Legal information

This Data Processing Agreement forms an integral part of the Agreement agreed between Tugi Tark and the Client in relation to the processing of the Client’s personal data by Tugi Tark upon the provision of the Services as per the applicable Purchase Order.

The terms and definitions used in this Data Processing Agreement shall have the meaning set out in the Agreement and the GDPR. In circumstances not covered by this Data Processing Agreement, the Agreement shall apply. In the event of any contradictions or inconsistencies between the Data Processing Agreement and the Agreement, this Data Processing Agreement shall prevail.

Tugi Tark agrees to provide the Services ordered by the Client under an applicable Purchase Order. The specific instructions for accessing and using the Services via Tugi, including for designating any users to use the Services on the Client’s behalf, shall be provided separately by Tugi Tark upon conclusion of the Agreement. The Services shall be accessible and available for use from the Activation Date specified under the applicable Purchase Order subject to compliance with the Agreement.

Tugi Tark hereby reserves the right to temporarily suspend or terminate the Client’s right to access and use the Services via Tugi, if the Client violates any term of the Agreement, and provided that the Client has not remedied such violation within additional term of 5 business days following the receipt of the prior notice (regarding the violation) communicated by Tugi Tark. No additional term is required if the violation is considered as material, or applicable law otherwise permits or obliges Tugi Tark to immediately suspend or terminate such access and usage right. This includes Tugi Tark’s right as an information society service provider to unilaterally delete any Client Data from Tugi if Tugi Tark is aware that such Client Data is in violation with applicable law or the Agreement.

The Client shall:

• Ensure that its performance of the Agreement, as well as use of the Services complies with all applicable laws and regulations, including Know Your Customer (KYC) obligations and anti-money laundering requirements pertaining to the provision of regulated services (such as gambling and gaming).
• Ensure that it shall obtain and maintain any and all regulatory licenses or permits required for the Client’s commercial activities during the use of the Services.
• Ascertain valid legal bases and other authorizations required for the processing of the Client Data, including end-users’ personal data, through the Services.
• Not use the Services for any unlawful, prohibited or fraudulent activities. The Client is thereby prohibited from, among others:
  -> Transmitting any material or content that contains viruses or other malicious code, or content that infringes or may infringe the intellectual property or other third party rights;
  -> Using the Services in any manner that is inappropriate or in any manner that could harm Tugi Tark or its other customers, including through excessive use of the Services;
  -> Using the Services to conduct the business of multiple legal entities.

The Client hereby warrants that any end-user designated to access and use the Services on behalf of the Client shall comply with and be subject to the obligations imposed on the Client under the Agreement (in particular, under Sections 4 and 7 of these Terms). The Client shall remain fully responsible for any actions or omissions of such end-users in connection with their use of the Services.

In the event that Tugi Tark processes the Client’s personal data (within the Client Data) on behalf of and in accordance with the instructions of the Client by providing the Services, the Client (or any end-user of the Client) shall be the data controller and Tugi Tark shall be the data processor. In such a case, the processing of the Client’s personal data shall be subject to Annex 1 to these Terms (“Data Processing Agreement”). The Data Processing Agreement shall not apply to the extent that Tugi Tark processes the Client’s personal data as a data controller in accordance with Tugi Tark’s Privacy Notice, which the Client undertakes to make available to any end-user of the Client.

Both parties agree to maintain the confidentiality of all information obtained in the course of performing and prior to the conclusion of this Agreement, and not to disclose it to any third party without the prior written consent of the other party, except as required by applicable law. This confidentiality obligation shall remain in force during the validity of this Agreement, for 5 years after its termination, and thereafter indefinitely.

Other than the Client Data, all intellectual property rights in the Services and any related documentation provided under the Agreement shall remain the exclusive property of Tugi Tark or its licensors. Unless expressly provided otherwise, this Agreement does not grant the Client any right to use the intellectual property rights in the Services without Tugi Tark’s prior express permission.

