Whop® Seller Data Sharing Addendum
This Data Sharing Addendum (“DSA”) is part of and incorporated into the Whop Terms of Service (the “Agreement”) between Whop and Seller, each a “Party” and collectively the “Parties.” In the event of any conflict between a term of this DSA and another term of the Agreement, this DSA will prevail. Any terms not defined in this DSA will having the meaning provided to them in the Agreement (which, for the avoidance of doubt, expressly includes the Seller Terms and the applicable Additional Terms).
Whop and Seller agree as follows:
For purposes of this DSA:
“Buyer Data” means Personal Data about Buyers of Seller’s Products that Whop discloses, provides or otherwise makes available to Seller pursuant to the provision of the Services.
“Controller” means an entity that is a “controller” or a “business” as defined under applicable Privacy Laws.
“Data Privacy Laws” means all applicable laws relating to privacy, data protection, data security, breach notification, or the Processing of Personal Data, including without limitation, to the extent applicable, the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”) and other applicable U.S. state and federal laws (collectively, “U.S. Privacy Laws”), the General Data Protection Regulation, Regulation (EU) 2016/679 (“GDPR”), the United Kingdom Data Protection Act of 2018 (“UK GDPR”), and the Swiss Federal Data Protection Act (“FADP”).
“Data Subject” means a “data subject” or “consumer” as defined by Data Privacy Laws.
“European Data Privacy Laws” means the Data Privacy Laws of the European Union, the European Economic Area, Switzerland and the United Kingdom.
“EU SCCs” means the Standard Contractual Clauses issued pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, completed as set forth in Section 9 below.
“Personal Data” means “personal data,” “personal information,” “personally identifiable information,” and equivalent terms as defined by applicable Data Privacy Laws.
“Privacy Request” means a request from a Data Subject to exercise their privacy rights under applicable Data Privacy Laws, including but not limited to requests for access, deletion, and correction.
“Process” and “Processing” refers to any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“Restricted Transfer” means a transfer of European Personal Data to a jurisdiction that is not subject to an adequacy decision by the European Commission. As used in this definition, “European Personal Data” means Personal Data that is subject to European Data Privacy Laws.
“Sell or Share” and “Selling or Sharing” mean any disclosure or Processing of Personal Data in a manner that constitutes a “sale,” “selling,” a “share,” “sharing,” “targeted advertising,” or equivalent term as defined under applicable Data Privacy Laws.
“Seller Platform” means Seller’s external website(s), mobile application(s), platform(s), webpages, connected services(s), and/or other online service(s) which have integrated Whop Payments. (For the avoidance of doubt, Seller Platform does not include any Whop Marketplace sites or storefronts, or any other websites, webpages, storefronts, applications or online services hosted by Whop or on the Whop platform.)
“Sensitive Data” means any Personal Data that is “sensitive personal information,” “sensitive data,” “special categories of personal information” or equivalent term, as well as any “sensitive data inferences,” as such terms are defined by applicable Data Privacy Laws.
“Services” means the services Whop provides to Seller, as set forth in the Agreement.
“Specified Purposes” means the purposes contemplated under the Agreement, including the following business or operational purposes of Seller:
(i) fulfilling orders, providing customer service and support, and communicating with Data Subjects;
(ii) internal use by Seller for its legitimate business purposes;
(iii) marketing and advertising on behalf of the Seller;
(iv) security, fraud prevention and protection;
(v) to protect and defend Seller’s legal, contractual and property rights, or rights, health or safety of others; and
(vi) complying with legal process or applicable legal and regulatory obligations.
“Whop Payments Data” means Personal Data that Whop collects and Processes about Buyers and users of Seller Platform related to Whop Payments transactions. (For the avoidance of doubt, Whop Payments Data does not include Personal Data about Buyers that Whop Collects and Processes through the Whop Marketplace.)
“UK Addendum” means the International Data Transfer Addendum to the EU SCCs (available at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf).
