convert

74715632.1

Effective Date: 10/14/2020

DATA PROCESSING ADDENDUM

This Data Processing Addendum (“

DPA

”) amends and supplements the Flickr Terms of Use

(“

Agreement

”) entered into between you, the user, together with any company or other business entity

you are representing, if any (collectively, “

Photographer

”), and Flickr, Inc. (“Flickr”) and is hereby

incorporated by reference into the Agreement. All capitalized terms not otherwise defined in this DPA
will have the meaning given to them in the Agreement. If there is any inconsistency or conflict between
this DPA and the rest of the Agreement as it relates to data protection, this DPA will govern.

DEFINITIONS.

“

Photographer Personal Data

” means (i) the images and videos that Photographer uploads to or creates

in the Services or Products, or (ii) any labels, tags, comments, descriptions or categorizations that
Photographer adds to those images and videos in the Services or Products, in each case processed by
Flickr in its capacity as a processor under applicable Data Protection Legislation.

“

Data Subject

” means any individual to whom Photographer Personal Data relates.

“

Data Protection Legislation

” means all applicable laws and other legal requirements applicable to the

Processing of Photographer Personal Data, including, as applicable: (a) the GDPR; (b) the Federal Data
Protection Act of 19 June 1992 (Switzerland); and (c) the California Consumer Privacy Act.

“

GDPR

” means the General Data Protection Regulation (EU) 2016/679 on the protection of natural

persons with regard to the processing of personal data and on the free movement of such data, and
repealing Directive 95/46/EC, and any amendment or replacement to it.

“

Personal Data

” means any information that relates to an identified or identifiable Data Subject,

including but not limited to a name, an identification number, location data, an online identifier or to one
or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social
identity of the Data Subject.

“

Process,

” “

Processed,

” or “

Processing

” means any operation or set of operations which is performed

on Personal Data, whether or not by automated means, such as the collection, recording, organization,
structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission,
dissemination or otherwise making available, alignment or combination, restriction, erasure or
destruction of Photographer Personal Data.

“

Standard Contractual Clauses

” means the standard contractual clauses and related appendices,

attached as Attachment 1 to this DPA, in the form mandated by and pursuant to the European
Commission’s decision (C(2010)593) of 5 February 2010 on standard contractual clauses for the transfer
of personal data to processors established in third countries or in the form mandated by and pursuant to
another European Commission decision authorizing the use of standard contractual clauses to safeguard
a transfer to processors or sub-processors in accordance with Data Protection Legislation.

The terms “

controller

,” “

data subject

,” “

personal data,

” “

personal data breach

,” “

processor

,” and

“

supervisory authority

” as used in this DPA will have the meanings ascribed to them in the GDPR,

74715632.1

regardless of whether the GDPR applies.

PROCESSING OF DATA.

2.1.

Purpose of Processing. The purpose of data Processing under this Agreement is the provision of
the Services or Products pursuant to the Agreement.

2.2.

Processor and Controller Responsibilities. The parties acknowledge and agree that: (a) Flickr is
a processor (or equivalent) of Photographer Personal Data under the Data Protection Legislation;
(b) Photographer is a controller (or equivalent) of Photographer Personal Data under the Data
Protection Legislation; and (c) each party will comply with the obligations applicable to it under
the Data Protection Legislation with respect to the Processing of Photographer Personal Data.
For example, under the CCPA, Flickr is Photographer’s “service provider” with respect to the
Photographer Personal Data.

2.3.

Photographer Instructions. Photographer instructs Flickr to Process Photographer Personal Data:
(a)  in  accordance  with  the  Agreement;  and  (b)  to  comply  with  other  reasonable  written
instructions provided by Photographer where such instructions are consistent with the terms of
the  Agreement.    Flickr  is  prohibited  from  retaining,  using,  or  disclosing  the  Photographer
Personal Data for any purpose other than for the specific purpose of performing such services
for Photographer, except as otherwise permitted by applicable law.   Photographer will ensure
that  its  instructions  for  the  Processing  of  Photographer  Personal  Data  comply  with  the  Data
Protection Legislation. Photographer shall have sole responsibility for the accuracy, quality, and
legality  of  Photographer  Personal  Data  and  the  means  by  which  Photographer  obtained  the
Photographer Personal Data.

2.4.

