LGPD Controller Addendum to the Google Controller-Controller Data Protection Terms

Google and the Customer have entered into the Google Controller-Controller Data Protection Terms (“Controller Terms”), which supplement the Agreement. This LGPD Controller Addendum to the Google Controller-Controller Data Protection Terms (the “LGPD Controller Addendum”) is entered into by Google and the Customer and also supplements the Agreement. This LGPD Controller Addendum will be effective on the date the LGPD becomes effective.

1.Introduction

This LGPD Controller Addendum reflects the parties’ agreement on the terms governing the processing of certain data in connection with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais) (“LGPD”). This LGPD Controller Addendum is effective solely to the extent the LGPD applies.

2.Definitions and Interpretation

2.1 In this LGPD Controller Addendum:

“Brazilian Controller Personal Data” means any personal data that is processed by a party under the Agreement in connection with its provision or use (as applicable) of the Controller Services.

“Controller Data Subject” means a data subject to whom Brazilian Controller Personal Data relates.

“Google Entity” means Google LLC, Google Brasil Internet Ltda, or any other Affiliate of Google LLC.

2.2 The terms “controller”, “data subject”, “personal data”, “processing”, “processing agent”, and “processor” as used in this LGPD Controller Addendum have the meanings given in the LGPD.

2.3 Capitalised terms used but not defined in this LGPD Controller Addendum will have the meanings given in the Controller Terms.

2.4 If this LGPD Controller Addendum conflicts or is inconsistent with the remainder of the Agreement (including the Controller Terms), this LGPD Controller Addendum will govern.

3.Roles and Restrictions on Processing

3.1 Independent Controllers. Each party:

(a) is an independent controller of Brazilian Controller Personal Data under the LGPD;

(b) is individually responsible for its decisions regarding the processing of Brazilian Controller Personal Data, including determining the purposes and means of such processing; and

(c) will comply with the obligations applicable to it under the LGPD with respect to the processing of Brazilian Controller Personal Data.

3.2 Restrictions on Processing. Section 3.1 (Independent Controllers) will not affect any restrictions on either party’s rights to use or otherwise process Brazilian Controller Personal Data under the Agreement.

4.Transparency

4.1 Customer Properties. Where Customer uses the Controller Services on any site, app, or other property under its control, or the control of a Customer Affiliate or client, Customer will ensure that the site, app, or other property provides data subjects with clear, precise and easily accessible information about:

(a) the processing of Brazilian Controller Personal Data; and

(b) the processing agents (including Google, and the identity of any other controller(s)) that may collect, receive, or use Brazilian Controller Personal Data.

4.2 Third-Party Properties. If Brazilian Controller Personal Data of data subjects using a third-party property is shared with Google due to Customer’s use of, or integration with, the Controller Services, then Customer will use commercially reasonable efforts to ensure the operator of the third-party property complies with Customer’s obligations in Section 4.1. In this Section 4.2, a “third-party property” means a site, app, or other property that is not under Customer’s, a Customer Affiliate's, or a Customer client's control, and whose operator is not already using a Controller Service that incorporates this LGPD Controller Addendum.

4.3 Google’s Use of Data. Google has published information about how Google uses information from sites, apps, or other properties that use its services at https://policies.google.com/technologies/partner-sites. To comply with Customer’s transparency obligations under Sections 4.1 and 4.2 with respect to Google's uses of Brazilian Controller Personal Data, Customer may link to that page.

5.Changes to this LGPD Controller Addendum

In addition to Section 10 of the Controller Terms (Changes to these Controller Terms), Google may change this LGPD Controller Addendum without notice if the change is required to comply with applicable law, applicable regulation, a court order, or guidance issued by a governmental regulator or agency.

27 August 2020