Bright Market, LLC d/b/a FastSpring will disclose Personal Data to Third Parties who reasonably need to know such data only for the scope of the initial transaction and not for other purposes outside of the scope of consent provided by the Data Subject. The use of such Personal Data by Third Parties for any other purposes is prohibited. Third Parties are required to use such Personal Data only for the purposes for which they have been authorized by Bright Market, LLC d/b/a FastSpring and they must either:
- comply with the Privacy Shield principles or another mechanism permitted by the applicable EU & Swiss data protection law(s) for transfers and processing of Personal Data;
- They will have in place appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, and which provide a level of security appropriate to the risk represented by the processing and the nature of the data to be protected.
- They will have in place procedures so that any third party they authorize to have access to the Personal Data will respect and maintain the confidentiality and security of such Personal Data. Any person acting under the authority of the Third Party, including a data processor, shall be obligated to process the Personal Data only on instructions from the Third Party. This provision does not apply to persons authorized or required by law or regulation to have access to the Personal Data.
- They have no reason to believe, at the time of entering into these clauses, in the existence of any local laws that would have a substantial adverse effect on the guarantees provided for under these clauses, and an applicable Third Party will inform Bright Market, LLC d/b/a FastSpring (which will pass such notification on to the authority where required) if it becomes aware of any such laws.
- They will process the Personal Data only for the scope of the consent provided by the Data Subject, and has the legal authority to give the warranties and fulfil the undertakings set out in these clauses.
- They will identify to Bright Market, LLC d/b/a FastSpring a contact point within their organization authorized to respond to enquiries concerning processing of the Personal Data, and will cooperate in good faith with Bright Market, LLC d/b/a FastSpring, the Data Subject and the authority concerning all such enquiries within a reasonable time.
- Upon reasonable request of Bright Market, LLC d/b/a FastSpring, they will submit their data processing facilities, data files and documentation needed for processing to reviewing, auditing and/or certifying by Bright Market, LLC d/b/a FastSpring (or any independent or impartial inspection agents or auditors, selected by Bright Market, LLC d/b/a FastSpring and not reasonably objected to by the applicable Third Party) to ascertain compliance with the warranties and undertakings in these clauses, with reasonable notice and during regular business hours.
- They will process the Personal Data, at their option, in accordance with:
- the data protection laws of the country in which Bright Market, LLC d/b/a FastSpring is established, or
- the relevant provisions of any European Commission decision pursuant to Article 25(6) of Directive 95/46/EC, where the Third Party complies with the relevant provisions of such an authorization or decision and is based in a country to which such an authorization or decision pertains, but is not covered by such authorization or decision for the purposes of the transfer(s) of the Personal Data.
- It will not disclose or transfer the Personal Data to a third party data controller located outside the European Economic Area (EEA) unless it notifies Bright Market, LLC d/b/a FastSpring about the transfer and:
- the third party data controller processes the Personal Data in accordance with a European Commission decision finding that a third country provides adequate protection, or
- the third party data controller becomes a signatory to these clauses or another data transfer agreement approved by a competent authority in the EU, or
- Data Subjects have been given the opportunity to object, after having been informed of the purposes of the transfer, the categories of recipients and the fact that the countries to which data is exported may have different data protection standards, or
- with regard to onward transfers of sensitive data, Data Subjects have given their unambiguous consent to the onward transfer
Third Parties must immediately notify Bright Market, LLC d/b/a FastSpring if they determine that they can no longer meet the obligations above. If such a determination is made, the applicable Third Party must immediately cease processing the Personal Data made available to it or take other reasonable and appropriate steps to remediate such unauthorized processing.
“Personal Data”, as defined under the European Union Directive 95/46/EC, means data that personally identifies or may be used to personally identify a person, including an individual’s name in combination with country of birth, marital status, emergency contact, salary information, terms of employment, job qualifications (such as educational degrees earned), address, phone number, e-mail address, user ID, password, and identification numbers. Personal Data does not include data that is de-identified, anonymous, or publicly available. For Switzerland, the term “person” includes both a natural person and a legal entity, regardless of the form of the legal entity.
“Third Party” means any individual or entity that is neither Bright Market, LLC d/b/a FastSpring nor a Bright Market, LLC d/b/a FastSpring employee, agent, contractor, or representative.
“Data Subject” means an identified or identifiable natural living person. An identifiable person is one who can be identified, directly or indirectly, by reference to a name, or to one or more factors unique to his or her personal physical, psychological, mental, economic, cultural or social characteristics. For purchasers residing in Switzerland, a Data Subject also may include a legal entity.
Bright Market, LLC d/b/a FastSpring reserves the right to review or revise this policy at any time without notice.