Information about Subprocessors is available at business.safety.google/adssubprocessors.

11.3Requirements for Subprocessor Engagement. When engaging any Subprocessor, Google will:

(a)ensure via a written contract that the Subprocessor only accesses and uses Customer Personal Data to the extent required to perform the obligations subcontracted to it, and does so in accordance with the Agreement (including these Data Processing Terms); and

(b)remain fully liable for all obligations subcontracted to, and all acts and omissions of, the Subprocessor.

11.4Opportunity to Object to Subprocessor Changes.

(a)When any New Subprocessor is engaged during the Term, Google will, at least 30 days before the New Subprocessor processes any Customer Personal Data, inform Customer of the engagement (including the name and location of the relevant New Subprocessor and the activities it will perform) by sending an email to the Notification Email Address.

(b)Customer may object to any New Subprocessor by terminating the Agreement for convenience immediately upon written notice to Google, on condition that Customer provides such notice within 90 days of being informed of the engagement of the New Subprocessor as described in Section 11.4(a).

12.Contacting Google; Processing Records

12.1Contacting Google. Customer may contact Google in relation to the exercise of its rights under these Data Processing Terms via the methods described at privacy.google.com/businesses/processorsupport or via such other means as may be provided by Google from time to time. Google will provide prompt and reasonable assistance with Customer queries Google receives via such means, and that relate to the processing of Customer Personal Data under the Agreement.

12.2Google’s Processing Records. Google will keep appropriate documentation of its processing activities as required by Applicable Data Protection Legislation.

12.3Controller Requests. If Google receives a request or instruction via the methods described in Section 12.1 (or any other method) from a third party purporting to be a controller of Customer Personal Data, Google will advise the third party to contact Customer.

13.Liability

If the Agreement is governed by the laws of:

(a)a state of the United States of America, then, regardless of anything else in the Agreement, the total liability of either party towards the other party under or in connection with these Data Processing Terms will be limited to the maximum monetary or payment-based amount at which that party’s liability is capped under the Agreement (and therefore, any exclusion of indemnification claims from the Agreement’s limitation of liability will not apply to indemnification claims under the Agreement relating to the Applicable Data Protection Legislation); or

(b)a jurisdiction that is not a state of the United States of America, then the liability of the parties under or in connection with these Data Processing Terms will be subject to the exclusions and limitations of liability in the Agreement.

14.Effect of these Data Processing Terms

14.1Order of Precedence. If there is any conflict or inconsistency between the Additional Terms, the remainder of these Data Processing Terms and/or the remainder of the Agreement, then the following order of precedence will apply:

(a)the Additional Terms (if applicable);

(b)the remainder of these Data Processing Terms; and

(c)the remainder of the Agreement.

Subject to the amendments in these Data Processing Terms, the Agreement remains in full force and effect.

14.2No Effect on Controller Terms. These Data Processing Terms will not affect any separate terms between Google and Customer reflecting a controller-controller relationship for a service other than the Processor Services.

15.Changes to these Data Processing Terms

15.1Changes to URLs. From time to time, Google may change any URL referenced in these Data Processing Terms and the content at any such URL, except that Google may only change the list of potential Processor Services at business.safety.google/adsservices:

(a)to reflect a change to the name of a service;

(b)to add a new service; or

(c)to remove a service (or a feature of a service) where either: (i) all contracts for the provision of that service are terminated; (ii) Google has Customer’s consent; or (iii) the service, or a certain feature of the service, has been recategorised as a controller service.

15.2Changes to Data Processing Terms. Google may change these Data Processing Terms if the change:

(a)is expressly permitted by these Data Processing Terms, including as described in Section 15.1 (Changes to URLs);

(b)reflects a change in the name or form of a legal entity;

(c)is required to comply with applicable law, applicable regulation, a court order or guidance issued by a governmental regulator or agency, or reflects Google’s adoption of an Alternative Transfer Solution (as defined in Appendix 3A); or

(d)does not: (i) result in a degradation of the overall security of the Processor Services; (ii) expand the scope of, or remove any restrictions on, (x) in the case of the Additional Terms, Google’s rights to use or otherwise process the data in scope of the Additional Terms or (y) in the case of the remainder of these Data Processing Terms, Google’s processing of Customer Personal Data, as described in Section 5.3 (Google’s Compliance with Instructions); and (iii) otherwise have a material adverse impact on Customer’s rights under these Data Processing Terms, as reasonably determined by Google.

15.3Notification of Changes. If Google intends to change these Data Processing Terms under Section 15.2(c) or (d), Google will inform Customer at least 30 days (or such shorter period as may be required to comply with applicable law, applicable regulation, a court order or guidance issued by a governmental regulator or agency) before the change will take effect by either: (a) sending an email to the Notification Email Address; or (b) alerting Customer via the user interface for the Processor Services. If Customer objects to any such change, Customer may immediately terminate the Agreement for convenience by giving written notice to Google within 90 days of being informed by Google of the change.

