Data Processing Agreement

Refer-O-Matic enables podcasters (“Creators”) to create referral programs and engage directly with listeners (“Ambassadors”) to offer referral program benefits.

As part of this service, Refer-O-Matic shares personal data of Ambassadors(“Ambassador Data”) with Creators, who then process Ambassador Data to provide products and services as part of the Creators’ referral programs (“Referral Program Services”). Refer-O-Matic requires all Creators to agree to this Data Processing Agreement and to respect the privacy rights of Ambassadors when processing Ambassador Data. Podcasters automatically agree to this Data Processing Agreement upon submitting payment information to start a Refer-O-Matic program.

This Data Processing Agreement takes effect when a Creator establishes a Refer-O-Matic account and applies exclusively to Ambassador Data collected by Refer-O-Matic and shared with Creators for the purpose of Creators providing Referral Program Services to Ambassadors. It is an extension of Refer-O-Matic’s Terms of Service and Privacy Policy and applies during and after Creators’ relationship with Refer-O-Matic.

I. Definitions.

• "Data Protection Law" means all applicable laws relating to privacy and the processing of personal data that may exist in any relevant jurisdiction, including, where applicable, the guidance and codes of practice issued by the supervisory authorities. Data Protection Law includes, but is not limited to, the General Data Protection Regulation (Regulation (EU) 2016/279) (“GDPR”) and the California Consumer Privacy Act (Civil Code § 1798.100 et seq. ) (“CCPA”), and/or any related regulations or laws which amends or replaces any of them.
• "Good Industry Practice" means exercising the same skill, expertise and judgement and using facilities and resources of a similar quality as would be expected from a person who: (a) is skilled and experienced in providing the services in question, seeking in good faith to comply with his contractual obligations and seeking to avoid liability arising under any duty of care that might reasonably apply; (b) takes all proper and reasonable care and is diligent in performing his obligations; and (c) complies with the Data Protection Law.
• The terms "data controller", "data processor", “subprocessor”, "data subject", "personal data", "processing", and "appropriate technical and organizational measures" shall be interpreted in accordance with the GDPR, or other applicable Data Protection Law, in the relevant jurisdiction.

II. Scope.

The parties agree that Refer-O-Matic and the Creator are each an independent data controller in relation to Ambassador Data that a Creator processes in the course of providing Referral Program Services. The subject matter of the data processing, the types of personal data processed, and the categories of data subjects will be defined by, and/or limited to, those necessary to carry out and/or provide the Creator’s Referral Program Services. The Creator must notify Ambassadors, and if required by Data Protection Law obtain Ambassadors’ consent, prior to the Creator processing Ambassador Data for any purpose other than as expressly set forth in this Data Processing Agreement. The processing to which this Data Processing Agreement applies will be carried out by the Creator upon leaving the Refer-O-Matic platform. The subject matter, duration, nature, and purpose of the processing of the personal data as well as the type of personal data and categories of data subjects covered by this Data Processing Agreement are as follows:

• The subject matter of the data processing is Ambassador Data.
• The duration of the processing is for as long as the Creator holds Ambassador Data.
• The nature and purpose of the processing is limited to (a) Creator’s fulfillment of Referral Program Services to the Ambassador, (b) maintenance of Creator’s relationship with the Ambassador, or (c) upon Ambassador’s request or express consent to Creator.
• The type of personal data covered by this Data Processing Agreement is contact information, including but not limited to email address and name.
• The category of the data subjects are Members including but not limited to website users who sign up for referral programs on Refer-O-Matic.