Pursuant to the Agreement and the provision of the Services, Whop may (i) disclose, provide or otherwise make available certain Buyer Data to Seller subject to the terms of this DSA; and (ii) collect and Processes Whop Payment Data from Buyers and other end users of Seller Platform pursuant to Whop Payments transactions (where applicable). The terms of this DSA apply to the Processing of Buyer Data and Whop Payments Data, in connection with the Agreement.
The Parties acknowledge and agree that they are independent Controllers, and not joint Controllers, for the Personal Data that they Process pursuant to the Agreement and the Services.
The Parties will comply with their respective obligations under applicable Data Privacy Laws and this DSA, in connection with their Processing of Personal Data pursuant to the Agreement and the Services. Without limiting the foregoing, each Party is responsible for ensuring that it has provided all necessary notices, obtained any required consents or authorizations, and has a valid legal basis under applicable Data Privacy Laws for the Party’s Processing of such Personal Data.
Whop will determine, in accordance with applicable Data Privacy Laws, how Personal Data is Processed, in connection with its provision of Buyer Data to Seller pursuant to the Agreement. This includes, without limitation, deciding which data to collect from Data Subjects, how to collect it, how long to store it, which security measures to apply to it, which data to disclose to Seller, and the legal basis for the disclosure of Buyer Data to Seller.
5.1. Whop may Process Buyer Data and Whop Payments Data in order to perform the Services and as set forth in the Whop Privacy Policy (https://whop.com/privacy), which may be updated by Whop from time to time in accordance with applicable Data Privacy Laws.
5.2. Whop will provide Data Subjects with appropriate information and disclosures, in accordance with applicable Data Privacy Laws, related to Whop’s Processing of Buyer Data (including its disclosure of Buyer Data as contemplated under this DSA).
Seller will post a publicly available privacy notice that complies with applicable Data Privacy Laws and includes all necessary and appropriate information and disclosures regarding Seller’s Processing of the Buyer Data, in accordance with such Data Privacy Laws (“Seller Privacy Policy”). Seller will take all steps necessary to ensure that the Seller Privacy Policy is provided or made available to Data Subjects as required by applicable Data Privacy Laws, and will, if applicable, post or prominently link to the Seller Privacy Policy from the Seller Store.
Seller may Process the Buyer Data received from Whop as reasonably necessary and proportionate for the Specified Purposes and at all times in accordance with applicable Data Privacy Laws, the terms of this DSA, and the Seller Privacy Policy. Seller is prohibited from Processing, and agrees that it will not Process, any Buyer Data in order to identify, derive or infer any Sensitive Data.
Seller will not Sell or Share any Buyer Data, unless:
(a) the Selling or Sharing is permitted under applicable Data Privacy Laws;
(b) Seller has disclosed the Selling or Sharing in the Seller Privacy Policy and provided all necessary and required notices and disclosures to Data Subjects regarding the Selling or Sharing, in accordance with applicable Data Privacy Laws;
(c) the Seller has obtained any required consent or authorization from Data Subjects under applicable Data Privacy Laws; and
(d) Seller provides Data Subject with the right to opt-out of Sales or Sharing, informs Data Subject of their right to opt-out in the Seller Privacy Policy, and processes requests to opt-out in a timely manner, in all cases in accordance with the requirements of applicable Data Privacy Laws.
Each Party will, upon request, provide the other Party with reasonable documents and information as necessary to enable the other Party to comply with its respective obligations under Data Privacy Laws, in connection with the Processing of Buyer Data, including information required to complete any data processing assessments.
In case of inquiry or investigation by a data protection authority related to Processing of Personal Data in connection with the Services, the Parties agree to cooperate in good faith and to provide one another with reasonable documents and information necessary to facilitate such cooperation.
Each Party will promptly inform the other if it determines it is no longer able to comply with its obligations under applicable Data Privacy Laws, in connection with the Processing of Buyer Data.
Each Party is responsible for independently processing, documenting and responding to Privacy Requests that the Party receives, in accordance with its respective obligations under applicable Data Privacy Laws.