Appendix 1: Subject Matter and Details of the Data Processing

Subject Matter

Google’s provision of the Processor Services and any related technical support to Customer.

Duration of the Processing

The Term plus the period from the end of the Term until deletion of all Customer Personal Data by Google in accordance with these Data Processing Terms.

Nature and Purpose of the Processing

Google will process (including, as applicable to the Processor Services and the Instructions collecting, recording, organising, structuring, storing, altering, retrieving, using, disclosing, combining, erasing and destroying) Customer Personal Data for the purpose of providing the Processor Services and any related technical support to Customer in accordance with these Data Processing Terms.

Types of Personal Data

Customer Personal Data may include the types of personal data described at business.safety.google/adsservices.

Categories of Data Subjects

Customer Personal Data will concern the following categories of data subjects:

data subjects about whom Google collects personal data in its provision of the Processor Services; and/or

data subjects about whom personal data is transferred to Google in connection with the Processor Services by, at the direction of, or on behalf of Customer.

Depending on the nature of the Processor Services, these data subjects may include individuals: (a) to whom online advertising has been, or will be, directed; (b) who have visited specific websites or applications in respect of which Google provides the Processor Services; and/or (c) who are customers or users of Customer’s products or services.

Appendix 2: Security Measures

As from the Terms Effective Date, Google will implement and maintain the Security Measures set out in this Appendix 2. Google may update or modify such Security Measures from time to time, provided that such updates and modifications do not result in the degradation of the overall security of the Processor Services.

1.Data Centre & Network Security

(a)Data Centres.

Infrastructure. Google maintains geographically distributed data centres. Google stores all production data in physically secure data centres.

Redundancy. Infrastructure systems have been designed to eliminate single points of failure and minimise the impact of anticipated environmental risks. Dual circuits, switches, networks or other necessary devices help provide this redundancy. The Processor Services are designed to allow Google to perform certain types of preventative and corrective maintenance without interruption. All environmental equipment and facilities have documented preventative maintenance procedures that detail the process for and frequency of performance in accordance with the manufacturer's or internal specifications. Preventative and corrective maintenance of the data centre equipment is scheduled through a standard process according to documented procedures.

Power. The data centre electrical power systems are designed to be redundant and maintainable without impact to continuous operations, 24 hours a day, and 7 days a week. In most cases, a primary as well as an alternate power source, each with equal capacity, is provided for critical infrastructure components in the data centre. Backup power is provided by various mechanisms such as uninterruptible power supply (UPS) batteries, which supply consistently reliable power protection during utility brownouts, blackouts, over voltage, under voltage, and out-of-tolerance frequency conditions. If utility power is interrupted, backup power is designed to provide transitory power to the data centre, at full capacity, for up to 10 minutes until the backup generator systems take over. The backup generators are capable of automatically starting up within seconds to provide enough emergency electrical power to run the data centre at full capacity typically for a period of days.

Server Operating Systems. Google servers use hardened operating systems which are customised for the unique server needs of the business. Data is stored using proprietary algorithms to augment data security and redundancy. Google employs a code review process to increase the security of the code used to provide the Processor Services and enhance the security products in production environments.

Business Continuity. Google replicates data over multiple systems to help to protect against accidental destruction or loss. Google has designed and regularly plans and tests its business continuity planning/disaster recovery programs.

Encryption Technologies. Google’s security policies mandate encryption at rest for all user data, including personal data. Data is often encrypted at multiple levels in Google’s production storage stack in data centres, including at the hardware level, without requiring any action by customers. Using multiple layers of encryption adds redundant data protection and allows Google to select the optimal approach based on application requirements. All personal data is encrypted at the storage level, generally using AES256. Google uses common cryptographic libraries which incorporate Google’s FIPS 140-2 validated module, to implement encryption consistently across the Processor Services.

(b)Networks & Transmission.

Data Transmission. Data centres are typically connected via high-speed private links to provide secure and fast data transfer between data centres. Further, Google encrypts data transmitted between data centres. This is designed to prevent data from being read, copied, altered or removed without authorisation during electronic transport. Google transfers data via Internet standard protocols.

External Attack Surface. Google employs multiple layers of network devices and intrusion detection to protect its external attack surface. Google considers potential attack vectors and incorporates appropriate purpose built technologies into external facing systems.

Intrusion Detection. Intrusion detection is intended to provide insight into ongoing attack activities and provide adequate information to respond to incidents. Google’s intrusion detection involves:

1.Tightly controlling the size and make-up of Google’s attack surface through preventative measures;

2.Employing intelligent detection controls at data entry points; and

3.Employing technologies that automatically remedy certain dangerous situations.

Incident Response. Google monitors a variety of communication channels for security incidents, and Google’s security personnel will react promptly to known incidents.

