Our Cookies and Privacy policy may have been provided to you in a non-english language text as a convenience. In the case of a conflict, inconsistency or interpretation issue between this text and our English language versions of our terms and conditions or privacy policy, the English text shall control.

Last modified October 5th, 2022

This policy describes the ways we collect, store, use and protect your personal information. You accept this policy when you sign up for or use our products, services or any other features, technologies or functionalities offered by us on our website or through any other means. We may amend this policy at any time by posting a revised version on our website. The revised version will be effective at the time we post it or when you are notified by other means. In addition, if the revised version includes a substantial change, Bitwage will try to, but is not obligated to, provide thirty (30) days prior notice of any such material change. You acknowledge that any such notice will be made available for your benefit and convenience.

Cookies and Privacy

Collecting Personal Information

When you visit the Bitwage website or use the Bitwage Services, the data we collect may include but is not limited to your IP address and standard web log information, such as your browser type and pages accessed on our website. If you open an account or use Bitwage Services, the data we collect may include but is not limited to:

User first name, last name, Date of Birth, phone, street address, city, state, zip and country.
Company name, phone, street address, city, state, zip, email, EIN number, and website URL.
Other information: Any information needed to comply with all legal requirements to use Bitwage Services.

Before permitting you to use Bitwage Services, we may require you to provide additional information, e.g. your social security number or government-issued IDso that we can verify your identity or address or manage risk. We may also obtain information about you from third parties such as your employer, credit bureaus, and identity verification services.

When you are using Bitwage Services, we collect information about your transactions and other activities on our website, and we may collect information about your computer other access devices for fraud prevention purposes.

Cookie Policy

When you access our website, we, or third party services that we use, may place small data files called "cookies" on your computer. We and our service providers may also use cookies to customize the Bitwage Services, content and advertising; measure promotional effectiveness, and promote trust and safety.

We encode our cookies (see our Security Policy- Browser Security) so that only we can interpret the information stored in them. We may also collect information about your computer or other access devices to mitigate risk and for fraud prevention purposes.

Minors

No one under age thirteen (13) is allowed to use the website, provide any personal information or receive our email distributions. Minors between the ages of thirteen (13) and seventeen (17) must be properly employed as a worksite employee and/or have the permission of a parent or legal guardian in order to use the website, provide any personal information or receive our email distributions.

Storing and Protecting Personal Information

Throughout this policy, we use the term \"personal information\" to describe information that can be associated with a specific person and can be used to identify that person. We do not consider personal information to include information that has been anonymized so that it does not identify a specific user.

All data that we process, store, or transmit is classified according to its business requirements and secured accordingly. By default, all data is considered confidential and is restricted on a need to know basis. Access to personal info is only allowed on a need to know basis. Access to data is safeguarded in alignment with industry best practices, which can be viewed in our Security Policy.

Bitwage aligns itself with the Safe Harbor privacy principles as set forth by the U.S. Department of Commerce regarding the collection, storage, use, transfer and other processing of Personal Data transferred from the European Economic Area (“EEA”) or Switzerland to the United States. While Bitwage itself is not certified by the US Department of Commerce, the information that you submit via the Bitwage website is hosted on secure servers by Google Cloud Platform located in the United States.

Use of Personal Information

Our primary purpose in collecting personal information is to provide you with a secure and efficient experience. We may use your personal information to:

Provide Bitwage Services and customer support;
Process transactions and send notices about your transactions;
Resolve disputes, collect fees, and troubleshoot problems;
Prevent potentially prohibited or illegal activities, and enforce our User Agreement;
Customize, measure, and improve the Bitwage Services and the content and layout of our website and applications;
Deliver targeted marketing, service update notices, and promotional offers based on your communication preferences;
Compare information for accuracy and verify it with third parties.

Marketing

We do not sell or rent your personal information to third parties for their marketing purposes without your explicit consent. If you do not wish to receive marketing communications from us or participate in our ad programs, click the unsubscribe link in the emails we send, or notify us at support@bitwage.com.

EEA Residents: Pursuant to EEA Data Protection Law, we process this personal information to satisfy on your consent.

We will not use your personal information for purposes other than those purposes we have disclosed to you, without your permission. From time to time we may request your permission to allow us to share your personal information with third parties. You may opt out of having your personal information shared with third parties or allowing us to use your personal information for any purpose that is incompatible with the purposes for which we originally collected it or subsequently obtained your authorization.

Sharing Personal Information

To process your payments, we may share some of your personal information with the party or company that you are paying or that is paying you. The personal information provided to other Bitwage users who you pay may include but is not limited to:

Company name

The information provided to other Bitwage users from whom you receive payment may include but is not limited to:

User name, date of birth, address, email, phone number

We share personal information with other Bitwage users to whom you pay after you have consented to the information being shared by choosing them as a recipient. We share personal information with other Bitwage users from whom you receive payment after you have consented to the information being shared by entering your Digital Currency Receiving Address for that Bitwage user.We work with third parties, who add value or additional services for Bitwage. In doing so, a third party may share information about you with us, such as your email address or mobile phone number. We use this information to confirm to that you are a Bitwage customer and that a Bitwage, payroll can then proceed.

Personal information may also be shared with third parties when you use these third parties to access the Bitwage Services. Unless you have agreed to it, these third parties are not allowed to use this information for any purpose other than to enable the Bitwage Services.