III. Data Protection.

The Creator shall adhere to the following requirements:

• Scope of Processing. Creators will process Ambassador Data only in accordance with the Refer-O-Matic Terms of Service, Privacy Policy and this Data Processing Agreement and only in compliance with Data Protection Law. The nature and purpose of the processing shall be limited to that necessary to carry out Referral Program Services, maintain Creator’s relationship with Ambassadors, or fulfill Ambassadors’ requests or consent, and not for the Creator's own purposes, or for any other purpose except as required by law. If the Creator is required by law to process the personal data for any other purpose, the Creator will inform the Ambassador of such requirement prior to the processing unless prohibited by law from doing so.
• Appropriate Technical and Organizational Measures. The Creator will implement and maintain appropriate technical and organizational measures designed to protect the personal data against unauthorized or unlawful processing and against accidental loss, destruction, damage, theft, alteration or disclosure. The measures shall be appropriate to the harm which might result from any unauthorized or unlawful processing, accidental loss, destruction, damage or theft of the personal data and having regard to the nature of the personal data which is to be protected and as a minimum shall be in accordance with the Data Protection Law and Good Industry Practice.
• Transfer to Third Parties. The Creator will not give access to or transfer any Ambassador Data to any third party (including any affiliates, group companies or subcontractors) without the prior consent of the Ambassador.  The Creator may disclose or give access to Ambassador Data to a subprocessor or service provider (collectively “Vendor”) only if the Creator (a) ensures the reliability and competence of such Vendor, its employees or agents who may have access to the personal data, and (b)enters a written contract with such Vendor that includes provisions protecting the Ambassador Data which are equivalent to those in this Data Protection Agreement and the Terms of Service and as are required by applicable Data Protection Law.
• Reliability and Competence of Creator Personnel. Creator will take reasonable steps to ensure the reliability and competence of any Creator personnel who have access to Ambassador Data. The Creator will ensure that all Creator personnel required to access the Ambassador Data are informed of the confidential nature of the personal data and comply with the obligations set out in this Data Protection Agreement.
• Acknowledgement of Data Protection Law and Assistance. Creator will take all reasonable steps to assist Refer-O-Matic in complying with applicable Data Protection Law. For example, the Creator will promptly inform Refer-O-Matic in writing if it receives: (a) a request from a data subject concerning any personal data; or (b) a complaint, communication, or request relating to Creator’s obligations under Data Protection Law.
• Destruction or Return of Property Upon Referral Program Services Completion. The Creator will not retain any of the personal data for longer than is necessary to provide Referral Program Services, maintain Creator’s relationship with the Ambassador, or fulfill an Ambassador’s request and consent. At the end of Referral Program Services, or upon the Ambassador’s request, Creator will securely destroy or return (at Refer-O-Matic’s election) the personal data to the Ambassador.
• Loss or Security Breach. If the Creator becomes aware of any accidental, unauthorized or unlawful destruction, loss, alteration, or disclosure of, or access to Ambassador Data processed by the Creator, it will do the following: (a) Provide notice to Refer-O-Matic. Creator shall promptly and without undue delay notify Refer-O-Matic and provide Refer-O-Matic with: a detailed description of the Loss or Security Breach; the type of data that was the subject of the Loss or Security Breach; the identity of each affected person if known, and the steps the Creator has taken or will take in order to mitigate and remediate such Security Breach, in each case as promptly as such information can be collected or otherwise becomes available (as well as periodic updates to this information and any other information Refer-O-Matic may reasonably request relating to the Loss or Security Breach); and (b) Compliance with Data Protection Law. The Creator shall comply at all times with and assist Refer-O-Matic in complying with its applicable obligations under Data Protection Law. The Creator shall provide reasonable information requested by Refer-O-Matic to demonstrate compliance with the obligations set out in this Data Protection Agreement. The Creator will notify Refer-O-Matic immediately if, in the Creator's opinion, an instruction for the processing of personal data given by Refer-O-Matic violates any country’s data privacy Law. Refer-O-Matic is a platform where podcast listeners subscribe to referral programs and get access to rewards from podcasters for participating. We care about your privacy and want to help you understand how we collect, use and share your personal information. This privacy policy applies to podcast subscribers and podcasters, and is part of our terms of use.
• Investigate the Matter promptly. The Creator shall promptly take action, at their own expense, to investigate the Loss or Security Breach and to identify, prevent and mitigate the effects of the Loss or Security Breach and to carry out appropriate recovery actions to remedy the Loss or Security Breach.
  

Last updated on May 18th, 2021.