Encryption Technologies. Google makes HTTPS encryption (also referred to as TLS connection) available. Google servers support ephemeral elliptic curve Diffie Hellman cryptographic key exchange signed with RSA and ECDSA. These perfect forward secrecy (PFS) methods help protect traffic and minimise the impact of a compromised key, or a cryptographic breakthrough.

2.Access and Site Controls

(a)Site Controls.

On-site Data Centre Security Operation. Google’s data centres maintain an on-site security operation responsible for all physical data centre security functions 24 hours a day, 7 days a week. The on-site security operations personnel monitor Closed Circuit TV (“CCTV”) cameras and all alarm systems. On-site security operation personnel perform internal and external patrols of the data centre regularly.

Data Centre Access Procedures. Google maintains formal access procedures for allowing physical access to the data centres. The data centres are housed in facilities that require electronic card key access, with alarms that are linked to the on-site security operation. All entrants to the data centre are required to identify themselves as well as show proof of identity to on-site security operations. Only authorised employees, contractors and visitors are allowed entry to the data centres. Only authorised employees and contractors are permitted to request electronic card key access to these facilities. Data centre electronic card key access requests must be made in advance and in writing, and require the approval of authorised data centre personnel. All other entrants requiring temporary data centre access must: (i) obtain approval in advance from authorised data centre personnel for the specific data centre and internal areas they wish to visit; (ii) sign in at on-site security operations; and (iii) reference an approved data centre access record identifying the individual as approved.

On-site Data Centre Security Devices. Google’s data centres employ an electronic card key and biometric access control system that is linked to a system alarm. The access control system monitors and records each individual’s electronic card key and when they access perimeter doors, shipping and receiving, and other critical areas. Unauthorised activity and failed access attempts are logged by the access control system and investigated, as appropriate. Authorised access throughout the business operations and data centres is restricted based on zones and the individual’s job responsibilities. The fire doors at the data centres are alarmed. CCTV cameras are in operation both inside and outside the data centres. The positioning of the cameras has been designed to cover strategic areas including, among others, the perimeter, doors to the data centre building, and shipping/receiving. On-site security operations personnel manage the CCTV monitoring, recording and control equipment. Secure cables throughout the data centres connect the CCTV equipment. Cameras record on-site via digital video recorders 24 hours a day, 7 days a week. The surveillance records are retained for at least 7 days based on activity.

(b)Access Control.

Infrastructure Security Personnel. Google has, and maintains, a security policy for its personnel, and requires security training as part of the training package for its personnel. Google’s infrastructure security personnel are responsible for the ongoing monitoring of Google’s security infrastructure, the review of the Processor Services, and responding to security incidents.

Access Control and Privilege Management. Customer's administrators and users must authenticate themselves via a central authentication system or via a single sign on system in order to use the Processor Services.

Internal Data Access Processes and Policies – Access Policy. Google’s internal data access processes and policies are designed to prevent unauthorised persons and/or systems from gaining access to systems used to process personal data. Google aims to design its systems to: (i) only allow authorised persons to access data they are authorised to access; and (ii) ensure that personal data cannot be read, copied, altered or removed without authorisation during processing, use and after recording. The systems are designed to detect any inappropriate access. Google employs a centralised access management system to control personnel access to production servers, and only provides access to a limited number of authorised personnel. LDAP, Kerberos and a proprietary system utilising digital certificates are designed to provide Google with secure and flexible access mechanisms. These mechanisms are designed to grant only approved access rights to site hosts, logs, data and configuration information. Google requires the use of unique user IDs, strong passwords, two factor authentication and carefully monitored access lists to minimise the potential for unauthorised account use. The granting or modification of access rights is based on: the authorised personnel’s job responsibilities; job duty requirements necessary to perform authorised tasks; and a need to know basis. The granting or modification of access rights must also be in accordance with Google’s internal data access policies and training. Approvals are managed by workflow tools that maintain audit records of all changes. Access to systems is logged to create an audit trail for accountability. Where passwords are employed for authentication (e.g. login to workstations), password policies that follow at least industry standard practices are implemented. These standards include restrictions on password reuse and sufficient password strength.

3.Data

(a)Data Storage, Isolation & Authentication.

Google stores data in a multi-tenant environment on Google-owned servers. Data, the Processor Services database and file system architecture are replicated between multiple geographically dispersed data centres. Google logically isolates each customer's data. A central authentication system is used across all Processor Services to increase uniform security of data.

(b)Decommissioned Disks and Disk Destruction Guidelines.

Certain disks containing data may experience performance issues, errors or hardware failure that lead them to be decommissioned (“Decommissioned Disk”). Every Decommissioned Disk is subject to a series of data destruction processes (the “Data Destruction Guidelines”) before leaving Google’s premises either for reuse or destruction. Decommissioned Disks are erased in a multi-step process and verified complete by at least two independent validators. The erase results are logged by the Decommissioned Disk’s serial number for tracking. Finally, the erased Decommissioned Disk is released to inventory for reuse and redeployment. If, due to hardware failure, the Decommissioned Disk cannot be erased, it is securely stored until it can be destroyed. Each facility is audited regularly to monitor compliance with the Data Destruction Guidelines.

