Partner Agreement

Terms of Service for Project Partners
between the Project Partner who acts as media owner in accordance to media law

and

SPOTTERON GmbH
Faßziehergasse 5 / 16, 1070 Vienna, AT
UID: ATU73129349
FN: 488215p

who acts as provider of the service and software

1) Scope

SPOTTERON GmbH will provide a toolkit for the Partner as agreed for an official quotation for the project's scope, sent to the partner via email or postal mail, and via the exchange of messages or emails.

2) Grant of License to Access and Use Service

SPOTTERON GmbH hereby grants to the Partner, including to all Partner's Authorized Users (max 10), a non-exclusive, non-sublicensable, non-assignable, royalty-free, and worldwide license to access and use the SPOTTERON platform solely for the Partner's internal operations and according to SPOTTERON GmbH's Terms of Use listed at https://www.spotteron.net/terms-of-use.

The Service consists of the

• design, development and launch of the application and/or software for the Project of the Partner,
• the ongoing maintenance and updates of the applications/software in the regular update cycles of the SPOTTERON Platform by SPOTTERON GmbH
• the grant of access to the Administration Interface of the SPOTTERON Platform for the Partner’s registered Project administrator users
• the hosting of data and user-generated content (UGC), map server map-tile traffic (within a fair-use level),
• the provision of the aggregated and anonymized data for analysis by the Partner via CSV download or additionally via API if part of the package,
• the creation of concepts, designs and the development for new features, software and system extensions as additional parts of the project if funded
• and in case of SPOTTERON Package B the development and setup of a CMS based website based on the SPOTTERON web template and provision of administration access for website admin users.

Summary of the Service:

3) Support Services

Runtime Support: For the runtime period beginning on the Effective Date, and at SPOTTERON GmbH's own expense, SPOTTERON GmbH shall provide the Partner with electronic support (eMail, scheduled Skype call) during SPOTTERON GmbH's normal business hours in order to help the Partner locate and correct problems with the Service and any related software.

Renewed Support: After the initial Service runtime period, the Partner may elect to renew SPOTTERON GmbH's service runtime for additional periods of minimum 12 months at SPOTTERON GmbH's then-current service rates of the SPOTTERON package provided.

4) Maintenance

SPOTTERON GmbH shall provide bug fixes, corrections, modifications, enhancements, upgrades, and new releases to the Services to ensure the best possible level of functionality of the Services including but not limited to, the Services conforming in all material respects to the specifications, functions, descriptions, standards, and criteria. The Services runtime fees of the SPOTTERON package are inclusive of the fees for regular maintenance and updates within the SPOTTERON Platform update cycles.

5) Payment

If not agreed otherwise, the payment of the SPOTTERON Package is 33% of the full sum at the start of the development phase of the Project (“Kick-Off Payment”) and 67% on the release of the apps. SPOTTERON GmbH will provide invoices for both payments.

6) Taxes

Payment amounts under this Agreement do not include Taxes, and the Partner shall pay all Taxes applicable to payments between the parties under this agreement. For EU based partners with a UIN number or international partners in countries with Reversed Charge agreements in place, SPOTTERON GmbH provides invoices VAT free.

7) Interest on Late Payments

Any amount not paid when due will bear interest from the due date until paid, at a rate equal to 2% per month (24% annually) or the maximum allowed by law, whichever is less.

8) Service Levels

Applicable Levels: SPOTTERON GmbH shall provide the Service to the Partner with a system availability of at least 96% during each calendar year. Please note that per-user availability can also depend on the connectivity and software/hardware of the party accessing the Services and in such cases it will not count against the system availability.

System Maintenance: SPOTTERON GmbH may take the Service offline for scheduled or emergency maintenance. Scheduled maintenance time will not count against System Availability.

8.1) System Availability Definition:

Percentage of Minutes per Month: "System Availability" means the percentage of hours in a year that the key components of the Service are operational.

Not Included in "System Availability: "System Availability" will not include any minutes or hours of downtime resulting from

• scheduled maintenance,

• events of force majeure,

• malicious attacks on the system,

• issues associated with the Partner's computing devices, local area networks or internet service provider connections, or

• SPOTTERON GmbH's inability to deliver Services because of the Partner's acts or omissions.