If you request that we validate your status as a Bitwage customer with a third party, we will do so as a convenience to our customers, however, we are not required to do so. Please note that many third parties we work with have their own privacy policies, and Bitwage may not be held responsible for their operations, including, but not limited to, their information practices.

Your Rights

You can contact us to obtain a copy of the Personal Information held about you by us. This may be subject to a fee not exceeding any prescribed fee permitted by applicable law. You can also ask us to correct and, where relevant, erase that information. Please note that certain Personal Information may need to be retained by Bitwage for a period of time following cancellation of your account where this is necessary for our legitimate business purposes or required by applicable law. As mentioned above in Marketing, you have a right to change your email preferences at any time.

Pursuant to EEA Data Protection Law, our lawful basis for processing such data is compliance with legal obligations. In some cases, we may process additional data about you to ensure our Services are not used fraudulently or for illicit activities. In such instances, your personal information is necessary to verify your identify to allow for us to continue processing your transactions.

How You Can Access or Change Your Personal Information

You are entitled to review, correct, or amend your personal information, or to delete that information where it is inaccurate. You may do this at any time by logging in to your account and making the necessary modifications, or you may contact support@bitwage.com detailing your changes.

If you close your Bitwage Account, we will mark your account in our database as "Closed," but will keep your account information in our database for a minimum of 5 years. This is necessary to deter fraud, by ensuring that persons who try to commit fraud will not be able to avoid detection simply by closing their account and opening a new account. Note that once your account has been closed, your personal information will not be used by us for any further purposes, except as necessary to prevent fraud and assist law enforcement, as required by law, or in accordance with this Privacy Policy.

Rights in Relation to the Use of Your Personal Information

Rights of access, correction and deletion of the personal information that we hold about you under European data protection legislation, and to some related information. You can also require any inaccurate personal information to be corrected or deleted.

Right to object our use of your personal information for direct marketing purposes at any time and you may have the right to object to our processing of some or all your personal information (and require them to be deleted) in some other circumstances.

To exercise any of these rights, please contact us at support@bitwage.com.

Retention of Personal Information

We store your personal information securely throughout the life of your Bitwage account. We will only retain your personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting obligations or to resolve disputes. While retention requirements vary by jurisdiction, information about our typical retention periods for different aspects of your personal information are described below.

Contact Information such as your name, email address and telephone number for marketing purposes is retained on an ongoing basis until you opt out.
Information collected via technical means such as cookies, webpage counters and other analytics tools is maintained in accordance with our cookie policy.

Individual Rights

Right to withdraw consent the processing of your personal information collected based on your consent at any time.
Right to erasure of your personal information that:
(a) is no longer necessary in relation to the purposes for which it was collected or otherwise processed
(b) was collected in relation to processing that you previously consented, but later withdrew such consent
(c) was collected in relation to processing activities to which you object, and there are no overriding legitimate grounds for our processing. If we have made your personal information public and are obliged to erase the personal information, we will, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other parties that are processing your personal information that you have requested the erasure of any links to, or copy or replication of your personal information. The above is subject to limitations by relevant data protection laws.
Bitwage will attempt limit the storage of your personal information to the extent that storage is necessary to serve the purpose(s) for which the personal information was processed, to resolve disputes, enforce our agreements, and as required or permitted by law.
Right to data portability of personal information in a structured, commonly used and machine-readable format, and to have us transfer your personal information directly to another “controller”, where technically feasible, unless exercise of this right adversely affects the rights and freedoms of others. A “controller” is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of your personal information.
Right to restriction of or processing. You have the right to restrict or object to us processing your personal information where one of the following applies:
(a) You contest the accuracy of your personal information that we processed. In such instances, we will restrict processing during the period necessary for us to verify the accuracy of your personal information.
(b) The processing is unlawful, and you oppose the erasure of your personal information and request the restriction of its use instead.
(c) We no longer need your personal information for the purposes of the processing, but it is required by you to establish, exercise or defense of legal claims.
Data Protection Officer: You may reach our data protection officer at support@bitwage.com Your rights to personal information are not absolute. Access may be denied when:
Denial of access is required or authorized by law;
Granting access would have a negative impact on other's privacy;
To protect our rights and properties;

Data Processing and Security Terms

The Customer agreeing to these terms (“Customer”) and Bitwage, Inc. or Bitwage Ireland Limited (as applicable, “Bitwage”) have entered into a Bitwage Platform License Agreement (as amended to date, the "Bitwage Platform License Agreement"). These Data Processing and Security Terms, including the Appendices (collectively, the “Terms”) are entered into by Customer and Bitwage as of the Terms Effective Date and supplement the Bitwage Platform License Agreement. These Terms supersede: (a) where the Bitwage Platform License Agreement was entered into offline with Bitwage Ireland Limited, the “Privacy” Clause in that agreement (if applicable); and (b) any Data Processing and Security Terms previously entered into between Customer and Bitwage on the same subject matter.

The “Terms Effective Date” is: (a) if these Terms are incorporated in the Bitwage Platform License Agreement by reference, the effective date of the Bitwage Platform License Agreement (subject to the paragraph above these Terms); or (b) if these Terms are not incorporated into the Bitwage Platform License Agreement by reference, the date Customer accepts these Terms by clicking to accept them.