(c)Pseudonymous Data.

Online advertising data are commonly associated with online identifiers which on their own are considered ’pseudonymous’ (i.e. they cannot be attributed to a specific individual without the use of additional information). Google has a robust set of policies and technical and organisational controls in place to ensure the separation between pseudonymous data and personally identifiable user information (i.e. information that could be used on its own to directly identify, contact, or precisely locate an individual), such as a user’s Google account data. Google policies only allow for information flows between pseudonymous and personally identifiable data in strictly limited circumstances.

(d)Launch reviews.

Google conducts launch reviews for new products and features prior to launch. This includes a privacy review conducted by specially trained privacy engineers. In privacy reviews, privacy engineers ensure that all applicable Google policies and guidelines are followed, including but not limited to policies relating to pseudonymisation and data retention and deletion.

4.Personnel Security

Google personnel are required to conduct themselves in a manner consistent with the company’s guidelines regarding confidentiality, business ethics, appropriate usage, and professional standards. Google conducts reasonably appropriate background checks to the extent legally permissible and in accordance with applicable local labor law and statutory regulations.

Personnel are required to execute a confidentiality agreement and must acknowledge receipt of, and compliance with, Google’s confidentiality and privacy policies. Personnel are provided with security training. Personnel handling Customer Personal Data are required to complete additional requirements appropriate to their role. Google’s personnel will not process Customer Personal Data without authorisation.

5.Subprocessor Security

Before onboarding Subprocessors, Google conducts an audit of the security and privacy practices of Subprocessors to ensure Subprocessors provide a level of security and privacy appropriate to their access to data and the scope of the services they are engaged to provide. Once Google has assessed the risks presented by the Subprocessor, the Subprocessor is required to enter into appropriate security, confidentiality and privacy contract terms, subject to the requirements set out in Section 11.3 (Requirements for Subprocessor Engagement).

Appendix 3: Additional Terms for Applicable Data Protection Legislation

PART A - ADDITIONAL TERMS FOR EUROPEAN DATA PROTECTION LEGISLATION

1.Introduction

This Appendix 3A will only apply to the extent that the European Data Protection Legislation applies to the processing of Customer Personal Data.

2.Additional Definitions

2.1In this Appendix 3A:

“Adequate Country” means:

(a)for data processed subject to the EU GDPR: the EEA, or a country or territory recognized as ensuring adequate protection under the EU GDPR;

(b)for data processed subject to the UK GDPR: the UK, or a country or territory recognized as ensuring adequate protection under the UK GDPR and the Data Protection Act 2018; and/or

(c)for data processed subject to the Swiss FDPA: Switzerland, or a country or territory that is: (i) included in the list of the states whose legislation ensures adequate protection as published by the Swiss Federal Data Protection and Information Commissioner, or (ii) recognized as ensuring adequate protection by the Swiss Federal Council under the Swiss FDPA,

in each case, other than on the basis of an optional data protection framework.

“Alternative Transfer Solution” means a solution, other than SCCs, that enables the lawful transfer of personal data to a third country in accordance with European Data Protection Legislation, for example a data protection framework recognized as ensuring that participating entities provide adequate protection.

“Customer SCCs” means the SCCs (Controller-to-Processor), the SCCs (Processor-to-Controller), and/or the SCCs (Processor-to-Processor), as applicable.

“EEA” means the European Economic Area.

“European Laws” means, as applicable: (a) EU or EU Member State law (if the EU GDPR applies to the processing of Customer Personal Data); (b) the law of the UK or a part of the UK (if the UK GDPR applies to the processing of Customer Personal Data); and (c) the law of Switzerland (if the Swiss FDPA applies to the processing of Customer Personal Data).

“SCCs” means the Customer SCCs and/or SCCs (Processor-to-Processor, Google Exporter), as applicable.

“SCCs (Controller-to-Processor)” means the terms at business.safety.google/adsprocessorterms/sccs/c2p.

“SCCs (Processor-to-Controller)” means the terms at business.safety.google/adsprocessorterms/sccs/p2c.

“SCCs (Processor-to-Processor)” means the terms at business.safety.google/adsprocessorterms/sccs/p2p.

“SCCs (Processor-to-Processor, Google Exporter)” means the terms at business.safety.google/adsprocessorterms/sccs/p2p-intra-group.

“Supervisory Authority” means, as applicable: (a) a “supervisory authority” as defined in the EU GDPR; and/or (b) the “Commissioner” as defined in the UK GDPR and/or the Swiss FDPA.

2.2The terms “data importer” and “data exporter” have the meanings given in the applicable SCCs.

3.Processor Customers. If Customer is a processor, Customer will forward to the relevant controller promptly and without undue delay, any notice that refers to any SCCs.