9) Data

In this Clause:

“Controller”, “Personal Data”, Data Subject, “Processing” and “Processor” or “Data Processor” have the meanings given in Data Protection Law and “Process” shall be interpreted accordingly; and

“Data Protection Laws” means any applicable law, statute, subordinate legislation regulation, order, mandatory guidance or code of practice, judgment of a relevant court of law, or directives or requirements of any regulatory body which relates to the protection of individuals with regard to the processing of Personal Data, with the EU General Data Protection Regulation (GDPR) as the governed regulation.

9.1) Both Parties will comply with all applicable requirements of the Data Protection Laws.

9.2) The Parties acknowledge that for the purposes of the Data Protection Laws:

9.2 (a) SPOTTERON is the Data Controller in relation to all platform-related personal and non-personal data. SPOTTERON will provide user registration and identification for the Project as part of the Service as Controller. SPOTTERON will not share platform-related personal data with the Partner; and

9.2 (b) SPOTTERON will collect the data from user’s inputs and user generated content and will make it available to the Partner in an anonymized and aggregated format. The definition of what kind of data is collected by the Project, and if the data definition contains elements of personal data, is made by the Partner in the Project’s definition phase. For all Project-related data and content, the Partner is the Data Controller and SPOTTERON acts as the Data Processor.

(where “Data Controller” and “Data Processor” have the meanings as defined in the Data Protection Laws).

9.3 SPOTTERON shall, in relation to any Personal Data processed which falls under the definition of 9.2(b) under this Agreement:

9.3 (a) process that Personal Data which falls under the definition of 9.2(b) only on the written instructions of the Partner and in accordance with Appendix 1, unless SPOTTERON is required by any applicable Data Protection Laws to process the Personal Data in another manner.

9.3 (b) ensure that it has in place appropriate industry-standard technical and organisational measures to protect against unauthorised or unlawful processing of Personal Data which falls under the definition of 9.2(b) and against accidental loss or destruction of, or damage to, Personal Data which falls under the definition of 9.2(b), appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, within the scope of the current state of technological development (those measures may include encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to Personal Data which falls under the definition of 9.2(b) can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it);

9.3 (c) ensure that all personnel who have access to and/or process Personal Data are obliged to keep the Personal Data confidential;

9.3 (d) ensure that any transfer of Personal Data outside of the European Economic Area complies with the Data Protection Laws;

9.3 (e) assist the Partner, at the Partner’s cost, in responding to any request from a data subject and in ensuring compliance with its obligations under the Data Protection Laws with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;

9.3 (f) notify the Partner without undue delay on becoming aware of a Personal Data breach;

9. 3(g) at the end of this Agreement, delete or return Personal Data which falls under the definition of 9.2(b) and copies thereof to the Partner if requested (at the Partner’s cost); and

9.3 (h) make available to the Partner (at the Partner’s cost) all information necessary to demonstrate compliance with this Clause 9.3 and allow for audits by the Partner or the Partner’s designated auditor (at the Partner’s cost).

9.4) The Partner provides SPOTTERON with a general written authorization for engaging third-party sub-Processors. SPOTTERON shall inform the Partner of any intended changes concerning the addition or replacement of third-party sub-Processors, thereby giving the Partner the opportunity to object to such changes. Objections by the Partner to a change or addition of a sub-Processor may result in termination of the app and the Service. In such a case, no charges, compensations or reparations can be requested by the Partner. The current sub-processors for data hosting are noted in the public information area in the app under "locations of data storage".

9.5) Data use: the Partner may license, store and distribute exported Data (a Data-set) in any way chosen only after a full anonymization or deletion of all personal data of the users in the Data-set, including when releasing data publicly, e.g. under OpenData licenses.

9.6) Personal data protection: the Partner guarantees to have safeguards mechanisms in place to protect the personal data of participating user (Participants) and ensure the internal use only of personal data, either in exports or via administration interface access.

9.7) Additional Sub-Partners: the Partner may appoint additional Sub-Partners (clause 23) to the Project under the terms of this Partner Agreement with access to the Data Administration Interface. These Sub-Partners must form a contract with the Partner. The Partner is liable for the rightful data processing and protection of personal data for all sub-partners and must inform SPOTTERON of data breaches or the misuse of data.

9.8) User generated content license: the Partner agrees that all user generated content (UGC) worthy of protection by intellectual property laws is licensed under Creative Commons CC:0 license and will not be distributed or used under another license.

9.9) During the term of this Agreement, it is acknowledged that each Party may disclose to the other Personal Data (“Disclosed Data”) for the purposes of the management and administration of this Agreement (including the performance of its obligations and the exercise of its rights). The parties agree that such disclosure is fair and lawful and does not contravene the Data Protection Law; that it shall use Disclosed Data received from the other party only for the Purpose; and that it shall otherwise comply with its obligations under the Data Protection Law. Each party will promptly inform the other upon becoming aware of any Personal Data breach relating to any Disclosed Data received by it from the other party.