If these Terms are not incorporated into the Bitwage Platform License Agreement by reference and you are accepting them on behalf of Customer, you represent and warrant that: (i) you have full legal authority to bind your employer, or the applicable entity, to these Terms; (ii) you have read and understand these Terms; and (iii) you agree, on behalf of the party you represent, to these Terms. If you do not have the legal authority to bind Customer, please do not click the “I Accept” button.

1. Introduction

These Terms reflect the parties’ agreement with respect to terms governing the processing of Customer Personal Data under the Bitwage Platform License Agreement.

2. Definitions

2.1 Capitalized terms used but not defined in these Terms have the meanings set out in the Bitwage Platform License Agreement. In these Terms, unless expressly stated otherwise:

Additional Products means products, services and applications (whether made available by Bitwage or a third party) that are not part of the Services, but that may be accessible via the Admin Console or otherwise, for use with the Services.

Agreement means the Bitwage Platform License Agreement, as supplemented by these Data Processing and Security Terms, and as may be further amended from time to time in accordance with the Bitwage Platform License Agreement.

Bitwage Platform License Agreement refers to the terms and conditions the Customer has agreed to for operating the Bitwage service.

Customer Data means content provided to Bitwage by Customer (or at its direction) via the Services under the Account.

Customer Personal Data means the personal data that is contained within the Customer Data.

Data Incident means (a) any unlawful access to Customer Data stored in the Services or systems, equipment, or facilities of Bitwage or its Subprocessors, or (b) unauthorized access to such Services, systems, equipment, or facilities that results in loss, disclosure, or alteration of Customer Data.

Data Protection Legislation means, as applicable: (a) any national provisions adopted pursuant to the Directive that are applicable to Customer and/or any Customer Affiliates as the controller(s) of the Customer Personal Data; and/or (b) the Federal Data Protection Act of 19 June 1992 (Switzerland).

Directive means Directive 95/46/EC of the European Parliament and of the Council on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data.

EEA means the European Economic Area.

Bitwage Group means those Bitwage Affiliates involved in provision of the Services to Customer.

Instructions means Customer’s written instructions to Bitwage consisting of the Agreement, including instructions to Bitwage to provide the Services as set out in the Agreement; instructions given by Customer via the Admin Console and otherwise in its use of the Services; and any subsequent written instructions given by Customer to Bitwage and acknowledged by Bitwage.

Contract Clauses or CCs mean the standard contractual clauses (processors) for the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection.

Safe Harbor Certification means a current certification to the U.S. Department of Commerce Safe Harbor framework requirements as set out at: https://export.gov/safeharbor/eu/eg_main_018475.asp, or any replacement framework or URL from time to time.

Security Measures has the meaning given in Section 6.1 (Security Measures) of these Terms.

Bitwage Platform License Agreement refers to the term “Bitwage Services” as defined under the terms and conditions the Customer has agreed to for operating the Bitwage service.

Subprocessors means (a) all Bitwage Group entities that have logical access to, store or process, Customer Personal Data (each, a “Bitwage Group Subprocessor”), and (b) all third parties (other than Bitwage Group entities) that are engaged to provide services to Customer and that have logical access to, store or process, Customer Personal Data (each, a "Third Party Subprocessor").

Third Party Auditor means a qualified and independent third party auditor, whose then-current identity Bitwage will disclose to Customer.

2.2 The terms “personal data”, “processing”, “data subject”, “controller” and “processor” have the meanings given to them in the Directive. The terms “data importer” and “data exporter” have the meanings given to them in the Model Contract Clauses.

3. Term

These Terms will take effect on the Terms Effective Date and, notwithstanding expiry or termination of the Bitwage Platform License Agreement, will remain in effect until, and automatically terminate upon, deletion by Bitwage of all data as described in Section 7 (Data Correction, Blocking, Exporting, and Deletion) of these Terms.

4. Data Protection Legislation

The parties agree and acknowledge that the Data Protection Legislation may apply to the processing of Customer Personal Data.

5. Processing of Customer Personal Data

5.1 Controller and Processor. If the Data Protection Legislation applies to the processing of Customer Personal Data, then as between the parties, the parties acknowledge and agree that: (a) Customer is the controller of Customer Personal Data under the Agreement; (b) Bitwage is a processor of such data; (c) Customer will comply with its obligations as a controller under the Data Protection Legislation; and (d) Bitwage will comply with its obligations as a processor under the Agreement. If under the Data Protection Legislation a Customer Affiliate is considered the controller (either alone or jointly with the Customer) with respect to certain Customer Personal Data, Customer represents and warrants to Bitwage that Customer is authorized: (i) to give the Instructions to Bitwage and otherwise act on behalf of such Customer Affiliate in relation to such Customer Personal Data as described in these Terms, and (ii) to bind the Customer Affiliate to these Terms. Appendix 1 sets out a description of the categories of data that may fall within Customer Personal Data and of the categories of data subjects to which that data may relate.

5.2 Scope of Processing. Bitwage will only process Customer Personal Data in accordance with the Instructions, and will not process Customer Personal Data for any other purpose.

5.3 Additional Products. Customer acknowledges that if it installs, uses, or enables Additional Products, then the Services may allow such Additional Products to access Customer Data as required for the interoperation of those Additional Products with the Services. The Agreement does not apply to the processing of data transmitted to or from such Additional Products. Such Additional Products are not required to use the Services.