Flickr’s Compliance With Photographer Instructions. Flickr shall only retain, use, disclose and
otherwise  Process  Photographer  Personal  Data  in  accordance  with  Photographer’s  written
instructions set forth above. Flickr may Process Photographer Personal Data other than on the
written  instructions  of  Photographer  if  it  is  required  under  applicable  law  to  which  Flickr  is
subject.  In  this  situation,  Flickr  shall  inform  Photographer  of  such  requirement  before  Flickr
Processes  the  Photographer  Personal  Data  unless  prohibited  by  applicable  law.  If  Flickr
concludes that Photographer’s instructions conflict with any Data Protection Legislation, Flickr
will inform Photographer without unreasonable delay.

SECURITY; PRIVACY IMPACT ASSESSMENTS.

3.1.

Flickr Personnel. Flickr shall ensure that its personnel engaged in the Processing of Photographer
Personal Data are informed of the confidential nature of the Photographer Personal Data, and
are subject to obligations of confidentiality, and such obligations survive the termination of such
individuals’ engagement with Flickr.

3.2.

Security. Flickr will implement technical and organizational measures regarding the security of
Photographer Personal Data. No security measure is perfect. Flickr cannot and does not promise
that the Photographer Personal Data will remain secure.

3.3

Data  Protection  Impact  Assessments.  Flickr will take reasonable measures to cooperate and
assist Photographer in conducting a data protection impact assessment and related consultations
with  any  supervisory  authority,  if  Photographer  is  required  to  do  so  under  Data  Protection
Legislation.  Because such assistance may be costly and burdensome, Flickr reserves the right
to condition significant support in this area on the payment of additional fees and agreement to

74715632.1

additional terms to be negotiated by the parties.

DATA SUBJECT RIGHTS.

4.1.

Notification and Assistance Obligations. Photographer must respond to Data Subjects’ requests
to exercise their rights under Data Protection Legislation (such as access, deletion or takedown)
within  7  days  (or  sooner  if  legally  required).    Photographer  must  honor  such  requests  to  the
extent legally required.  Flickr shall, to the extent legally permitted, promptly either (i) notify
Photographer if it receives such a request from a Data Subject, or (ii) direct such individual to
contact  Photographer  directly.  Flickr  may  communicate  with  the  Data  Subject,  such  as  to
facilitate  this  process,  to  explain  why  Flickr  has  not  immediately  honored  the  individual’s
request,  to address  potential  violations of  the  Terms & Conditions of  Service,  and  to address
requests unrelated to the ones covered by this paragraph.

4.2.

Flickr shall provide Photographer with commercially reasonable cooperation and assistance in
relation to handling of a Data Subject request, to the extent Flickr is legally permitted and able
to do so, where Photographer does not have the ability to honor such requests through its use or
receipt of the Services or Products. As part of this, Flickr will de-publish the Photographer
Personal Data and notify Photographer when the individual requests removal of Photographer
Personal Data but Flickr concludes that Photographer has not responded within 7 days.

SUBCONTRACTORS.

5.1.

General  Authorization.  Photographer  provides  a  general  authorization  for  the  use  of
subprocessors  to  Process  Photographer  Personal  Data  in  connection  with  fulfilling  Flickr’s
obligations under the Agreement and/ or this DPA.  Flickr’s third-party subprocessors are listed

here

(the “Subprocessor List”).

5.2

New Subprocessors. When Flickr engages any new subprocessor to process Photographer
Personal Data, Flickr will update the Subprocessor List to give Photographer the opportunity to
object to such subprocessor by terminating service pursuant to the Terms & Conditions.

5.3.

Flickr Obligations. Flickr will contractually impose data protection obligations on its
subprocessors that are at least equivalent to those data protection obligations imposed on Flickr
under this DPA.

TRANSFERS OF PERSONAL DATA OUTSIDE OF THE EUROPEAN ECONOMIC
AREA, THE UNITED KINGDOM, OR SWITZERLAND.

6.1.

Where Photographer Personal Data originating in the European Economic Area is Processed by
Flickr outside the European Economic Area, in a territory that has not been designated by the
European Commission as ensuring an adequate level of protection pursuant to applicable Data
Protection  Legislation,  Flickr  and  Photographer  agree  that  the  transfer  shall  be  undertaken
pursuant  to  Standard  Contractual  Clauses.  The  Standard  Contractual  Clauses  apply  to
Photographer or the affiliates of Photographer established within the European Economic Area,
Switzerland or the United Kingdom, which are otherwise entitled to receive Services under the
Agreement. For the purpose of the Standard Contractual Clauses, Photographer or the affiliates
of Photographer shall be deemed “data exporters.”  For transfers from Switzerland only, the term

74715632.1

“personal data” as used in the Standard Contractual Clauses, shall have the meaning give under
the Swiss Data Protection Act, as amended or replaced from time to time.