4.European Laws. Where European Data Protection Legislation applies to Google’s processing of Customer Personal Data, references to “applicable laws” in Sections 5.3 (Google’s Compliance with Instructions), 6.1.1 (Processor Services with Deletion Functionality), 6.1.2(a) (Processor Services without Deletion Functionality) and Section 6.2 (Deletion on Term Expiry), means “European Laws.”

5.Instruction Notifications. Google will immediately notify Customer if, in Google’s opinion: (a) European Laws prohibit Google from complying with an Instruction; (b) an Instruction does not comply with European Data Protection Legislation; or (c) Google is otherwise unable to comply with an Instruction, in each case unless such notice is prohibited by European Law. If Customer is a processor, Customer will immediately forward to the relevant controller any notice provided by Google under this paragraph. This paragraph 5 (Instruction Notifications) does not reduce either party’s rights and obligations elsewhere in the Agreement.

6.Audits of Compliance

6.1Customer’s Audit Rights.

(a)Google will allow Customer or a third party auditor appointed by Customer to conduct audits (including inspections) to verify Google’s compliance with its obligations under these Data Processing Terms in accordance with paragraph 6.2 (Additional Business Terms for Audits) of this Appendix 3A. During an audit, Google will make available all information necessary to demonstrate such compliance and contribute to the audits as described in Section 7.4 (Security Certification) and paragraph 6 (Audits of Compliance) of this Appendix 3A.

(b)If the SCCs apply under paragraph 7.1 (Restricted European Transfers) of this Appendix 3A, Google will allow Customer (or a third-party auditor appointed by Customer) to conduct audits as described in the SCCs and, during the audit, make available all information required by the SCCs, each in accordance with paragraph 6.2 (Additional Business Terms for Audits) of this Appendix 3A .

6.2Additional Business Terms for Audits.

(a)Customer will send any request for an audit under paragraph 6.1(a) or 6.1(b) of this Appendix 3A to Google as described in Section 12.1 (Contacting Google).

(b)Following receipt by Google of a request under paragraph 6.2(a) of this Appendix 3A, Google and Customer will discuss and agree in advance on the reasonable start date, scope and duration of, and security and confidentiality controls applicable to, any audit under paragraphs 6.1(a) or 6.1(b) of this Appendix 3A.

(c)Google may charge a fee (based on Google’s reasonable costs) for any audit under paragraphs 6.1(a) or 6.1(b) of this Appendix 3A. Google will provide Customer with further details of any applicable fee, and the basis of its calculation, in advance of any such audit. Customer will be responsible for any fees charged by any third party auditor appointed by Customer to execute any such audit.

(d)Google may object to any third party auditor appointed by Customer to conduct any audit under paragraph 6.1(a) or 6.1(b) of this Appendix 3A if the auditor is, in Google’s reasonable opinion, not suitably qualified or independent, a competitor of Google or otherwise manifestly unsuitable. Any such objection by Google will require Customer to appoint another auditor or conduct the audit itself.

(e)Nothing in these Data Processing Terms will require Google either to disclose to Customer or its third party auditor, or to allow Customer or its third party auditor to access: (i) any data of any other customer of a Google Entity; (ii) any Google Entity’s internal accounting or financial information; (iii) any trade secret of a Google Entity; (iv) any information that, in Google's reasonable opinion, could: (A) compromise the security of any Google Entity’s systems or premises; or (B) cause any Google Entity to breach its obligations under the European Data Protection Legislation or its security and/or privacy obligations to Customer or any third party; or (v) any information that Customer or its third party auditor seeks to access for any reason other than the good faith fulfilment of Customer’s obligations under the European Data Protection Legislation.

7.Data Transfers

7.1Restricted European Transfers. The parties acknowledge that European Data Protection Legislation does not require SCCs or an Alternative Transfer Solution in order to process Customer Personal Data in or transfer it to an Adequate Country. If Customer Personal Data is transferred to any other country, and European Data Protection Legislation applies to the transfers (“Restricted European Transfers”), then:

(a)if Google has adopted an Alternative Transfer Solution for any Restricted European Transfers, then Google will inform Customer of the relevant solution and ensure that such Restricted European Transfers are made in accordance with that solution; and/or

(b)if Google has not adopted, or informs Customer that Google is no longer adopting an Alternative Transfer Solution for any Restricted European Transfers, then:

(i)if Google’s address is in an Adequate Country:

(A)the SCCs (Processor-to-Processor, Google Exporter) will apply with respect to such Restricted European Transfers from Google to Subprocessors; and

(B)in addition, if Customer’s address is not in an Adequate Country, the SCCs (Processor-to-Controller) will apply with respect to Restricted European Transfers between Google and Customer (regardless of whether Customer is a controller and/or a processor); or

(ii)if Google’s address is not in an Adequate Country, the SCCs (Controller-to-Processor) and/or SCCs (Processor-to-Processor) will apply (according to whether Customer is a controller and/or processor) with respect to such Restricted European Transfers between Customer and Google.