6. Data Security; Security Compliance; Audits

6.1 Security Measures. Bitwage will take and implement appropriate technical and organizational measures to protect Customer Data against accidental or unlawful destruction or accidental loss or alteration, or unauthorized disclosure or access, or other unauthorized processing, as detailed in Appendix 2 (the "Security Measures"). Bitwage may update or modify the Security Measures from time to time, provided that such updates and modifications do not result in the degradation of the overall security of the Services. Customer agrees that it is solely responsible for its use of the Services, including securing its account authentication credentials, and that Bitwage has no obligation to protect Customer Data that Customer elects to store or transfer outside of Bitwage’s and its Subprocessors’ systems (e.g., offline or on-premise storage).

6.2 Security Compliance by Bitwage Staff. Bitwage will take appropriate steps to ensure compliance with the Security Measures by its employees, contractors and Subprocessors to the extent applicable to their scope of performance.

6.3 Data Incidents. If Bitwage becomes aware of a Data Incident, Bitwage will promptly notify Customer of the Data Incident, and take reasonable steps to minimize harm and secure Customer Data. Notification(s) of any Data Incident(s) will be delivered to the email address provided by Customer in the Agreement (or in the Admin Console) or, at Bitwage’s discretion, by direct Customer communication (e.g., by phone call or an in-person meeting). Customer acknowledges that it is solely responsible for ensuring that the contact information set forth above is current and valid, and for fulfilling any third party notification obligations. Customer agrees that “Data Incidents” do not include: (i) unsuccessful access attempts or similar events that do not compromise the security or privacy of Customer Data, including pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems; or (ii) accidental loss or disclosure of Customer Data caused by Customer’s use of the Services or Customer’s loss of account authentication credentials. Bitwage’s obligation to report or respond to a Data Incident under this Section will not be construed as an acknowledgement by Bitwage of any fault or liability with respect to the Data Incident.

6.4 Compliance with Security and Privacy Standards; SOC 2 and 3 Reports

6.4.1. its ISO/IEC 27001:2013 Bitwage develops, manages and operates its applications, systems and services in alignment with current ISO standards. Bitwage relies on the ISO Certification of it’s subprocessors to ensure their compliance to ISO. These may be obtained directly from those subprocessors.

6.4.2. Bitwage relies on its subprocessors for obtaining a confidential Service Organization Control (SOC) 2 report (or a comparable report). These may be obtained directly from those subprocessors.

6.4.3. Bitwage relies on its subprocessors for obtaining a confidential Service Organization Control (SOC) 3 report (or a comparable report). These may be obtained directly from those subprocessors.

6.5 Auditing Security Compliance.

6.5.1 Reviews of Security Documentation. Customers may contact the Bitwage subprocessors for:

6.5.1.1. the certificate issued in relation to subprocessor’s ISO 27001 Certification;

6.5.1.2. subprocessor’s then-current SOC 3 Report;

6.5.1.3. a summary or redacted version of the subprocessors then-current confidential SOC 2 Report; and

6.5.1.4. following a request by Customer in accordance with Section 6.5.4 below, the subprocessor’s then-current confidential SOC 2 Report.

6.5.2 Customer Reviews. If Customer (or an authorized Customer Affiliate) has entered into Contract Clauses as described in Section 10.2 of these Terms, Customer or such Customer Affiliate may exercise the review rights granted under clauses 5(f) and 12(2) of such Contract Clauses:

6.5.2.1. by instructing Bitwage to execute the a review as described in 6.5.1 above; and/or

6.5.2.2. following a request by Customer in accordance with Section 6.5.4 below, by executing an review as described in such Contract Clauses.

6.5.3 Additional Business Terms for Reviews. Bitwage and Customer (or an authorized Customer Affiliate if applicable) will discuss and agree in advance on:

6.5.3.1. the reasonable date(s) of and security and confidentiality controls applicable to any Customer review under Section 6.5.1.4; and

6.5.3.2. the identity of a suitably qualified review in accordance with the terms agreed upon within the Contract Clauses and the reasonable start date, scope and duration of and security and confidentiality controls applicable to any such review. The scope shall only include those activites performed by Bitwage and not any subprocessor except for those described under Section 5.4 and/or Section 6.5.1.

Bitwage reserves the right to charge a fee (based on Bitwage’s reasonable costs) for any review under Section 6.5.1.4 and/or under Section 6.5.2.2. For clarity, Bitwage is not responsible for any costs incurred or fees charged by any third party reviewer appointed in connection with a a review under Section 6.5.2.2. Nothing in this Section 6.5 varies or modifies any rights or obligations of Customer (or any authorized Customer Affiliate) or Bitwage, Inc. under any Contract Clauses entered into as described in Section 10.2 (Transfers of Data Out of the EEA) of these Terms.

6.5.4 Requests for Reviews and Audits. Any requests under Section 6.5.1 or 6.5.2 must be sent to the Data Privacy Office as described in Section 9 (Data Privacy Office for Bitwage Platform) of these Terms.