LEGAL REQUESTS FOR PERSONAL DATA.

7.1.

Unless prohibited by applicable law, in the event that Flickr is required by law, court order,
warrant, subpoena, or other legal judicial process (“Legal Request”) to disclose or permit access
to any Photographer Personal Data to any person or entity other than Photographer, Flickr shall
notify Photographer promptly and shall provide all reasonable assistance to Photographer, at
Photographer’s cost, to enable Photographer to respond or object to, or challenge, any such
demands, requests, inquiries or complaints and to meet applicable statutory or regulatory
deadlines. Flickr shall not disclose Photographer Personal Data pursuant to a Legal Request
unless it is required to do so and has otherwise complied with the obligations in this Section.
Notwithstanding any provision in this DPA to the contrary, nothing set forth in this DPA shall
restrict or limit Flickr’s right to notify law enforcement or applicable regulatory authorities
and/or to disclose Photographer Personal Data to the same, in the event Flickr reasonably
believes that Photographer Personal Data, in whole or in part, violates applicable law.

SECURITY BREACH.

8.1.

Notification  Obligations.  In  the  event  of  a  confirmed  Security  Breach,  Flickr  will  notify
Photographer of the Security Breach without undue delay. The obligations in this Section 8 do
not  apply  to  unsuccessful  attempts  or  activities  that  do  not  compromise  the  security  of
Photographer Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of
service attacks, and other network attacks on firewalls or networked systems. It is Photographer’s
responsibility  to  notify  the  relevant  governmental  authorities  and  affected  Data  Subjects.
Photographer authorizes Flickr to notify governmental authorities or affected individuals of a
Security Breach if Flickr considers such notification appropriate.

8.2.

Manner of Notification. Notification(s) of Security Breaches, if any, will be delivered to one or
more of Photographer’s business, technical or administrative contacts by any means Flickr
selects, including via email. It is Photographer’s sole responsibility to ensure it maintains
accurate contact information on Flickr’s support systems at all times.

TERM AND TERMINATION.

9.1.

Term of DPA. This DPA will remain in effect until, and automatically expire upon, deletion of
all Photographer Personal Data as described in this DPA.

9.2.

Deletion  of  Photographer  Data.  Flickr  shall  delete  or  return  Photographer  Personal  Data  to
Photographer  after  the  end  of the provision of Services or Products under the Agreement and
shall  delete  all  existing  copies  thereof,  except  to  the  extent  that  Flickr  is  required  under
applicable law to keep a copy of the Photographer Personal Data.

10.

COMPLIANCE INFORMATION.

10.1.

Information Available. To the extent applicable law requires Photographer to impose the
following provision on Flickr, it applies: Flickr will make available all information reasonably
necessary to demonstrate compliance with the obligations set forth in this Addendum and will

74715632.1

Attachment 1

STANDARD CONTRACTUAL CLAUSES

For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors

established in third countries which do not ensure an adequate level of data protection

Photographer

as defined in the Amendment and as further specified therein

(the

data

exporter

)

And

Flickr Inc.

(the

data

importer

)

each a “party”; together “the parties”,

The  parties  HAVE  AGREED  on  the  following  Contractual  Clauses  (the  Clauses)  in  order  to  adduce
adequate  safeguards  with  respect  to  the  protection  of  privacy  and  fundamental  rights  and  freedoms  of
individuals  for  the  transfer  by  the  data  exporter  to  the  data  importer  of  the  personal  data  specified  in
Appendix 1.

Background

The data exporter has entered into a data processing addendum (“DPA”) with the data importer.

Pursuant to the terms of the DPA, it is contemplated that services provided by the data importer will
involve  the  transfer  of  personal  data  to  data  importer.  Data  importer  is  located  in  a  country  not
ensuring  an adequate  level  of  data  protection.  To ensure  compliance  with  Directive  95/46/EC and
applicable data protection law, the controller agrees to the provision of such Services, including the
processing  of  personal  data  incidental  thereto,  subject  to  the  data  importer’s  execution  of,  and
compliance with, the terms of these Clauses.