The Client is hereby expressly prohibited from, among others:

• Modifying, processing, decompiling, reverse engineering, disassembling, copying, duplicating, creating derivative works of, selling, renting or otherwise distributing any software (including in relation to the source code) included in the Services or any materials in any medium which relate to the Services.
• Accessing the contents and structure of the source code of the Services, or circumventing or bypassing any technological protection measures in or relating to the Services.
• Providing access to the Services to third parties, including by unauthorized third party applications, or sublicensing or otherwise commercializing (e.g., by way of reselling) the Services.
• Interfering in any manner with the operation or hosting of the Services.
• Using or accessing or attempting to use or access any Services, except as expressly provided under the Agreement.

In addition to the use of the Client Data by Tugi Tark regulated under Section 8 of these Terms, the Client further grants Tugi Tark a worldwide, irrevocable, non-exclusive, sublicensable, and royalty-free right to use, store, copy, display the Client’s name, any logos, brands, trademarks and other similar intellectual property objects uploaded to Tugi or otherwise provided to Tugi Tark by the Client, for relevant use on Tugi and other platforms (including social media platforms, websites, other marketing materials and mediums).  This includes, but is not limited to, general marketing and promotional activities in accordance with industry-accepted standards.

The Client retains ownership of all the Client Data entered and provided to Tugi Tark in course of using the Services. Where technically feasible, Tugi Tark shall provide mechanisms for data import and export (of the Client Data) during and upon termination of this Agreement, with standard formats available at no cost.

The Client hereby grants Tugi Tark a worldwide, irrevocable, non-exclusive, sublicensable, and royalty-free right to use, store, copy (including reproduce), modify (including create derivative works), translate, display, and distribute the Client Data as may be necessary for the provision of the Services.

The Client acknowledges that a fundamental component of the Services is the training and use of machine learning or other processes, and generating performance metrics for providing and improving the Services. The Client further agrees that Tugi Tark may use the Client Data for the purpose of training, refining and improving AI models that are used by Tugi Tark to provide the services. All such usage of the Client Data shall be subject to strict confidentiality measures and, where applicable or technically feasible, anonymization or aggregation to prevent identification of the Client or its end-users. Tugi Tark shall ensure compliance with all relevant applicable laws and shall neither sell or disclose the Client Data to unauthorized third parties without the Client’s prior written consent. Tugi Tark may also collect other information related to the Client (in addition to the Client Data) for similar purposes, which may include aggregated, anonymized or analytical information and statistics on the Client’s (including the Client’s end-users’) use of the Services (“Usage Metrics”). Tugi Tark retains ownership of all such Usage Metrics.

To the maximum extent permitted by applicable law, Tugi Tark's liability under this Agreement is limited to the amount paid by the Client for the Services in the preceding 6 months prior to the event giving rise to liability. Tugi Tark shall not be liable for any indirect, incidental, or consequential damages (including for loss of profits) arising out of or in connection with the performance of this Agreement or the Services.

The Client agrees to indemnify, defend and hold Tugi Tark and its third party service providers harmless from and against any claims, demands, damages, costs or liabilities (including reasonable legal fees) arising out of or related to any misuse of the Services, any breach or alleged breach of the Agreement or any violation of any third party rights (including data privacy or intellectual property rights) by the Client.

The Agreement shall commence on the Effective Date and be valid for the Subscription Term specified in the Purchase Order. Upon expiry of the Subscription Term, the Agreement shall be automatically renewed in an equal length to the Subscription Term, unless either party provides the other with a notice of termination at least 30 calendar days prior to the end of the then-current Subscription Term.

Upon termination of the Agreement, the Client shall cease all use of the Services, and Tugi Tark shall delete or return all Client Data in its possession, as may be requested by the Client'. Tugi Tark shall retain the Client Data for a maximum period of 30 calendar days after termination of this Agreement, after which the Client Data shall be deleted.

In the event of termination of the Agreement by the Client, Tugi Tark shall have no obligation to reimburse the Client for any Subscription Fees that the Client may have already pre-paid, unless Tugi Tark is required to do so by applicable law.