7. Data Correction, Blocking, Exporting, and Deletion

During the Term, Bitwage will provide Customer with the ability to correct, block, export and delete Customer Data in a manner consistent with the functionality of the Services and in accordance with the terms of the Agreement. Once Customer deletes Customer Data via the Services such that the Customer Data cannot be recovered by Customer (the “Customer-Deleted Data”), Bitwage will delete the Customer-Deleted Data within a maximum period of 180 days, unless applicable legislation or legal process prevents it from doing so. On the expiry or termination of the Agreement (or, if applicable on expiry of any post-termination period during which Bitwage may agree to continue providing access to the Services), after a recovery period of up to 30 days following such expiry or termination, Bitwage will thereafter delete the Customer-Deleted Data within a maximum period of 180 days, unless applicable legislation or legal process prevents it from doing so.

8. Access; Export of Data

During the Term, Bitwage will make available to Customer the Customer Data in a manner consistent with the functionality of the Services and in accordance with the terms of the Agreement. To the extent Customer, in its use and administration of the Services during the Term, does not have the ability to amend or delete Customer Data (as required by applicable law), or migrate Customer Data to another system or service provider, Bitwage will, at Customer’s reasonable expense, comply with any reasonable requests by Customer to assist in facilitating such actions to the extent Bitwage is legally permitted to do so and has reasonable access to the relevant Customer Data.

9. Data Privacy Office for Bitwage Platform

Bitwage’s Data Privacy Office for Bitwage Platform can be contacted by Customer administrators at support@bitwage.com (or via such other means as Bitwage may provide).

10. Data Transfers

10.1 Transfers of Data Out of the EEA. If the storage and processing of Customer Data (as set out in Section 10.1 above) involves transfers of Customer Personal Data out of the EEA, and Data Protection Legislation applies to those transfers, Bitwage will:

10.1.1 ensure that Bitwage, Inc. as the data importer of Customer Personal Data enters into Model Contract Clauses with Customer (or an authorized Customer Affiliate) as the data exporter of such data, if Customer so requests, and that the transfers are made in accordance with any such Model Contract Clauses; and/or

10.1.2 adopt a solution that achieves compliance with the terms of the Directive for transfers of personal data to a third country, and ensure that the transfers are made in accordance with such solution.

10.2 Data Center Information. Bitwage will make available to Customer information about the countries in which data centers used to store Customer Personal Data are located.

11. Subprocessors

11.1 Subprocessors. Bitwage may engage Subprocessors to provide limited parts of the Services, subject to the restrictions in these Terms.

11.2 Subprocessing Restrictions. Bitwage will ensure that Subprocessors only access and use Customer Data in accordance with Section 10.1 (Data Location and Transfers) and terms of the Agreement and that they are bound by written agreements that require them to provide at least the level of data protection required by the following, as applicable pursuant to Section 10.2 (Transfers of Data Out of the EEA): (a) any Model Contract Clauses entered into by Bitwage, Inc. and Customer (or an authorized Customer Affiliate); and/or (b) any alternative compliance solution adopted by Bitwage.

11.3 Consent to Subprocessing. Customer consents to Bitwage subcontracting the processing of Customer Data to Subprocessors in accordance with the Agreement. If the Model Contract Clauses have been entered into as described above, Customer (or, if applicable, an authorized Customer Affiliate) consents to Bitwage, Inc. subcontracting the processing of Customer Data in accordance with the terms of the Model Contract Clauses.

11.4 Additional Information. At the written request of the Customer, Bitwage will provide additional information regarding Subprocessors and their locations. Any such requests must be sent to Bitwage’s Data Privacy Office for Bitwage Platform, the contact details of which are set out in Section 9 (Data Privacy Office for Bitwage Platform) above.

GDPR Standard Contractual Clauses

Standard contractual clauses for the transfer of personal data from the Community to third countries (controller to controller transfers) Data transfer agreement between

The data exporter, which constitutes you (a) a employee within the European Economic Area ("EEA") receiving or using Bitwage Services as defined in the Terms of Use; (b) a contractor within the EEA receiving or using Bitwage Services as defined in the Terms of Use; (c) a company within the EEA receiving or using Bitwage Services as defined in the Terms of Use; or (d) any other kind of entity within the EEA receiving or using Bitwage Services as defined in the Terms of Use.

hereinafter "data exporter")

And

Bitwage Inc. and it's affiliated entities. 244 California Street, Suite 607, California, 94111, USA.

hereinafter "data importer" each a “party”; together “the parties”.

HAVE AGREED that the following Contractual Clauses (the Clauses) are entered into by the parties in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data.

Definitions

For the purposes of the Clauses:

“personal data”, “special categories of data/sensitive data”, “process/processing”, “controller”, “processor”, “data subject” and “supervisory authority/authority” shall have the same meaning as in Directive 95/46/EC of 24 October 1995 (whereby “the authority” shall mean the competent data protection authority in the territory in which the data exporter is established);
“the data exporter” shall mean the controller who transfers the personal data;
“the data importer” shall mean the controller who agrees to receive from the data exporter personal data for further processing in accordance with the terms of these clauses and who is not subject to a third country’s system ensuring adequate protection;
“clauses” shall mean these contractual clauses, which are a free-standing document that does not incorporate commercial business terms established by the parties under separate commercial arrangements.

The details of the transfer (as well as the personal data covered) are specified in Annex B, which forms an integral part of the clauses.