Taking into account the nature of the Personal Data and the risks associated with a breach of such Personal Data, as well as the requirements of applicable Data Privacy Laws, each Party will implement and maintain reasonable security procedures and practices to protect the Buyer Data from unauthorized or illegal access, destruction, use, modification, disclosure, or Processing.
10.1. Each Party will comply with applicable Data Privacy Laws with respect to any cross-border transfer of Buyer Data, including any Restricted Transfer. Without limiting the foregoing, in the event of any Restricted Transfer of Buyer Data by Whop to Seller, pursuant to the Agreement, Section 10.2 will apply.
10.2. The EU SCCs Module 1 (Controller-to-Controller) and the UK Addendum are: (i) incorporated by reference into this DSA; (ii) will take effect upon and apply to the extent of a Restricted Transfer of Buyer Data to Seller pursuant to the Agreement, subject to Appendix 1 to this DSA. By executing the Agreement, Whop as the data exporter, and Seller as the data importer, execute and agree to be bound by the EU SCCs and the UK Addendum (as applicable), as set forth hereunder.
Appendix 1: Restricted Transfers Subject to European Data Privacy Laws
Part 1-A Identifies the relevant Module and certain selections applicable to the EU SCCs.
Part 1-B Sets forth the information necessary to complete Annex I and Annex II of the EU SCCs.
Part 1-A
1.1. Clause 7 (Docking): the (optional) Clause 7 does apply.
1.2. Clause 11(a) (Redress): the optional paragraph of Clause 11(a) does not apply.
1.3. Clause 17 (Governing Law): Option 1 applies and:
1.1.1. For Restricted Transfers that are subject to the Data Privacy Laws of the European Union and the European Economic Area, the Parties specify the law of the Republic of Ireland.
1.3.1. For Restricted Transfers governed by the Data Privacy Laws of Switzerland or the United Kingdom, the governing law is as specified in Section 2 and Section 3, respectively, of this Appendix 1.
1.4. Clause 18 (Choice of Forum and Jurisdiction): For purposes of paragraph b) of Clause 18, the Parties select the law and courts of the Republic of Ireland, except that, for Restricted Transfers governed by the Data Protection Laws of Switzerland or the United Kingdom, the choice of forum and jurisdiction will be as specified in Section 2 and Section 3, respectively, of this Appendix 1.
1.5. Annexes: Annex I and Annex II of the EU SCCs are completed as set forth in Part 1-B of this Appendix 1; Annex III does not apply.
2.1. General and specific references in the Clauses to the GDPR, Regulation (EU) 2016/679, EU Member State Law, or any provisions thereof, will be interpreted as references to the Data Protection Laws of Switzerland or the equivalent reference in the Data Protection Laws of Switzerland, as applicable;
2.2. Any other obligation in the Clauses determined by the Member State in which the Data Subject is established will refer to an obligation under Swiss Data Protection Laws, as applicable;
2.3. The relevant supervisory authority will be the Swiss Data Protection and Information Commissioner, the governing law will be the law of Switzerland, and the applicable forum will the federal courts of Switzerland; and
2.4. The term “Member State” or “EU Member State” must not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence in accordance with Clause 18.
3.1. The Clauses will be read, apply in accordance with, and be deemed amended by, the provisions of Part 2 (Mandatory Clauses) of the UK Addendum;
3.2. The relevant supervisory authority is the UK Information Commissioner’s Office, the governing law will be the laws of England and Wales, and the applicable forum for disputes will be the courts of England and Wales;
3.3. The information required to complete Part 1 (Tables) of the UK Addendum is set out in below, in Part 1-B.
3.4. For purposes of Table 4, the Importer and the Exporter may end the UK Addendum as set forth in Section 19 of the UK Addendum.
Part 1-B
Annex I and Annex II of the EU SCCs are completed as set forth in this Part 1-B.
Annex I:
A. LIST OF PARTIES
Data Exporter: The data exporter is Whop, Inc. Whop provides Services to data importer pursuant to their underlying Agreement.