Clause 1

DEFINITIONS

For the purposes of the Clauses:

‘personal data’, ‘special categories of data’, ‘process/processing’, ‘controller’, ‘processor’,
‘data subject’

and

‘supervisory authority’

shall have the same meaning as in Directive

95/46/EC of the European Parliament and of the Council of 24 October 1995 on the
protection of individuals with regard to the Processing of personal data and on the free
movement of such data;

‘

the data exporter’

means the controller who transfers the personal data;

‘the data importer’

means the processor who agrees to receive from the data exporter

personal data intended for processing on his behalf after the transfer in accordance with his
instructions and the terms of the Clauses and who is not subject to a third country’s system
ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;

‘the sub-processor’

means any processor engaged by the data importer or by any other sub-

processor of the data importer who agrees to receive from the data importer or from any other
sub-processor of the data importer personal data exclusively intended for processing

74715632.1

activities to be carried out on behalf of the data exporter after the transfer in accordance with
his instructions, the terms of the Clauses and the terms of the written subcontract;

‘

the applicable data protection law’

means the legislation protecting the fundamental rights

and freedoms of individuals and, in particular, their right to privacy with respect to the
Processing of personal data applicable to a data controller in the Member State in which the
data exporter is established;

‘technical and organisational security measures’

means those measures aimed at protecting

personal data against accidental or unlawful destruction or accidental loss, alteration,
unauthorised disclosure or access, in particular where the processing involves the
transmission of data over a network, and against all other unlawful forms of processing.

Clause 2

DETAILS OF THE TRANSFER

The details of the transfer and in particular the special categories of personal data where applicable are
specified in Schedule 1 which forms an integral part of the Clauses.

Clause 3

THIRD-PARTY BENEFICIARY CLAUSE

The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause
5(a) to (e), and (g) to (j), Clause 6.1 and 6.2, Clause 7, Clause 8.2, and Clauses 9 to 12 as third-
party beneficiary.

The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g),
Clause 6, Clause 7, Clause 8.2, and Clauses 9 to 12, in cases where the data exporter has
factually disappeared or has ceased to exist in law unless any successor entity has assumed the
entire legal obligations of the data exporter by contract or by operation of law, as a result of
which it takes on the rights and obligations of the data exporter, in which case the data subject
can enforce them against such entity.

The data subject can enforce against the sub-Processor this Clause, Clause 5(a) to (e) and (g),
Clause 6, Clause 7, Clause 8.2, and Clauses 9 to 12, in cases where both the data exporter and
the data importer have factually disappeared or ceased to exist in law or have become insolvent,
unless any successor entity has assumed the entire legal obligations of the data exporter by
contract or by operation of law as a result of which it takes on the rights and obligations of the
data exporter, in which case the data subject can enforce them against such entity. Such third-
party liability of the sub-processor shall be limited to its own processing operations under the
Clauses.

The Parties do not object to a data subject being represented by an association or other body if
the data subject so expressly wishes and if permitted by national law.

Clause 4

OBLIGATIONS OF THE DATA EXPORTER

The data exporter agrees and warrants:

74715632.1

that the processing, including the transfer itself, of the personal data has been and will continue
to be carried out in accordance with the relevant provisions of the applicable data protection
law (and, where applicable, has been notified to the relevant authorities of the Member State
where the data exporter is established) and does not violate the relevant provisions of that State;

that it has instructed and throughout the duration of the personal data processing services will
instruct the data importer to Process the personal data transferred only on the data exporter’s
behalf and in accordance with the applicable data protection law and the Clauses;

that the data importer will provide sufficient guarantees in respect of the technical and
organisational security measures specified in Schedule 2;

that after assessment of the requirements of the applicable data protection law, the security
measures are appropriate to protect personal data against accidental or unlawful destruction or
accidental loss, alteration, unauthorised disclosure or access, in particular where the processing
involves the transmission of data over a network, and against all other unlawful forms of
processing, and that these measures ensure a level of security appropriate to the risks presented
by the processing and the nature of the data to be protected having regard to the state of the art
and the cost of their implementation;

that it will ensure compliance with the security measures;

that, if the transfer involves special categories of data, the data subject has been informed or
will be informed before, or as soon as possible after, the transfer that its data could be
transmitted to a third country not providing adequate protection within the meaning of
Directive 95/46/EC;

to forward any notification received from the data importer or any sub-processor pursuant to
Clause 5(b) and Clause 8.3 to the data protection supervisory authority if the data exporter
decides to continue the transfer or to lift the suspension;

to make available to the data subjects upon request a copy of the Clauses, with the exception
of Schedule 2, and a summary description of the security measures, as well as a copy of any
contract for sub-processing services which has to be made in accordance with the Clauses,
unless the Clauses or the contract contain commercial information, in which case it may remove
such commercial information;

that, in the event of sub-processing, the processing activity is carried out in accordance with
Clause 11 by a sub-processor providing at least the same level of protection for the personal
data and the rights of data subject as the data importer under the Clauses; and

10.

that it will ensure compliance with Clause 4(a) to (i).