1. Obligations of the data exporter

The data exporter warrants and undertakes that:

1.1. The personal data have been collected, processed and transferred in accordance with the laws applicable to the data exporter.

1.2. It has used reasonable efforts to determine that the data importer is able to satisfy its legal obligations under these clauses.

1.3. It will provide the data importer, when so requested, with copies of relevant data protection laws or references to them (where relevant, and not including legal advice) of the country in which the data exporter is established.

1.4. It will respond to enquiries from data subjects and the authority concerning processing of the personal data by the data importer, unless the parties have agreed that the data importer will so respond, in which case the data exporter will still respond to the extent reasonably possible and with the information reasonably available to it if the data importer is unwilling or unable to respond. Responses will be made within a reasonable time.

1.5. It will make available, upon request, a copy of the clauses to data subjects who are third party beneficiaries under clause III, unless the clauses contain confidential information, in which case it may remove such information. Where information is removed, the data exporter shall inform data subjects in writing of the reason for removal and of their right to draw the removal to the attention of the authority. However, the data exporter shall abide by a decision of the authority regarding access to the full text of the clauses by data subjects, as long as data subjects have agreed to respect the confidentiality of the confidential information removed. The data exporter shall also provide a copy of the clauses to the authority where required.

2. Obligations of the data importer

The data importer warrants and undertakes that:

2.1. It will have in place appropriate technical and organisational measures to protect the personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, and which provide a level of security appropriate to the risk represented by the processing and the nature of the data to be protected.

2.2. It will have in place procedures so that any third party it authorises to have access to the personal data, including processors, will respect and maintain the confidentiality and security of the personal data. Any person acting under the authority of the data importer, including a data processor, shall be obligated to process the personal data only on instructions from the data importer. This provision does not apply to persons authorised or required by law or regulation to have access to the personal data.

2.3. It has no reason to believe, at the time of entering into these clauses, in the existence of any local laws that would have a substantial adverse effect on the guarantees provided for under these clauses, and it will inform the data exporter (which will pass such notification on to the authority where required) if it becomes aware of any such laws.

2.4. It will process the personal data for purposes described in Annex B, and has the legal authority to give the warranties and fulfil the undertakings set out in these clauses.

2.5. It will identify to the data exporter a contact point within its organisation authorised to respond to enquiries concerning processing of the personal data, and will cooperate in good faith with the data exporter, the data subject and the authority concerning all such enquiries within a reasonable time. In case of legal dissolution of the data exporter, or if the parties have so agreed, the data importer will assume responsibility for compliance with the provisions of clause I(e).

2.6. At the request of the data exporter, it will provide the data exporter with evidence of financial resources sufficient to fulfil its responsibilities under clause III (which may include insurance coverage).

2.7. Upon reasonable request of the data exporter, it will submit its data processing facilities, data files and documentation needed for processing to reviewing, auditing and/or certifying by the data exporter (or any independent or impartial inspection agents or auditors, selected by the data exporter and not reasonably objected to by the data importer) to ascertain compliance with the warranties and undertakings in these clauses, with reasonable notice and during regular business hours. The request will be subject to any necessary consent or approval from a regulatory or supervisory authority within the country of the data importer, which consent or approval the data importer will attempt to obtain in a timely fashion.

2.8. It will process the personal data, at its option, in accordance with:

2.8.1. the data protection laws of the country in which the data exporter is established, or

2.8.2. the relevant provisions (1) of any Commission decision pursuant to Article 25(6) of Directive 95/46/EC, where the data importer complies with the relevant provisions of such an authorisation or decision and is based in a country to which such an authorisation or decision pertains, but is not covered by such authorisation or decision for the purposes of the transfer(s) of the personal data (2), or

2.9. the data processing principles set forth in Annex A.

2.10. Data importer to indicate which option it selects:

2.10.1. Initials of data importer:_;

2.11. It will not disclose or transfer the personal data to a third party data controller located outside the European Economic Area (EEA) unless it notifies the data exporter about the transfer and

2.11.1. the third party data controller processes the personal data in accordance with a Commission decision finding that a third country provides adequate protection, or

2.11.2. the third party data controller becomes a signatory to these clauses or another data transfer agreement approved by a competent authority in the EU, or

2.11.3. data subjects have been given the opportunity to object, after having been informed of the purposes of the transfer, the categories of recipients and the fact that the countries to which data is exported may have different data protection standards, or

2.11.4. with regard to onward transfers of sensitive data, data subjects have given their unambiguous consent to the onward transfer

3. Liability and third party rights

3.1. Each party shall be liable to the other parties for damages it causes by any breach of these clauses. Liability as between the parties is limited to actual damage suffered. Punitive damages (i.e. damages intended to punish a party for its outrageous conduct) are specifically excluded. Each party shall be liable to data subjects for damages it causes by any breach of third party rights under these clauses. This does not affect the liability of the data exporter under its data protection law.

3.2. The parties agree that a data subject shall have the right to enforce as a third party beneficiary this clause and clauses 1.2, 1.4, 1.5, 2.1, 2.3, 2.4, 2.5, 2.8, 2.9, 3.1, 5, 6.4 and 7 against the data importer or the data exporter, for their respective breach of their contractual obligations, with regard to his personal data, and accept jurisdiction for this purpose in the data exporter’s country of establishment. In cases involving allegations of breach by the data importer, the data subject must first request the data exporter to take appropriate action to enforce his rights against the data importer; if the data exporter does not take such action within a reasonable period (which under normal circumstances would be one month), the data subject may then enforce his rights against the data importer directly. A data subject is entitled to proceed directly against a data exporter that has failed to use reasonable efforts to determine that the data importer is able to satisfy its legal obligations under these clauses (the data exporter shall have the burden to prove that it took reasonable efforts).