• Address: As provided in the Agreement.
• Contact person’s name, position, and contact details: As provided in the Agreement.
• Activities relevant to the data transferred under these Clauses: The data exporter provides Services to data importer pursuant to their underlying Agreement.
• Role: Controller
Signature and Date: By entering into the Agreement with Seller, Whop, as the data exporter, enters into and agrees to be bound the EU SCCs (including Annexes I and II) as set forth in this DSA, and is deemed to have signed Annex I(A) of the EU SCCs as of the effective date of the Agreement.
Data Importer: The data importer is Seller. Seller receives Services from data exporter pursuant to their underlying Agreement.
• Address: As provided in the Agreement.
• Contact person’s name, position, and contact details: The contact information and name of the individual who electronically signed the Agreement.
• Activities relevant to the data transferred under these Clauses: The data exporter provides Services to data importer pursuant to their underlying Agreement.
• Role: Controller
Signature and Date: By entering into the Agreement with Whop, Seller, as the data importer, enters into and agrees to be bound the EU SCCs (including Annexes I and II) as set forth in this DSA, and is deemed to have signed Annex I(A) of the EU SCCs as of the effective date of the Agreement.
B. DESCRIPTION OF TRANSFER
Categories of Data Subjects whose personal data is transferred: Buyers and end users of the Whop platform who purchase Seller Products or interact with Seller through the Whop platform.
Categories of personal data transferred: Names, email address, addresses, phone number and contact information of Buyers of Seller Products; IP address; Buyer purchase and transaction history related to Buyer purchases of Seller Products; Buyer communications and requests related to Seller and Seller Products; and transactional analytics related to Buyer purchases of Seller Products.
Sensitive data transferred: N/A.
The frequency of the transfer: Continuous.
Nature of the Processing: Data Exporter Processes the Buyer Data for purposes of providing the Services pursuant to the Agreement and as set forth in the Whop Privacy Policy.
Purpose(s) of the data transfer and further Processing: The Buyer Data is transferred to and will be further Processed by the Data Importer for the Specified Purposes set forth in the DSA.
The period for which the Personal Data will be retained: Personal Data will be retained for so long as necessary to provide the Services under the Agreement, this DSA, and/or in accordance with applicable legal requirements.
For transfers to (sub)processors, also specify subject matter, nature and duration of the processing: Not applicable.
C. COMPETENT SUPERVISORY AUTHORITY
As specified in Part 1-A of Appendix 1.
Annex II:
Controller will implement and will maintain commercially reasonable technical and organizational measures for protecting Buyer Data, including with respect to its relevant information processing systems, and reasonable and appropriate technical, physical and administrative measures will be maintained to protect Buyer Data against unauthorized or unlawful Processing or accidental loss, destruction or damage, including:
(a) employees and other personnel that regularly handle Personal Data receive privacy and security appropriate to their responsibilities;
(b) documented policies, procedures and processes for managing the security risks related to Processing of Personal Data;
(c) devices, systems, facilities and assets that Process Personal Data and/or are material to the Processing of the Buyer Data are identified and managed (“assets”);
(d) security risks are identified, and are assessed regularly;
(e) access to assets is limited to authorized users;
(f) access logs are collected and reviewed as appropriate;
(g) remote access to assets is restricted and securely managed;
(h) electronic and paper records containing Personal Data are securely destroyed in accordance with secure destruction policies and procedures;
(i) appropriate technical security solutions are implemented and managed to protect the confidentiality, integrity and availability of Personal Data;
(j) maintenance and repair of information system components is performed in a controlled and secure manner;
(k) incident response processes and procedures are maintained to provide for timely identification of, response to, and mitigation of detected events; and
(l) backups and disaster recovery processes are in place.
(m) reasonable steps will be taken in an effort to ensure the reliability of personnel having access to Personal Data.
(n) Appropriate due diligence will be conducted on processors and service providers to ensure that each is capable of providing an appropriate level of protection for the relevant Personal Data.