7.2Supplementary Measures and Information. Google will provide Customer with information relevant to Restricted European Transfers, including information about supplementary measures to protect Customer Personal Data, as described in Section 7.5 (Verifying Compliance), Appendix 2 (Security Measures) and other materials concerning the nature of the Processor Services and the processing of Customer Personal Data (for example, help centre articles).

7.3Termination. If Customer concludes, based on its current or intended use of the Processor Services, that the Alternative Transfer Solution and/or SCCs, as applicable, do not provide appropriate safeguards for Customer Personal Data, then Customer may immediately terminate the Agreement for convenience by notifying Google in writing.

7.4Alternative Transfer Solution Adoption and Certification. Information about Google and/or its Affiliates’ adoption of, or certification under, any Alternative Transfer Solutions can be found at https://business.safety.google/adsdatatransfers.

8.Subprocessors. When engaging any Subprocessor, Google will ensure via a written contract that if the processing of Customer Personal Data is subject to European Data Protection Legislation, the data protection obligations in these Data Processing Terms (as referred to in Article 28(3) of the GDPR, if applicable) are imposed on the Subprocessor.

9.Google’s Processing Records.

Customer acknowledges that Google is required under the GDPR to:

(a)collect and maintain records of certain information, including: (i) the name and contact details of each processor and/or controller on behalf of which Google is acting and (if applicable) of such processor’s or controller's local representative and data protection officer, and (ii) if applicable under the Customer SCCs, Customer’s Supervisory Authority; and

(b)make such information available to any Supervisory Authority. Accordingly, Customer will, where requested and as applicable to Customer, provide such information to Google via the user interface of the Processor Services or via such other means as may be provided by Google, and will use such user interface or other means to ensure that all information provided is kept accurate and up-to-date.

10.SCCs

10.1Order of Precedence. If there is any conflict or inconsistency between the Customer SCCs and this Appendix 3A, the remainder of these Data Processing Terms or the remainder of the Agreement, then the Customer SCCs will prevail.

10.2No Modification of SCCs. Nothing in the Agreement (including these Data Processing Terms) is intended to modify or contradict any SCCs or prejudice the fundamental rights or freedoms of data subjects under the European Data Protection Legislation.

11.Changes to SCCs. Google may only change the SCCs in accordance with Sections 15.2(b) - 15.2(d) (Changes to Data Processing Terms) or to incorporate any new version of the SCCs that may be adopted under the European Data Protection Legislation, in each case in a manner that does not affect the validity of the SCCs under the European Data Protection Legislation.

PART B - ADDITIONAL TERMS FOR US STATE PRIVACY LAWS

1.Introduction

Google may offer and Customer may enable certain in-product settings, configurations or other functionality for the Processor Services relating to restricted data processing, as described in supporting documentation available at business.safety.google/rdp, as updated from time to time (“Restricted Data Processing”). This Appendix 3B reflects the parties’ agreement on the processing of Customer Personal Data and Deidentified Data (as defined below) pursuant to the Agreement in connection with the US State Privacy Laws, and is effective solely to the extent each US State Privacy Law applies.

2.Additional Definitions and Interpretation

In this Appendix 3B:

(a)“Deidentified Data” means data information that is “deidentified” (as that term is defined by the CCPA) and “de-identified data” (as defined by other US State Privacy Laws), when disclosed by one party to the other.

(b)“RDP Instructions” means, collectively, the Instructions (as defined in these Data Processing Terms) and Customer’s instructions to Google to process Customer Personal Data as permitted under US State Privacy Laws for service providers and processors.

(c)“RDP Services” means Processor Services operating under Restricted Data Processing.

(d)the terms “business”, “consumer”, “personal information”, “sale(s)”, “sell”, “service provider”, and “share” as used in this Appendix 3B have the meanings given in the applicable US State Privacy Laws.

(e)Customer is solely liable for its compliance with each of the US State Privacy Laws in its use of Google services, including Restricted Data Processing.

3.Applicable State Privacy Law Terms (under Restricted Data Processing).

3.1With respect to Customer Personal Data processed under Restricted Data Processing, and to the extent that one or more of the US State Privacy Laws applies to the processing of Customer Personal Data:

3.1.1Roles and Regulatory Compliance; Authorization.

(a)Processor and Controller Responsibilities.The parties acknowledge and agree that:

(i)Appendix 1 of these Data Processing Terms describes the subject matter and details of the processing of Customer Personal Data, subject to the following modifications:

(1)All references to “Processor Services” are replaced with “RDP Services”; and

(2)The “Types of Personal Data” section is replaced with the following language: “Customer Personal Data may include the types of personal data described under the US State Privacy Laws.”

(ii)Google is a service provider and processor of Customer Personal Data under the US State Privacy Laws; and

(iii)Customer is a controller or processor, as applicable, of Customer Personal Data under the US State Privacy Laws.