4. Law applicable to the clauses

These clauses shall be governed by the law of the country in which the data exporter is established, with the exception of the laws and regulations relating to processing of the personal data by the data importer under clause 2.8, which shall apply only if so selected by the data importer under that clause.

5. Resolution of disputes with data subjects or the authority

5.1. In the event of a dispute or claim brought by a data subject or the authority concerning the processing of the personal data against either or both of the parties, the parties will inform each other about any such disputes or claims, and will cooperate with a view to settling them amicably in a timely fashion.

5.2. The parties agree to respond to any generally available non-binding mediation procedure initiated by a data subject or by the authority. If they do participate in the proceedings, the parties may elect to do so remotely (such as by telephone or other electronic means). The parties also agree to consider participating in any other arbitration, mediation or other dispute resolution proceedings developed for data protection disputes.

5.3. Each party shall abide by a decision of a competent court of the data exporter’s country of establishment or of the authority which is final and against which no further appeal is possible.

6. Termination

6.1. In the event that the data importer is in breach of its obligations under these clauses, then the data exporter may temporarily suspend the transfer of personal data to the data importer until the breach is repaired or the contract is terminated.

6.2. In the event that:

6.2.1. the transfer of personal data to the data importer has been temporarily suspended by the data exporter for longer than one month pursuant to paragraph (6.2.1);

6.2.2. compliance by the data importer with these clauses would put it in breach of its legal or regulatory obligations in the country of import;

6.2.3. the data importer is in substantial or persistent breach of any warranties or undertakings given by it under these clauses;

6.2.4. a final decision against which no further appeal is possible of a competent court of the data exporter’s country of establishment or of the authority rules that there has been a breach of the clauses by the data importer or the data exporter; or

6.2.5. a petition is presented for the administration or winding up of the data importer, whether in its personal or business capacity, which petition is not dismissed within the applicable period for such dismissal under applicable law; a winding up order is made; a receiver is appointed over any of its assets; a trustee in bankruptcy is appointed, if the data importer is an individual; a company voluntary arrangement is commenced by it; or any equivalent event in any jurisdiction occurs

6.3 then the data exporter, without prejudice to any other rights which it may have against the data importer, shall be entitled to terminate these clauses, in which case the authority shall be informed where required. In cases covered by 6.2.1, 6.2.2, or 6.2.4 above the data importer may also terminate these clauses.

6.4. Either party may terminate these clauses if (i) any Commission positive adequacy decision under Article 25(6) of Directive 95/46/EC (or any superseding text) is issued in relation to the country (or a sector thereof) to which the data is transferred and processed by the data importer, or (ii) Directive 95/46/EC (or any superseding text) becomes directly applicable in such country.

6.5. The parties agree that the termination of these clauses at any time, in any circumstances and for whatever reason (except for termination under clause VI(c)) does not exempt them from the obligations and/or conditions under the clauses as regards the processing of the personal data transferred.

7. Variation of these clauses

The parties may not modify these clauses except to update any information in Annex B, in which case they will inform the authority where required. This does not preclude the parties from adding additional commercial clauses where required.

8. Description of the Transfer

The details of the transfer and of the personal data are specified in Annex B. The parties agree that Annex B may contain confidential business information which they will not disclose to third parties, except as required by law or in response to a competent regulatory or government agency, or as required under clause 1.5. The parties may execute additional annexes to cover additional transfers, which will be submitted to the authority where required. Annex B may, in the alternative, be drafted to cover multiple transfers.