Tugi Tark disclaims any and all warranties, express or implied, with respect to the Services or the performance of the Agreement. The Services are provided “as is”, “as available” and at the Client’s own risk and Tugi Tark does not warrant or represent the quality, fitness for purpose, non-infringement, completeness or accuracy of the Services. Notwithstanding Tugi Tark’s endeavors to provide the highest-quality, safest and securest service to the Client, Tugi Tark does not guarantee that the Services shall be uninterrupted, timely or error-free or that defects will be remedied.

Tugi Tark reserves the right to modify or discontinue, from time to time or at any time, temporarily or permanently, the functions and features of the Services without liability towards the Client for any interruption, modification or discontinuance of the Services (or parts of it). Where possible, reasonable notice of discontinuance of the Services shall be given.

The Client hereby acknowledges and agrees that the Services use and incorporate AI components, which may generate outputs containing errors, inaccuracies or biases. The Client is solely responsible for verifying the accuracy and appropriateness of any output generated by the Services. Tugi Tark disclaims any liability for errors, inaccuracies, or biases in the AI-generated outputs. The Client further undertakes to use the relevant outputs at their own risk and to exercise due diligence in reviewing and validating the results.

This Agreement as well as any accompanying documentation (including the applicable Purchase Order) shall be governed by and construed in accordance with the laws of the Republic of Estonia.

Any disputes arising out of or in connection with this Agreement shall be subject to the exclusive jurisdiction of the courts of Estonia, with the Harju County Court serving as the court of first instance.

• Entire Agreement: The Agreement constitutes the entire agreement between the parties and supersedes all prior agreements and understandings.
• Amendments: Any amendment to the Agreement must be signed by both parties. Without prejudice to the foregoing, Tugi Tark reserves the right to amend any of these Terms at any time, in particular, if modifications are necessary to comply with legal obligations or due to changes in the service or business. Tugi Tark shall notify the Client of any such modifications reasonably in advance. If the Client does not agree to the amendments or to any specific amendment, the Client may not be able to continue using the Services. The provisions of this Section shall not apply to the extent that they govern any modification of the Data Processing Agreement.
• Assignment: Neither party may assign or delegate any rights or obligations under the Agreement without the other party’s prior written consent, provided however that the Agreement or any of the rights or obligations contained herein may be assigned without the Client’s consent by Tugi Tark to any other entity who directly or indirectly, controls, is controlled by or is under common control with Tugi Tark.
• Severability: If any provision of the Agreement is found to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.
• Export Control and Sanctions: Each party shall comply with all export control and economic sanctions laws applicable to its performance under the Agreement.
• Notices: All notices and communications producing a legal effect under the Agreement shall be provided at least in a format reproducible in writing (e.g., via e-mail), unless any other form is expressly required (e.g., written form requiring signing of authorized representative), and delivered at contact details specified in the applicable Purchase Order.
• Contradictions: In the event of contradictions or inconsistencies between these Terms and the applicable Purchase Order, terms of the said Purchase Order shall take precedence.

This Data Processing Agreement forms an integral part of the Agreement agreed between Tugi Tark and the Client in relation to the processing of the Client’s personal data by Tugi Tark upon the provision of the Services as per the applicable Purchase Order.

The terms and definitions used in this Data Processing Agreement shall have the meaning set out in the Agreement and the GDPR. In circumstances not covered by this Data Processing Agreement, the Agreement shall apply. In the event of any contradictions or inconsistencies between the Data Processing Agreement and the Agreement, this Data Processing Agreement shall prevail.

For the purposes of providing the Services, the Client (data controller) authorises Tugi Tark (data processor) to process the Client’s personal data that the Client or the Client’s cooperation partner determines to enter and provide to Tugi Tark in the course of using the Services. This includes, in particular, data subjects’ names and contact details, relevant correspondence and communication between the Client and the Client’s cooperation partner, their end-users and employees, as well as any information conveyed in the course of using the Services (transaction details, personal identifiers, support details, etc.). The Client’s personal data shall pertain to relevant data subjects designated by the Client (in particular, end-users and employees of the Client and the Client’s cooperation partners).