Clause 5

OBLIGATIONS OF THE DATA IMPORTER

The data importer agrees and warrants:

to process the personal data only on behalf of the data exporter and in compliance with its
instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it

74715632.1

agrees to inform promptly the data exporter of its inability to comply, in which case the data
exporter is entitled to suspend the transfer of data and/or terminate the contract;

that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the
instructions received from the data exporter and its obligations under the contract and that in
the event of a change in this legislation which is likely to have a substantial adverse effect on
the warranties and obligations provided by the Clauses, it will promptly notify the change to
the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend
the transfer of data and/or terminate the contract;

that it has implemented the technical and organisational security measures specified in
Schedule 2 before processing the personal data transferred;

that it will promptly notify the data exporter about:

any legally binding request for disclosure of the personal data by a law enforcement
authority unless otherwise prohibited, such as a prohibition under criminal law to
preserve the confidentiality of a law enforcement investigation,

any accidental or unauthorised access, and

any request received directly from the data subjects without responding to that request,
unless it has been otherwise authorised to do so;

to deal promptly and properly with all inquiries from the data exporter relating to its processing
of the personal data subject to the transfer and to abide by the advice of the supervisory
authority with regard to the processing of the data transferred;

at  the  request  of  the  data  exporter  to  submit  its  data  Processing  facilities  for  audit  of  the
processing activities covered by the Clauses which shall be carried out by the data exporter or
an  inspection  body  composed  of  independent  members  and  in  possession  of  the  required
professional  qualifications bound  by a  duty  of  confidentiality,  selected  by  the  data  exporter,
where applicable, in agreement with the supervisory authority;

to make available to the data subject upon request a copy of the Clauses, or any existing contract
for sub-processing, unless the Clauses or contract contain commercial information, in which
case it may remove such commercial information, with the exception of Schedule 2 which shall
be replaced by a summary description of the security measures in those cases where the data
subject is unable to obtain a copy from the data exporter;

that, in the event of sub-processing, it has previously informed the data exporter and obtained
its prior written consent;

that the processing services by the sub-processor will be carried out in accordance with Clause
11;

10.

to send promptly a copy of any sub-processor agreement it concludes under the Clauses to the
data exporter.

Clause 6

74715632.1

LIABILITY

The Parties agree that any data subject, who has suffered damage as a result of any breach of the
obligations referred to in Clause 3 or in Clause 11 by any Party or sub-processor is entitled to
receive compensation from the data exporter for the damage suffered.

If a data subject is not able to bring a claim for  compensation in accordance with paragraph 6.1
against the data exporter, arising out of a breach by the data importer or his sub-processor of any
of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually
disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data
subject  may  issue  a  claim  against  the  data  importer  as  if  it  were  the  data  exporter,  unless  any
successor  entity  has assumed  the  entire  legal  obligations  of  the  data  exporter  by  contract  of  by
operation of law, in which case the data subject can enforce its rights against such entity. The data
importer may not rely on a breach by a sub-processor of its obligations in order to avoid its own
liabilities.

If a data subject is not able to bring a claim against the data exporter or the data importer referred
to in paragraphs 6.1 and 6.2, arising out of a breach by the sub-processor of any of their obligations
referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have
factually disappeared or ceased to exist in law or have become insolvent, the sub-processor agrees
that the data subject may issue a claim against the data sub-processor with regard to its own
processing operations under the Clauses as if it were the data exporter or the data importer, unless
any successor entity has assumed the entire legal obligations of the data exporter or data importer
by contract or by operation of law, in which case the data subject can enforce its rights against such
entity. The liability of the sub-Processor shall be limited to its own processing operations under the
Clauses.