GDPR Standard Contractual Clauses Annex A

DATA PROCESSING PRINCIPLES

Purpose limitation: Personal data may be processed and subsequently used or further communicated only for purposes described in Annex B or subsequently authorised by the data subject.
Data quality and proportionality: Personal data must be accurate and, where necessary, kept up to date. The personal data must be adequate, relevant and not excessive in relation to the purposes for which they are transferred and further processed.
Transparency: Data subjects must be provided with information necessary to ensure fair processing (such as information about the purposes of processing and about the transfer), unless such information has already been given by the data exporter.
Security and confidentiality: Technical and organisational security measures must be taken by the data controller that are appropriate to the risks, such as against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, presented by the processing. Any person acting under the authority of the data controller, including a processor, must not process the data except on instructions from the data controller.
Rights of access, rectification, deletion and objection: As provided in Article 12 of Directive 95/46/EC, data subjects must, whether directly or via a third party, be provided with the personal information about them that an organisation holds, except for requests which are manifestly abusive, based on unreasonable intervals or their number or repetitive or systematic nature, or for which access need not be granted under the law of the country of the data exporter. Provided that the authority has given its prior approval, access need also not be granted when doing so would be likely to seriously harm the interests of the data importer or other organisations dealing with the data importer and such interests are not overridden by the interests for fundamental rights and freedoms of the data subject. The sources of the personal data need not be identified when this is not possible by reasonable efforts, or where the rights of persons other than the individual would be violated. Data subjects must be able to have the personal information about them rectified, amended, or deleted where it is inaccurate or processed against these principles. If there are compelling grounds to doubt the legitimacy of the request, the organisation may require further justifications before proceeding to rectification, amendment or deletion. Notification of any rectification, amendment or deletion to third parties to whom the data have been disclosed need not be made when this involves a disproportionate effort. A data subject must also be able to object to the processing of the personal data relating to him if there are compelling legitimate grounds relating to his particular situation. The burden of proof for any refusal rests on the data importer, and the data subject may always challenge a refusal before the authority.
Sensitive data: The data importer shall take such additional measures (e.g. relating to security) as are necessary to protect such sensitive data in accordance with its obligations under clause II.
Data used for marketing purposes: Where data are processed for the purposes of direct marketing, effective procedures should exist allowing the data subject at any time to “opt-out” from having his data used for such purposes.
Automated decisions: For purposes hereof “automated decision” shall mean a decision by the data exporter or the data importer which produces legal effects concerning a data subject or significantly affects a data subject and which is based solely on automated processing of personal data intended to evaluate certain personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct, etc. The data importer shall not make any automated decisions concerning data subjects, except when:
such decisions are made by the data importer in entering into or performing a contract with the data subject, and
(the data subject is given an opportunity to discuss the results of a relevant automated decision with a representative of the parties making such decision or otherwise to make representations to that parties.
or where otherwise provided by the law of the data exporter.

GDPR Standard Contractual Clauses Annex B

DESCRIPTION OF THE TRANSFER

LAST UPDATED - December 04, 2020

Data Subject

The personal data transferred concern the following categories of data subjects:

Website Visitors: Any person or entity that accesses the websites managed by Bitwage, Inc. and its affiliates.

Bitwage Services User: Any person or entity that provides its email through the Bitwage website or Bitwage customer support channels.

Third Party Users with Bitwage Accounts: Any person or entity that directly or indirectly uses Bitwage through a third-party service.

Purposes Of The Transfer(s)

The transfer is made for the following purposes

Bitwage Services: We use information we have to operate and provide Bitwage Services, including providing customer support and improving, fixing and customizing Bitwage Services. We understand how people use the Bitwage Services and analyze and use the information we have to evaluate and improve the Bitwage Services, research, develop and test new services and features, and conduct troubleshooting activities. We also use your information to respond to you when you contact us.

Safety And Security: We verify accounts and activity, and promote safety and security on and off the Bitwage Services, such as by investigating suspicious acidity or violations of our Terms, and to ensure the Bitwage Services are being used legally.

Communications About The Bitwage Services: We use the information we have to communicate with you about the Bitwage Services and features and let you know about our terms and policies and other important updates. We may provide you marketing for the Bitwage Services. We may user your information as a basis for funding other potential customers for the Bitwage services.

Measurement, Analytics, And Other Business Services: We help companies who use the Bitwage Services analyze their past usage of the services. If you have received wages or invoices from companies on using the Bitwage Services, that data will be recorded in their transaction history.

Categories Of Data

The personal data transferred concern the following categories of data

Account Information: You provide data in order to open an account and to user Bitwage Services, such as name, address, company name, company EIN, company URL and other data provided to verify your account. You may also provide information of your various bank accounts, digital wallets or credit cards in order to use the Bitwage services. This information is related to your Personally Identifiable Information. You can learn more about how we secure this data in our Security Policy.

Customer Support: This includes any communication you have with the members of Bitwage, Inc. and its affiliates. This includes, but is not limited to, communicate through email, slack or any other form of communication.

Use of Bitwage Services: This includes any information related to your usage of our services, such as activity, log files, transactions, IP addresses, devices, locations.

Cookies: When you access our website, we, or third party services that we use, may place small data files called "cookies" on your computer. We and our service providers may also use cookies to customize the Bitwage Services, content and advertising; measure promotional effectiveness, and promote trust and safety.

We encode our cookies (see our Security Policy- Browser Security) so that only we can interpret the information stored in them. We may also collect information about your computer or other access devices to mitigate risk and for fraud prevention purposes.

Third Party Information: We receive information about you from other users and businesses. For example, a company administrator may indicate whether you are an employee or a freelancer. We work with third-party service providers to help us operate, provide, improve, understand, customize, support and market the Bitwage Services. For example, we work with companies to provide our infrastructure, ensure we adhere to anti-money laundering regulations and laws, and market our services, conduct surveys and research and help with customer service. We also allow you to use the Bitwage Services in connection with third-party services, for example, your company's time tracking service may have an integration of Bitwage Services. These companies may provide us information about you in certain circumstances.

Recipients

The personal data transferred may be disclosed only to the following recipients or categories of recipients

Regulatory Compliance: Data is shared with third-parties in order to fulfill various regulatory and legal obligations.

Email & Chat: Data is received and sent between Bitwage team members and customers through various email and chat services.

Technology Infrastructure: Data is shared and stored on third-party hosted databases, servers and other technology service providers required to operate the Bitwage Services.

Marketing & Analysis: Data is shared with services to visualize user data, send marketing of Bitwage Services to Data Subjects, find customers with similar profiles to Data Subjects.

Additional Useful Information

Contact Information

Support@Bitwage.com