10) Data Privacy

SPOTTERON GmbH may collect, use and process Personal Data of the Partner and his associates only in compliance with the EU GDPR.

11) Publicity Cooperation

Both parties agree to name the other in press releases, online articles and publications with the full name, homepage link and logo if possible (not binding). On website items in relation to the Project, both parties will use HTML links (a href) for the name and / or homepage link without rel=”nofollow” tag. On social media, posts regarding the Project will tag and link (@partneraccountname) both parties if possible (not binding).

12) Representation

12.1.) Mutual Representation

Authority and Capacity: The parties have the authority and capacity to enter into this Agreement.

Execution and Delivery: The parties have duly executed and delivered this Agreement.

Enforceability: This Agreement constitutes a legal, valid, and binding obligation, enforceable against the parties according to its terms.

No Conflicts: Neither party is under any restriction or obligation that the party could reasonably expect might affect the party's performance of its obligations under this Agreement.

No Breach: Neither party’s execution, delivery, or performance of its obligations under this Agreement will breach or result in a default under

• its articles, by laws, or any unanimous shareholders agreement,

• any Law to which it is subject,

• any judgment, Order, or decree of any Governmental Authority to which it is subject, or

• any agreement to which it is a party or by which it is bound.

Permits, Consents, and Other Authorizations. Each party holds all Permits and other authorizations necessary to

• own, lease, and operate its properties, and

• conduct its business as it is now carried on.

No Disputes or Proceedings: There are no Legal Proceedings pending, threatened, or foreseeable against either party, which would affect that party’s ability to complete its obligations under this Agreement.

No Bankruptcy: Neither party has taken or authorized any proceedings related to that party’s bankruptcy, insolvency, liquidation, dissolution, or winding up.

12.2) SPOTTERON GmbH's Representations

Ownership: SPOTTERON GmbH is the exclusive legal owner of the Service, including all Intellectual Property included in the Service and granted under the scope of the Project.

Status of Licensed Intellectual Property: SPOTTERON GmbH has properly registered and maintained all Intellectual Property included in the Service of their own making and granted under the project scope and paid all applicable maintenance and renewal fees.

No Conflicting Grant: SPOTTERON GmbH has not granted and is not obligated to grant any license to a third party that would conflict with the Project scope.

No Infringement: The Service does not infringe the Intellectual Property rights or other proprietary rights of any third party. User generated content infringing Intellectual Property Law will be removed and permanently deleted on request by owner requests.

No Third Party infringement: To SPOTTERON GmbH's Knowledge, no third party is infringing the Service.

13) Partner Obligations

Hardware Obligations: the Partner shall be responsible for

• obtaining and maintaining all computer hardware, software, and communications equipment needed to internally access the Service, and

• paying all third party access charges incurred while using the Service.

Anti-Virus Obligations: the Partner shall be responsible for implementing, maintaining, and updating all necessary and proper procedures and software for safeguarding against computer infection, viruses, worms, Trojan horses, and other code that manifest contaminating or destructive properties (collectively "Viruses").

The Partner's Use of Services: the Partner shall

• abide by all local and international Laws and regulations applicable to its use of the Service,

• use the Service only for legal purposes, and

• comply with all regulations, policies and procedures of networks connected to the service

Restricted Uses: the Partner will not

• upload or distribute of any files that contain viruses, corrupted files, or any other similar software or programs that may damage the operation of the Service,

• modify, disassemble, decompile or reverse engineer the Service,

• probe, scan, test the vulnerability of, or circumvent any security mechanisms used by, the sites, servers, or networks connected to the Service,

• take any action that imposes an unreasonably or disproportionately large load on the sites, servers, or networks connected to the Service,

• copy or reproduce the Service,

• access or use any other clients' or their users' data through the Service,

• maliciously reduce or impair the accessibility of the Service,

• use the service to post, promote, or transmit any unlawful, harassing, libelous, abusive, threatening, harmful, hateful, or otherwise objectionable material, or

• transmit or post any material that encourages conduct that could constitute a criminal offense or give rise to civil liability.

Data administration: The Partner is obliged to check that content, provided by users in the Partner‘s Project, do not violate any intellectual property laws or licenses, or that the Partner or the Partner organization holds all necessary rights of usage by the owner of the content to be used as public content in the Project‘s applications or website.