(b)Processor Customers. If Customer is a processor:

(i)Customer warrants on an ongoing basis that the relevant controller has authorized: (A) the Instructions, (B) Customer’s appointment of Google as another processor, and (C) Google’s engagement of subcontractors as described in paragraph 3.4 (Subcontractors) of this Appendix 3B.

(ii)Customer will immediately forward to the relevant controller any notice provided by Google under Section 7.2.1 (Incident Notification) of these Data Protection Terms and paragraph 3.4 (Subcontractors) of this Appendix 3B.

(iii)Customer may make available to the relevant controller any information made available by Google under paragraphs 3.2(b) (Customer’s Audit Rights) and 3.4 (Subcontractors) of this Appendix 3B.

3.1.2Customer’s Instructions for RDP Services. By entering into this Appendix 3B, and with respect to the RDP Services, Customer instructs Google to process Customer Personal Data only in accordance with the RDP Instructions.

3.1.3Google’s Compliance with RDP Instructions. With respect to the RDP Services, Google will comply with the RDP Instructions unless prohibited under the US State Privacy Laws.

3.1.4Additional Products. If Customer uses any product, service or application provided by Google or a third party that: (a) is not part of the RDP Services; and (b) is accessible for use within the user interface of the RDP Services or is otherwise integrated with the RDP Services (an “Additional Product”), the RDP Services may allow that Additional Product to access Customer Personal Data as required for the interoperation of the Additional Product with the RDP Services. For clarity, this Appendix 3B does not apply to the processing of personal data in connection with the provision of any Additional Product used by Customer, including personal data transmitted to or from that Additional Product.

3.2Data Security

3.2.1Customer’s Security Responsibilities and Assessment.

(a)Customer’s Security Responsibilities. In addition to Customer’s security responsibilities under Section 7.3.1 of these Data Processing Terms, Customer agrees that, without prejudice to Google’s obligations under Sections 7.1 (Google’s Security Measures and Assistance) and 7.2 (Data Incidents) of these Data Processing Terms, Customer is responsible for its use of the RDP Services, including: (1) making appropriate use of the RDP Services to ensure a level of security appropriate to the risk in respect of Customer Personal Data; and (2) securing the account authentication credentials, systems and devices Customer uses to access the RDP Services.

(b)Customer’s Audit Rights.

(i)Customer may conduct an audit to verify Google’s compliance with its obligations under this Appendix 3B by requesting and reviewing (1) a certificate issued for security verification reflecting the outcome of an audit conducted by a third party auditor (e.g., SOC 2 Type II or ISO/IEC 27001 certification or a comparable certification or other security certification of an audit conducted by a third-party auditor agreed by Customer and Google) within 12 months as of the date of Customer’s request and (2) any other information Google determines is reasonably necessary for Customer to verify such compliance.

(ii)Alternatively, Google may, at its sole discretion and in response to a request by Customer, initiate a third-party audit to verify Google’s compliance with its obligations under this Appendix 3B. During such an audit, Google will make available to the third-party auditor all information necessary to demonstrate such compliance. Where Customer requests such an audit, Google may charge a fee (based on Google’s reasonable costs) for any audit. Google will provide Customer with further details of any applicable fee, and the basis of its calculation, in advance of any such audit. Customer will be responsible for any fees charged by any third-party auditor appointed by Customer to execute any such audit.

(iii)Nothing in this Appendix 3B will require Google either to disclose to Customer or its third-party auditor, or to allow Customer or its third-party auditor to access:

(1)any data of any other customer of a Google Entity;

(2)any Google Entity’s internal accounting or financial information;

(3)any trade secret of a Google Entity;

(4)any information that, in Google's reasonable opinion, could: (A) compromise the security of any Google Entity’s systems or premises; or (B) cause any Google Entity to breach its obligations under the US State Privacy Laws or its security and/or privacy obligations to Customer or any third party; or

(5)any information that Customer or its third party auditor seeks to access for any reason other than the good faith fulfillment of Customer’s obligations under the US State Privacy Laws.

3.3Data Subject Rights. For the purposes of this Appendix 3B, Google will adhere to the procedures set forth under Section 9 (Data Subject Requests) to the extent such requests, requests for assistance, or rectification is applicable to the RDP Services.

3.4Subcontractors.

(a)Customer generally authorizes Google to engage other entities as subcontractors in connection with the provision of the RDP Services. When engaging any subcontractor, Google will:

(i)ensure via a written contract that: (A) the subcontractor only accesses and uses Customer Personal Data to the extent required to perform the obligations subcontracted to it, and does so in accordance with the Agreement (including this Appendix 3B); and (B) if the processing of Customer Personal Data is subject to the US State Privacy Laws, ensure that the data protection obligations in this Appendix 3B are imposed on the subcontractor;

(ii)when engaging any new subcontractors, provide notice of such new subcontractors where required by US State Privacy Laws, and, where required by US State Privacy Laws, further provide an opportunity for Customer to object to such subcontractors; and

(iii)remain fully liable for all obligations subcontracted to, and all acts and omissions of, the subcontractor.