Clause 7

MEDIATION AND JURISDICTION

The data importer agrees that if the data subject invokes against it third-party beneficiary rights
and/or claims compensation for damages under the Clauses, the data importer will accept the
decision of the data subject:

to refer the dispute to mediation, by an independent person or, where applicable, by the
supervisory authority;

to refer the dispute to the courts in the Member State in which the data exporter is
established.

The Parties agree that the choice made by the data subject will not prejudice its substantive or
procedural rights to seek remedies in accordance with other provisions of national or international
law.

Clause 8

74715632.1

COOPERATION WITH SUPERVISORY AUTHORITIES

The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so
requests or if such deposit is required under the applicable data protection law.

The parties agree that the supervisory authority has the right to conduct an audit of the data
importer, and of any sub-processor, which has the same scope and is subject to the same conditions
as would apply to an audit of the data exporter under the applicable data protection law.

The data importer shall promptly inform the data exporter about the existence of legislation
applicable to it or any sub-processor preventing the conduct of an audit of the data importer, or any
sub-processor, pursuant to paragraph 8.2. In such a case the data exporter shall be entitled to take
the measures foreseen in Clause 5(b).

Clause 9

GOVERNING LAW

The Clauses shall be governed by the law of the Member State in which the data exporter is established.

Clause 10

VARIATION OF THE CONTRACT

The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding
clauses on business related issues where required as long as they do not contradict the Clauses.

Clause 11

SUB-PROCESSING

The data importer shall not subcontract any of its processing operations performed on behalf of the
data exporter under the Clauses without the prior written consent of the data exporter. Where the
data importer subcontracts its obligations under the Clauses, with the consent of the data exporter,
it shall do so only by way of a written agreement with the sub-Processor which imposes the same
obligations on the sub-processor as are imposed on the data importer under the Clauses. Where the
sub-processor fails to fulfil its data protection obligations under such written agreement the data
importer shall remain fully liable to the data exporter for the performance of the sub-processor’s
obligations under such agreement.

The prior written contract between the data importer and the sub-processor shall also provide for a
third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able
to bring the claim for compensation referred to in Clause 6.1 against the data exporter or the data
importer because they have factually disappeared or have ceased to exist in law or have become
insolvent and no successor entity has assumed the entire legal obligations of the data exporter or
data importer by contract or by operation of law. Such third-party liability of the sub-processor
shall be limited to its own processing operations under the Clauses.

The provisions relating to data protection aspects for sub-processing of the contract referred to in
paragraph 11.1 shall be governed by the law of the Member State in which the data exporter is
established.

74715632.1

The data exporter shall keep a list of sub-processing agreements concluded under the Clauses and
notified by the data importer pursuant to Clause 5(j), which shall be updated at least once a year.
The list shall be available to the data exporter’s data protection supervisory authority.

Clause 12

OBLIGATION AFTER THE TERMINATION OF PERSONAL DATA PROCESSING

SERVICES

The parties agree that on the termination of the provision of data processing services, the data
importer and the sub-processor shall, at the choice of the data exporter, return all the personal data
transferred and the copies thereof to the data exporter or shall destroy all the personal data and
certify to the data exporter that it has done so, unless legislation imposed upon the data importer
prevents it from returning or destroying all or part of the personal data transferred. In that case, the
data importer warrants that it will guarantee the confidentiality of the personal data transferred and
will not actively process the personal data transferred anymore.

The data importer and the sub-processor warrant that upon request of the data exporter and/or of
the supervisory authority, it will submit its data processing facilities for an audit of the measures
referred to in paragraph 7.

- 13
-

74715725.2

SCHEDULE 1 TO THE STANDARD CONTRACTUAL CLAUSES

DESCRIPTION OF THE TRANSFERS (CONTROLLER TO PROCESSOR)

This Schedule 1 forms part of these Clauses.

The Member States may complete or specify, according to their national procedures, any additional
necessary information to be contained in this Schedule.

Data exporter

The Data Exporter is:

Photographer or affiliates of Photographer as described in Section 10 of the Data Processing
Agreement.

Data importer

The Data Importer is:

Flickr Inc.

Data subjects

The personal data transferred concern the following categories of data subjects:

Customers of Photographer or other individuals who have engaged in one or more transactions with
Photographer.

Categories of data

The personal data transferred concern the following categories of data:

Images

Contact information

Localization and demographic data

Special categories of data (if appropriate)

The personal data transferred concern the following special categories of data:

N/A

Processing operations

The personal data transferred will be subject to the following basic processing activities:

Use of personal data for the provision of the Services as described in the Agreement.

Document Outline