The Partner maintains the data set in the Partner’s Project and removes any items and content, that may violate the terms of use of the Service or which may infringe any copyright, personal rights or intellectual property laws.

14) Confidentiality Obligations

The parties shall continue to be bound by the terms of the non-disclosure agreement between the parties if existing for the Project.

15) Export Compliance

No Representation by SPOTTERON GmbH: SPOTTERON GmbH makes no representation or warranty as to the accuracy or reliability or use of the service outside EU regulations and National State laws of Austria.

the Partner Status: the Partner represents and that it is not located in, under the control of, or a national or resident of any country to which the EU or Austria has embargoed the import or export of goods or provision of services.

16) Limited Warranty

Service Warranty: SPOTTERON GmbH will provide the Service in a professional manner consistent with general industry standards.

Performance Warranty: SPOTTERON GmbH warrants that the Service will perform substantially in accordance with the Documentation of functionalities athttps://www.spotteron.net/citizen-science-app-features

Warranty Disclaimer: SPOTTERON GmbH does not guarantee that the Service will be error-free, virus-free, or uninterrupted. SPOTTERON Gmbh will not be liable for any unauthorized alteration, theft, or destruction of any of the user’s or Partner’s data.

17) Ownership of Intellectual Property

17.1) Content provided by SPOTTERON: SPOTTERON GmbH will retain all interest in and to the Services, including all documentation, modifications, improvements, upgrades, derivative words, and all other Intellectual Property rights in connection with the Service and Platform, including SPOTTERON GmbH's name, logos and trademarks reproduced through the Service. SPOTTERON agrees to indemnify the Partner against all liabilities, costs, claims, losses, and expenses assessed against, or incurred by, the Partner as a result of, or in connection with, any claim brought by a third party against the use of such material, provided by SPOTTERON for the Project.

17.2) Content provided by Partner: The Partner retains all interest and ownership of all content the Partner provides to SPOTTERON for the purpose of being used in the Partner’s Project. The Partner agrees to provide source material to SPOTTERON, that is under full intellectual property of the Partner or which is licensed correctly to be legally used in the production and publishing of the Partner’s tools, websites and software. The partner is liable for all media and content provided to SPOTTERON for further use in the Partner’s Project and agrees keep SPOTTERON indemnified against all liabilities, costs, claims, losses, and expenses assessed against, or incurred by, SPOTTERON as a result of any claim brought by a third party against the use of such material, provided by the Partner for the Project. In the event that such a claim arises, SPOTTERON will:

(a) promptly notify the Partner of any such claim; and

(b) not make any admission or compromise with respect to such claim without the Partner’s prior approval which approval shall not unreasonably be withheld; and

The Partner shall, at its expense, give SPOTTERON all reasonable assistance in connection with negotiations and litigation to settle any claim arising under clause 17.2.

17.3) Data and User Generated Content:

The Partner can freely choose, under which license the Data-set is handled as long this license does not interfere, nor is in any conflict with the Service or its Terms of Use. Unique creative works in user generated content remain the intellectual property of the author and they are always licensed under Creative Commons CC0 for general public use by the uploader (user).

17.4) Outcomes of the Project: The Partner will own the Intellectual Property rights in any material (including any findings, academic publications, teaching material and research) that the Partner creates by interpreting and analysing the anonymized data-set, and may share the anonymized data-set with research partners.

18) Termination

Termination on Notice: Either party may terminate this Agreement for any reason on 28 business days’ notice to the other party.

Termination for Material Breach: Each party may terminate this Agreement with immediate effect by delivering notice of the termination to the other party, if

• the other party fails to perform, has made or makes any inaccuracy in, or otherwise materially breaches, any of its obligations, covenants, or representations, and

• the failure, inaccuracy, or breach continues for a period of 10 Business Days' after the injured party delivers notice to the breaching party reasonably detailing the breach.

Termination for Failure to Pay: SPOTTERON GmbH may terminate this Agreement with immediate effect by delivering notice of the termination to the Partner if the Partner fails to pay the yearly service fee on time 8 weeks after the invoice was sent.

Termination on objection to processors: SPOTTERON Gmbh may terminate this agreement if the Partner objects a change or addition to/of processors for technical or software-related reasons under 9.4)

19) Effect of Termination

Pay Outstanding Amounts: the Partner shall within 7 business days pay to SPOTTERON GmbH all amounts outstanding as of the date of, and any amounts outstanding as a result of, termination.