The Agreement accompanying this Data Processing Agreement shall be deemed to be the complete and final documented instructions regarding the processing of the Client’s personal data by Tugi Tark and any further instructions shall require a prior written agreement.

The Client shall ensure that any personal data entered and provided to Tugi Tark in the course of using the Services is processed only in accordance with the applicable laws. In doing so, the Client shall ensure, among others, that there is an appropriate legal basis for the processing of the Client’s personal data.

Tugi Tark undertakes to process the Client’s personal data only in accordance with applicable laws, this Data Processing Agreement and only to the extent and in the manner necessary for the provision of the Services. When processing the Client’s personal data, Tugi Tark undertakes to keep the Client’s personal data confidential, while ensuring that access to the necessary personal data is only granted to persons who have a direct need to know in order to fulfil Tugi Tark’s obligations under the Agreement. Tugi Tark shall ensure that the persons involved in the processing of the Client’s personal data have entered into an appropriate confidentiality agreement or have a legal obligation of confidentiality. Tugi Tark undertakes to provide reasonable assistance to the Client in relation to the requirements of applicable law, taking into account the nature of processing and the information available to the processor.

Tugi Tark shall not transfer the Client’s personal data to countries outside the European Economic Area or not on the European Commission’s list of countries providing adequate protection of personal data (“Restricted Transfer(s)”) without the Client’s prior authorization (given in accordance with Sections 5 or 8 of this Data Processing Agreement) and applying appropriate safeguards. These safeguards may include, for instance, standard data protection clauses adopted by the European Commission to be agreed between the respective parties.

Where the Client’s personal data is transferred from Tugi Tark (as a data processor) to the Client (as a data controller) as a Restricted Transfer, the parties to this Data Processing Agreement shall apply module four of the EU Processor-to-Controller Standard Contractual Clauses (“SCCs”) as adopted by the European Commission in the Annex to the Commission Implementing Decision (EU) 2021/914 of 4 June 2021. The SCCs shall be deemed to be incorporated into this DPA by the reference herein, and applied accordingly. The relevant Annexes of the SCCs shall be deemed be completed as set forth in the Schedule 1 to this Data Processing Agreement. The parties further agree that: (i) Clause 7 (Docking clause) is not incorporated; (ii) Clause 11 (Redress) optional section is not incorporated; (iii) Clauses 17 (Governing Law) and 18 (Choice of Forum and Jurisdiction) follow the governing law and choice of forum and jurisdiction as stipulated under the Terms. To the extent a conflict exists between the terms of the SCCs and any terms of this Data Processing Agreement with respect to Restricted Transfers, the terms of the SCCs shall take precedence over the terms of this Data Processing Agreement.

Tugi Tark shall implement appropriate technical and organizational measures to protect the Client’s personal data against unauthorized or unlawful processing, accidental loss, destruction or damage. Tugi Tark’s security measures comply with the applicable law, taking into account, among others, the nature of the personal data processed and the risks associated with the specific processing. Upon processing the Client’s personal data, Tugi Tark shall apply, among others, the security measures listed here.

Tugi Tark shall inform the Client of any enquiries and requests received from data subjects, competent supervisory authorities or other third parties relating to the processing of the Client’s personal data by Tugi Tark in the course of providing the Services. Where necessary, in particular where the request relates to Tugi Tark’s systems and the Client does not have all the necessary information, Tugi Tark undertakes to reasonably assist the Client in responding to the enquiry or request. Tugi Tark shall not act on behalf of or as an agent for the Client in dealing with any enquiry covered by this Section 7.

The Client authorizes Tugi Tark to use sub-processors for the processing of the Client’s personal data, provided that Tugi Tark only uses sub-processors that provide adequate safeguards in accordance with the applicable laws. Tugi Tark shall ensure that sub-processors have a contractual obligation to comply with requirements for the processing of personal data that are at least equivalent to those contained in this Data Processing Agreement. In any event, Tugi Tark shall be fully liable to the Client for any failure of sub-processors to comply with applicable requirements.