(b)Customer may object to any new subcontractor by terminating the Agreement for convenience immediately upon written notice to Google, on condition that Customer provides such notice within 90 days of being informed of the engagement of the new subcontractor as described in paragraph 3.4(a)(ii) herein.

4.US State Privacy Law Terms

4.1Deidentified Data. With respect to Customer Personal Data processed with or without Restricted Data Processing enabled, and to the extent that one or more of the US State Privacy Laws applies to the processing of Customer Personal Data, each party will comply with the requirements for processing Deidentified Data set out in the US State Privacy Laws, with respect to any Deidentified Data it receives from the other party pursuant to the Agreement. For purposes of this paragraph 4.1 (Deidentified Data), Customer Personal Data means any personal data that is processed by a party under the Agreement in connection with its provision or use of the Processor Services.

5.Google’s CCPA Obligations.

5.1With respect to Customer Personal Data processed under Restricted Data Processing and to the extent that CCPA applies to such processing of Customer Personal Data, Google will act as Customer’s service provider, and as such, unless otherwise permitted for service providers under CCPA, as reasonably determined by Google:

(i)Google will not sell or share any Customer Personal Data that it obtains from Customer in connection with the Agreement;

(ii)Google will not retain, use or disclose Customer Personal Data (including outside of the direct business relationship between Google and Customer), other than for a business purpose under the CCPA on behalf of Customer and the specific purpose of performing the RDP Services, as further described in supporting documentation available at business.safety.google/rdp, as updated from time to time;

(iii)Google will not combine Customer Personal Data that Google receives from, or on behalf of, Customer with (a) personal information that Google receives from, or on behalf of, another person or persons or (b) personal information collected from Google’s own interaction with a consumer, as further described in supporting documentation available at business.safety.google/rdp except to the extent permitted under CCPA;

(iv)Google will process such Customer Personal Data for the specific purpose of performing the RDP Services, as further described in the Agreement and supporting documentation (e.g., help center articles), or as otherwise permitted under the CCPA, and the parties agree that Customer is making such Customer Personal Data available to Google for such purposes;

(v)Google will allow audits to verify Google’s compliance with its obligations under this Appendix 3B in accordance with paragraph 3.2.1(b) (Customer’s Audit Rights) of this Appendix 3B;

(vi)Google will notify Customer if Google makes a determination that it can no longer meet its obligations under the CCPA. This paragraph 5.1(vi) does not reduce either party’s rights and obligations elsewhere in the Agreement;

(vii)If Customer reasonably believes that Google is processing Customer Personal Data in an unauthorized manner, Customer has the right to notify Google of such belief via the methods described at privacy.google.com/businesses/processorsupport, and the parties will work together in good faith to remediate the allegedly violative processing activities, if necessary; and

(viii)Google will comply with applicable obligations under CCPA and will provide the same level of privacy protection as is required by CCPA.

5.2With respect to Customer Personal Data processed without Restricted Data Processing enabled, and to the extent that CCPA applies to the processing of Customer Personal Data:

(i)Google will process such Customer Personal Data for the specific purpose of performing the Processor Services, as further described in the Agreement and supporting documentation (e.g., help center articles), or as otherwise permitted under the CCPA, and the parties agree that Customer is making such Customer Personal Data available to Google for such purposes;

(ii)Google will allow audits to verify Google’s compliance with its obligations under this Appendix 3B in accordance with paragraph 3.2.1(b) (Customer’s Audit Rights) herein.

(iii)Google will notify Customer if Google makes a determination that it can no longer meet its obligations under the CCPA;

(iv)If Customer reasonably believes that Google is processing Customer Personal Data in an unauthorized manner, Customer has the right to notify Google of such belief via the methods described at privacy.google.com/businesses/processorsupport, and the parties will work together in good faith to remediate the allegedly violative processing activities, if necessary; and

(v)Google will comply with applicable obligations under CCPA and will provide the same level of privacy protection as is required by CCPA.

6.Changes to this Appendix 3B. In addition to Section 15 of the Data Processing Terms (Changes to these Data Processing Terms), Google may change this Appendix 3B without notice if the change (a) is based on applicable law, applicable regulation, a court order, or guidance issued by a governmental regulator or agency or (b) does not have a material adverse impact on Customer under the US State Privacy Laws, as reasonably determined by Google.

Google Ads Data Processing Terms, Version 7.0

1 September 2023

LAMBRETTA-LUTZ | info@lambretta-lutz.de

La pagina contiene informazioni su:Termini e Condizioni,Politica sulla Privacy eTermini di Elaborazione dei Dati di Google

Termini e Condizioni

Contenuti esterni

Impostazioni cookie

La pagina contiene informazioni su:
Termini e Condizioni,
Politica sulla Privacy e
Termini di Elaborazione dei Dati di Google