Discontinuance of Use: the Partner shall cease all use of the Service upon the effective date of the termination.

Recovery of Data: the Partner will have 14 days from the date of termination to retrieve any data that the Partner wishes to keep in the SPOTTERON Administration Interface as CSV download.

Cooloff-Period: for the Smartphone Apps and interactive web-app, SPOTTERON GmbH guarantees a continuation of the service for 14 days after termination if requested by the Partner to inform the users of the Partner’s SPOTTERON package.

20) Renewal

Following expiration of the Initial Term, the Partner may renew this Agreement for additional successive terms. The minimum length of such a renewed term is 12 month, unless agreed otherwise by the parties. To ensure the continuity of the project and its public applications, all services and run-times are extended automatically 1 month before end of period; Cancellation-terms: anytime until 28 days (1 month) before end of current runtime via written notice.

21) Indemnification

Subject to Clause 22, the Partner agrees to defend and indemnify SPOTTERON GmbH against any third-party claims in any way related to the use of the Service, including any costs, expenses, damages, demands, loss, lawsuits, including judgments and attorney fees actually incurred for damages to property, injury or harm to life of third parties resulting or arising from the use of the Service, except where such claims arise from the negligence or wilful misconduct of SPOTTERON GmbH

22) Liability

Mutual Limit on Liability: Neither party will be liable for breach-of-contract damages suffered by the other party that are remote or speculative, or that could not have reasonably been foreseen on entry into this Agreement.

Maximum Liability: Neither party’s liability under this agreement will exceed the fees paid by the Partner under this agreement during the full runtime of the Partner’s Project.

Liability for public use: SPOTTERON GmbH is not liable for any use of the Service, content and software by the participants (users) or partners, or for uploaded User-generated Content or content uploaded by administrators of the Project, or for any infringements or damage or accidents during use of the applications, tools or software by users or by the partner and his associates.

Liability for content, provide by the partner(s): SPOTTERON GmbH is not liable for infringements or damage caused by any violation of intellectual property laws or misuse of licenses in relation to content, provided by the Partner for the use in the Project’s software or website, nor for uploads by the partner and his associates in applications or the content management system (CMS) of the Project‘s website(s).

Liability for content, provided by users in the partner’s app: For all user-generated content (UGC) uploaded in the Project, the sole liability lies with the Partner. The Partner has access to the SPOTTERON Data Administration Interface and agrees to monitor and moderate all data, media objects and user-generated content. This also includes monitoring and moderating the comments by users on data points and other interactive sections in the according panels of the Data Administration Interface.

UGC including a violation against the Terms of Use of the SPOTTERON platform, against intellectual property laws, privacy laws, spacial restrictions or other violation against community standards or rights must be unpublished and/or deleted by the Partner. If such violations are committed multiple times by a single user, the user name must be reported to SPOTTERON’s team along with a summary of the violation with IDs of the items (data points, comments).

Whenever the Partner receives notice or take-down requests by a third party, SPOTTERON Gmbh must be informed within 2 workdays with the full notice or request included and immediate steps have to be taken by the Partner to solve the situation by unpublishing/deletion of the UGC in question.

For own UGC uploads by the Project, the Partner agrees never to violate the Terms of Use of SPOTTERON platform or present laws and to have obtained all necessary rights to do so.

Liability for breaches of third-party Intellectual Property Rights: SPOTTERON will keep the Partner indemnified against liabilities as a result of claims, brought by a third party against the Partner that the supply of the Services, provided directly by SPOTTERON infringes a third party’s Intellectual Property Rights. In the event that such a claim arises, the Partner will:

• promptly notify SPOTTERON of any such claim; and

• not make any admission or compromise with respect to such claim without the prior approval of SPOTTERON,which approval shall not unreasonably be withheld;

SPOTTERON shall, at its expense, give the Partner all reasonable assistance in connection with negotiations and litigation to settle any claim arising under clause 22.

Integrated third party services like maps, API-based content or other forms of data and/or software are not part of this liability.

23) Additional Partner (Sub-Partners)

The Partner may bring in an additional partner for this Project where SPOTTERON and the Partner agree to this in writing. The terms and conditions applicable to the new partner, including in relation to ownership of Intellectual Property under the Agreement, must be agreed between the existing parties to this Agreement and the new partner.

If the Project is promoted and used actively in another country than the one, the original Partner is located, the regular run-time fee applies to every country an additional partner is promoting the Project at as extended Reach. SPOTTERON will invoice such additional run-time costs on a per country/additional partner directly to the new partner. The additional runtime fees are always billed for a one year run-time in advance.

