Privacy Policy

LGPD Processor Addendum to the Google Data Processing Addendum

Google and the Customer have entered into the Google Data Processing Addendum (“DPA”), which supplement the Agreement. This LGPD Processor Addendum to the DPA (the “LGPD Processor Addendum”) is entered into by Google and the Customer and also supplements the Agreement. This LGPD Processor Addendum will be effective on the date the LGPD becomes effective.

1. Introduction

This LGPD Processor Addendum reflects the parties’ agreement on the terms governing the processing of certain data in connection with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais) (“LGPD”). This LGPD Processor Addendum is effective solely to the extent the LGPD applies.

2. Definitions and Interpretation

2.1 In this LGPD Processor Addendum:

“Brazilian Customer Personal Data” means personal data that is processed by Google on behalf of Customer in Google’s provision of the Processor Services.

“Google Entity” means Google LLC, Google Brasil Internet Ltda, or any other Affiliate of Google LLC.

2.2 The terms “controller”, “data subject”, “personal data”, “processing”, and “processor” as used in this LGPD Processor Addendum have the meanings given in the LGPD.

2.3 Capitalised terms used but not defined in this LGPD Processor Addendum will have the meanings given in the DPA.

2.4 If this LGPD Processor Addendum conflicts or is inconsistent with the remainder of the Agreement (including the DPA), this LGPD Processor Addendum will govern.

3. Data Processing

3.1 Roles and Regulatory Compliance; Authorisation.

3.1.1 Processor and Controller Responsibilities. The parties acknowledge and agree that:

(a) Google is a processor of Brazilian Customer Personal Data under the LGPD;

(b) Customer is a controller or processor, as applicable, of Brazilian Customer Personal Data under the LGPD; and

(c) each party will comply with the obligations applicable to it under the LGPD with respect to the processing of Brazilian Customer Personal Data.

3.1.2 Authorisation by Third-Party Controller. If Customer is a processor, Customer warrants to Google that Customer’s instructions and actions with respect to Brazilian Customer Personal Data, including its appointment of Google as another processor, have been authorised by the relevant controller.

3.2 Customer’s Instructions. By entering into this LGPD Processor Addendum, Customer instructs Google to process Brazilian Customer Personal Data only in accordance with applicable law:

(a) to provide the Processor Services and any related technical support;

(b) as further specified via Customer’s use of the Processor Services (including in the settings and other functionality of the Processor Services) and any related technical support;

(c) as documented in the form of the Agreement, including this LGPD Processor Addendum; and

(d) as further documented in any other written instructions given by Customer and acknowledged by Google as constituting instructions for purposes of this LGPD Processor Addendum.

3.3 Google’s Compliance with Instructions. Google will comply with the instructions described in Section 3.2 (Customer’s Instructions) unless applicable laws to which Google is subject require other processing of Brazilian Customer Personal Data by Google.

3.4 Additional Products. If Customer uses any Additional Product, the Processor Services may allow that Additional Product to access Brazilian Customer Personal Data as required for the interoperation of the Additional Product with the Processor Services. This LGPD Processor Addendum does not apply to the processing of personal data in connection with the provision of any Additional Product used by Customer, including personal data transmitted to or from that Additional Product.

4. Data Deletion

4.1 Deletion During Term.

4.1.1 Processor Services With Deletion Functionality. During the Term, if:

(a) the functionality of the Processor Services includes the option for Customer to delete Brazilian Customer Personal Data;

(b) Customer uses the Processor Services to delete certain Brazilian Customer Personal Data; and

(c) the deleted Brazilian Customer Personal Data cannot be recovered by Customer (for example, from the “trash”),

then Google will delete such Brazilian Customer Personal Data from its systems as soon as reasonably practicable and within a maximum period of 180 days, unless applicable laws require storage.

4.1.2 Processor Services Without Deletion Functionality. During the Term, if the functionality of the Processor Services does not include the option for Customer to delete Brazilian Customer Personal Data, then Google will comply with any reasonable request from Customer to facilitate such deletion, insofar as this is possible taking into account the nature and functionality of the Processor Services and unless applicable laws require storage.

Google may charge a fee (based on Google’s reasonable costs) for any data deletion under Section 4.1.2(a). Google will provide Customer with further details of any applicable fee, and the basis of its calculation, in advance of any such data deletion.

4.2 Deletion on Term Expiry. On expiry of the Term, Customer instructs Google to delete all Brazilian Customer Personal Data (including existing copies) from Google’s systems in accordance with applicable law. Google will comply with this instruction as soon as reasonably practicable and within a maximum period of 180 days, unless applicable laws require storage.

5. Verifying Compliance

Google will assist Customer in verifying Google’s compliance with (i) Customer’s instructions; (ii) its obligations under this LGPD Processor Addendum; and (ii) the obligations applicable to it under the LGPD with respect to the processing of Brazilian Customer Personal Data, by:

(a) making the Security Documentation available for review by Customer;

(b) providing the information contained in the DPA; and

(c) providing or otherwise making available, in accordance with Google’s standard practices, other materials concerning the nature of the Processor Services and the processing of Brazilian Customer Personal Data (for example, help centre materials).

6. Data Subject Rights

Responses to Data Subject Requests. If Google receives a request from a data subject in relation to Brazilian Customer Personal Data, Google will:

(a) if the request is made via a Data Subject Tool, respond directly to the data subject’s request in accordance with the standard functionality of that Data Subject Tool; or

(b) if the request is not made via a Data Subject Tool, advise the data subject to submit the request to Customer, and Customer will be responsible for responding to such request.

7. Changes to this LGPD Processor Addendum.

In addition to Section 16 of the DPA (Changes to this Data Processing Addendum), Google may change this LGPD Processor Addendum without notice if the change is required to comply with applicable law, applicable regulation, a court order, or guidance issued by a governmental regulator or agency.

27 August 2020