In the event that Tugi Tark intends to involve (or change) sub-processors in the context of the processing of the Client’s personal data, Tugi Tark will provide the Client with the details of the sub-processor to be engaged, thereby giving the Client the opportunity to object to the involvement of the relevant sub-processor. Such objection must be reasonably justified and based on the applicable law. If the Client does not object to the said changes within 7 calendar days, the Client shall be deemed to have accepted the changes to the list of sub-processors. If the parties do not reach an agreement on the objection, and if the new sub-processor is indispensable for Tugi Tark to provide the Services, Tugi Tark may terminate the Agreement with immediate effect. By entering into this Data Processing Agreement, the Client agrees to the engagement of sub-processor(s) listed here.

In the event of a personal data breach, Tugi Tark shall provide reasonable assistance to the Client, considering the nature of the processing and the information available to Tugi Tark, with a view to ensuring compliance with its obligations under applicable law. Tugi Tark shall further notify the Client of such a personal data breach without undue delay, but no later than forty-eight (48) hours after becoming aware of the personal data breach.

Upon the Client’s request, Tugi Tark shall allow the Client (or authorised auditor) to conduct audits to the extent necessary to verify compliance with Tugi Tark‘s obligations under this Data Processing Agreement. In order to exercise the right of audit, the Client shall coordinate the time and scope of the audit with Tugi Tark by giving the latter at least 30 calendar days’ prior notice. The information disclosed to the Client (or to the authorized auditor) in the course of the audit shall be confidential in accordance with the requirements set out in the Agreement. Unless otherwise agreed between the parties, the costs of the audit, including Tugi Tark’s costs, shall be borne by the Client. The Client shall ensure that the audit takes place during Tugi Tark’s normal working hours, with the least possible disruption to Tugi Tark’s business and the activities of Tugi Tark’s other customers.

Tugi Tark’s liability towards the Client is limited as set out in the Agreement, taking into account the applicable laws governing the protection of personal data. In the event that Tugi Tark is subject to a claim for damages by a data subject or to any sanctions by a supervisory authority or court for a breach of this Data Processing Agreement or applicable law caused by the Client, the Client shall indemnify Tugi Tark for such damages in accordance with the Agreement. If the parties are involved in the same personal data processing activities and the parties are therefore jointly and severally liable for the damage caused to data subjects by the processing of personal data, and if one of the parties has paid compensation for the damage, the paying party shall be entitled to reclaim the part of the compensation corresponding to the other party’s liability for the damage from the other party involved in the processing.

This Data Processing Agreement shall enter into force at the Effective Date and shall remain in force during the duration of the processing, i.e. either the validity of the Agreement or for as long as Tugi Tark processes the Client’s personal data on behalf of and in accordance with the Client’s instructions. Termination of the Data Processing Agreement shall be subject to the general termination provisions of the Agreement. Upon expiry or termination of the Data Processing Agreement for any reason, Tugi Tark shall return or destroy the Client’s personal data upon the Client’s request and undertakes to do so within a reasonable time after receipt of such request. Tugi Tark shall not return or destroy any personal data of the Client that Tugi Tark is obliged to process under applicable law.

Tugi Tark reserves the right, at its sole discretion, to modify this Data Processing Agreement at any time, in particular if such modifications are necessary to comply with legal obligations, in connection with changes in the services provided or in the ordinary course of any other business. Tugi Tark shall notify the Client at least 30 calendar days prior to the modification of this Data Processing Agreement. If the Client does not agree to the changes to the Data Processing Agreement, the Client may terminate the Agreement and this Data Processing Agreement by notifying Tugi Tark before the changes take effect. If the Client continues to use the Services after 30 calendar days (from the date of Tugi Tark’s modification notice), the Client shall be deemed to have accepted the relevant modifications to this Data Processing Agreement.

For the avoidance of doubt, this Schedule 1 applies only insofar as Section 5 of the Data Processing Agreement (“DPA”) applies.