24) General

Entire Agreement: The parties intend that this Agreement, together with all attachments, schedules, exhibits, and other documents that both are referenced in this agreement and refer to this agreement,

• represent the final expression of the parties' intent relating to the subject matter of this agreement,

• contain all the terms the parties agreed to relating to the subject matter, and

• replace all of the parties' previous discussions, understandings, and agreements relating to the subject matter of this agreement.

Amendment: SPOTTERON GmbH may amend the Terms of Use applicable to this Agreement at any time by reasonable notice, including without limitation by posting revised terms on its website at https://www.spotteron.net/terms-of-use.

Assignment: Neither party may assign this agreement or any of their rights or obligations under this agreement without the other party's written consent.

Location of the court: Vienna, Austria
Governing law: Austria

24.1) Notices:

Method of Notice. The parties shall give all notices and communications between the parties in writing by electronic mail to the party's address specified in this agreement, or to the address that a party has notified to be that party's address for the purposes of this section.

Receipt of Notice: A notice given under this agreement will be effective on

• the other party's receipt of it, or

• if mailed, the earlier of the other party's receipt of it and the 5 business day after mailing it.

Governing Law: Disputes shall be governed by the laws of Austria and shall be subject to the jurisdiction of the courts of Austria.

Severability: If any part of this agreement is declared unenforceable or invalid, the remainder will continue to be valid and enforceable.

24.2) Waiver

Affirmative Waivers: Neither party's failure or neglect to enforce any rights under this agreement will be deemed to be a waiver of that party's rights.

Written Waivers: A waiver or extension is only effective if it is in writing and signed by the party granting it.

No General Waivers: A party's failure or neglect to enforce any of its rights under this agreement will not be deemed to be a waiver of that or any other of its rights.

No Course of Dealing: No single or partial exercise of any right or remedy will preclude any other or further exercise of any right or remedy.

Force Majeure: Neither party will be liable for performance delays nor for non-performance due to causes beyond its reasonable control, except for payment obligations.

24.3) Relationship of the Parties

No Relationship: Nothing in this Agreement creates any special relationship between the parties, such as a business partnership, joint venture, or employee/employer relationship between the parties.

No Authority: Neither party will have the authority to, and will not, act as agent for or on behalf of the other party or represent or bind the other party in any manner.

Co-Operation: The parties will reasonably cooperate with any of the investigation of Service outages, security problems, and any suspected breach of the Agreement. Where agreement, approval, acceptance, consent or similar action by either party hereto is required by any provision of this Agreement, such action shall not be unreasonably delayed or withheld.

Counterparts: This Agreement may be executed in counterparts, each of which shall be deemed to be an original, but all of which, taken together, shall constitute one and the same agreement.

25) Term

This agreement begins with the launch date of the tools provided (smartphone app; website; other tool) and will continue if not terminated until the included run-time is expired, unless renewed as set out in clause 20.

Definitions

“Agreement” means this Agreement and any Appendix.

"Authorized Users" means the list of Persons authorized to use the Services under this agreement as sent by email by the Partner.

“Administrator” means user accounts, that are used by the partner to maintain, add, change, delete or export any form of data or content on the Service

"Business Day" means a day other than a Saturday, a Sunday, or any other day on which the principal banks located in Vienna, Austria are not open for business.

"Confidential Information" has the same meaning in this agreement as the term has under a Non-Disclosure Agreement between the parties

"Data” means the Data on the SPOTTERON platform, including the User generated content in the application or software of the Project.

“Data Results" means all of the data the Partner creates with or uses with the Service, or otherwise related to the Partner's use of the Services.

"Disclosure Schedule" means the schedules delivered, before the execution of this Agreement, by each party to the other party which list, among other things, items the disclosure of which is necessary or appropriate either in response to an express disclosure requirement contained in a provision of this Agreement or as an exception to one or more of the representations or warranties made by the party, or to one or more of the covenants of the party.

"Effective Date" starts with the first public launch of any of the Project’s software tools (apps, website, other tools).

“Fair use” means an amount of usage by the Project, that does not overload or interfere with the infrastructure, or which generates additional costs for SPOTTERON for the use of external services like e.g. map servers and data hosting.

"Governmental Authority" means

1. any federal, state, local, or foreign government, and any political subdivision of any of them,

2. any agency or instrumentality of any such government or political subdivision,

3. any self-regulated organization or other non-governmental regulatory authority or quasi-governmental authority (to the extent that its rules, regulations or orders have the force of law), and

4. any arbitrator, court or tribunal of competent jurisdiction.

"Intellectual Property" means any and all of the following in any jurisdiction throughout the world

1. trademarks and service marks, including all applications and registrations, and the goodwill connected with the use of and symbolized by the foregoing,

2. copyrights, including all applications and registrations related to the foregoing,

3. trade secrets and confidential know-how,

4. patents and patent applications,

5. websites and internet domain name registrations, and

6. other intellectual property and related proprietary rights, interests and protections (including all rights to sue and recover and retain damages, costs and attorneys' fees for past, present, and future infringement, and any other rights relating to any of the foregoing).

"Law" means

1. any law (including the common law), statute, by law, rule, regulation, order, ordinance, treaty, decree, judgment, and

2. any official directive, protocol, code, guideline, notice, approval, order, policy, or other requirement of any Governmental Authority having the force of law.

"Legal Proceeding" means any claim, investigation, hearing, legal action, or other legal, administrative, arbitral, or similar proceeding, whether civil or criminal (including any appeal or review of any of the foregoing).

"License Grant" is defined in section [GRANT OF ACCESS AND USE OF SERVICE].

"Order" means any decision, order, judgment, award, or similar order of any court of competent jurisdiction, arbitration panel, or Governmental Authority with jurisdiction over the subject matter, whether preliminary or final.

“Participant” means a user, active in the Partners application with at least one content contribution.

“Partner content“ or „Content provided by partner“ means all text, image or other content protected by intellectual property laws or licensed under an open license like Creative Commons variants, which the partner provided to be used in the applications or website of the Project.

"Permits" means all material licenses, franchises, permits, certificates, approvals, and authorizations, from Governmental Authorities necessary for the ownership and operation of the party's business.

"Person" includes

(a) any corporation, company, limited liability company, partnership, Governmental Authority, joint venture, fund, trust, association, syndicate, organization, or other entity or group of persons, whether incorporated or not, and (b) any individual.

“Platform” means the combined software, infrastructure, designs and data of SPOTTERON, provided in form of a customized services for the Partner

“Project” means the topic, Reach, use-case and current scope of the Partner’s application and / or software.

“Reach” means the geographical, state or country-based area of active operation and / or promotion of the Project.

"Service" is defined in section GRANT OF ACCESS AND USE OF SERVICE.

"System Availability" is defined in section SERVICE LEVELS.

"Taxes" includes all taxes, assessments, charges, duties, fees, levies, and other charges of a Governmental Authority, including income, franchise, capital stock, real property, personal property, tangible, withholding, employment, payroll, social security, social contribution, unemployment compensation, disability, transfer, sales, use, excise, gross receipts, value-added and all other taxes of any kind for which a party may have any liability imposed by any Governmental Authority, whether disputed or not, any related charges, interest or penalties imposed by any Governmental Authority, and any liability for any other person as a transferee or successor by Law, contract or otherwise.

"Term" is defined in section TERM.

“User generated content” means any form of contribution by a registered or unregistered user account in the applications or software of the Project, provided by SPOTTERON GmbH.

"Viruses" is defined in section PARTNER OBLIGATIONS.

Appendix 1 to the Partner Agreement
between SPOTTERON and the Partner:

Project-related Processing, Personal Data and Data Subjects

Subject-matter of project-related processing:

• User generated data provided and/or uploaded by users of the Citizen Science app which runs on the SPOTTERON Citizen Science platform.

• In case of informed consent given by the user: providing Username/Displayname, Account Type and eMail Address to the Project Partner (e.g. for Project Partner‘s Newsletter Subscription)

• In case of project-specific personal-data related questions in the „Add Spot“ Dialoque or other forms in the Project‘s Software and Applications by the Partner‘s definition: Personal Data as provided by the user in those forms which falls under the definition of 9.2(b)

• In case of utilizing provided features of the SPOTTERON platform in a way, Personal Data is processed by the Project‘s Partner: the provided information by the user as given
  (e.g. using comments to ask a user‘s personal information, RSVP to events, etc)

Duration of the project-related processing:

If applicable, SPOTTERON may process Personal Data shared by registered users of the Citizen Science app in user generated content, forms and platform features for the duration of this Agreement.

Nature and purpose of the project-related processing

The purpose of this Project is to engage the public into the research and to allow participation for data collection and community activities. The available input fields for data collection are defined by the Partner in the role of Data Controller for the project-specific parts and may include the user’s Personal Data which falls under the definition of 9.2(b) in user generated content if provided by a user on an optional basis.

Type of project-related Personal Data:

This will depend on the data collected by the Citizen Science Project, and whether the data definition for user generated content contains elements of Personal Data which falls under the definition of 9.2(b), as decided by the Partner in the Project’s definition phase. In case of informed consent given by the user: providing Username/Displayname, Account Type and eMail Address to the Project Partner (e.g. for Project Partner‘s Newsletter Subscription)

Categories of project-related Data Subjects:

Users of the Citizen Science app in relation to user generated content and provided data in forms or input elements of the App; Partner’s employees

Appendix 2:
Technical and organizational measures (TOM) for protection of project-specific personal data incl. sub-contractors

Deletion concepts for project-specific personal data:

* On request, we delete the entire project-specific data-set in the live system within 14 days.

* Deletions are logged in the system with date/time (flag).

* Individual or bulk deletions of data points in the live system can be carried out by the partner in the Data Administration Interface.

Note: Data in backups are excluded from the immediate deletion procedure according to Art. 5 DSGVO and 32 para. 1 lit. c DSGVO.

Measures of implementation of access control:

* Strong password protection with multi-factor authentication incl. app authorisation at access on system relevant infrastructure.
* Deployments are located exclusively in the cloud environments with security measures according to industry standards of the cloud hosters and it is ensured that only the necessary services are exposed to the outside.
* All clients with access to relevant systems are protected by harddrive encrpytion and firewalls.
* Physical access controls happen on the basis and measures of the cloud hosting providers' data centres.
* Logins to the ICT infrastructure are logged by the system.

Password policies for project admins:

Project-specific access takes place exclusively via provided user accounts for the admin area and are equipped with corresponding passwords. Admin accounts can also change the password independently or upon request after an identity check. Changes to the project-specific data set by admins or users are logged with an extension for this purpose.

Measures of implementation of transfer control of data:

The transfer of project-specific data (CSV export) is encrypted via SSL/TLS and is only available to the project partner after login as admin user.

It is prohibited to send personal data within the company. Any employee who is authorised to view this data must do so with the appropriate security mechanisms and authentication at the platform's cloud provider.

Implementation of the input control:

Project-specific personal data can only be entered by registered users. There is a role concept with a distinction between privileged users per project (in-app moderator users with rights to change project-specific data) and project admins (access to the data management interface). For this purpose, there is a clear and strict separation from the system admins, who have access to relevant areas of the infrastructure. Changes to the data set by admins or users are logged with an extension for this purpose. On the infrastructure side, there is an audit log with the cloud provider.

Measures to implement availability control:

Technical measures are taken on the basis of the data centers of the cloud providers.
On the system side, there are internal real-time warning systems that warn of failures or irregularities.

Measures to implement the separation requirement:

The project-specific data can only be viewed in the administration interface by the project admins after logging in and are strictly separated from access by other projects.

Audit of processors with regard to compliance with the data protection principles:

We have standard contractual clauses (SCC) in place with all external project-specific processors.
More information and EU legislation on SCC: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en

Storage/Processor of project-specific data:

Project-specific data and submissions are stored only in EU countries.
Current processor: Microsoft Azure (Cloud Hosting, Data Hosting) - EU-based servers
Headquarters: Microsoft Corporation, One Microsoft Way, 98052-6399 Redmond, United States

Procedures for restoring the availability of project-specific personal data after a physical or technical incident:

* Backups: complete database backups are made daily to provide the ability to quickly restore availability and access to personal data.

* Incident Response Management: Incidents are logged and documented in an internal ticket system. Actions are taken in an appropriate timeframe depending on the severity of the incident.

Substitution arrangements for the IT officers:

There are several people with the competence to manage and maintain IT. If the IT manager is absent, the deputy IT manager can take over his or her duties.

Those responsible for IT security are adequately trained and integrated into all company structures that deal with personal data.

Resilience of the systems:

The cloud provider guarantees the resilience of the systems and services through the infrastructure. Stress tests of the project are carried out exclusively within the framework of the development process on own environments in order not to jeopardise the smooth running at the production level.

Other

All employees who deal with personal data have been committed to data secrecy and have been trained in the handling of data.

The technical and organisational measures correspond to the current state of technical progress and are appropriate according to the defined protection goals and risk profile.

Timestamp: 6.1.2024
<end of document>