Privacy Policy
Introduction
MilkMoney Holdings, Inc. ("MilkMoney”, "Company" or "We") respect your privacy and are committed to protecting it through our compliance with this policy.
This policy describes the types of information we may collect from you or that you may provide when you visit the website [“www.milkmoney.com”] (our "Website") and our practices for collecting, using, maintaining, protecting, and disclosing that information.
This policy applies to information we collect:
On this Website.
In email, text, and other electronic messages between you and this Website.
Through mobile and desktop applications you download from this Website, which provide dedicated non-browser-based interaction between you and this Website.
Through mobile and desktop applications you download from this Website, which provide dedicated non-browser-based interaction between you and this Website.
It does not apply to information collected by:
us offline or through any other means, including on any other website operated by Company or any third party (including our affiliates and subsidiaries); or any third party (including our affiliates and subsidiaries), including through any application or content (including advertising) that may link to or be accessible from or on the Website.
Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Website. By accessing or using this Website, you agree to this privacy policy. This policy may change from time to time (see Changes to Our Privacy Policy). Your continued use of this Website after we make changes is deemed to be acceptance of those changes, so please check the policy periodically for updates.
Children Under the Age of 13
Our Website is not intended for children under 13 years of age. No one under age 13 may provide any personal information to or on the Website. We do not knowingly collect personal information from children under 13. If you are under 13, do not use or provide any information on this Website or on or through any of its features/register on the Website, make any purchases through the Website, use any of the interactive or public comment features of this Website or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received personal information from a child under 13 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 13, please contact us at support@milkmoney.com.
Business to Business Use of Website
Our Website is not intended for the personal use of an individual consumer. The use of our Website is intended for the use of businesses (whether sole proprietorship, partnership, corporation, limited liability company, or other entity), through their employees, agents, or other authorized representatives, for commercial purposes in connection with the advertising displays or services offered by milkmoney to such businesses. An individual who uses this Website does so on behalf of such business for such commercial purposes and not for personal use. The information we collect may include the name, email address, and telephone number of such individual, and IP address or any screen name or user name such individual may use, which information will be identified and stored as information of the business such individual represents, not the individual.
Information We Collect About You and How We Collect It
We collect several types of information from and about users of our Website, including information:
by which you may be identified under the business you represent, such as name, postal address, e-mail address, telephone number, or any other identifier for the business by which you may be contacted online or offline ("business information"); that is about you but individually does not identify you; and/or about your internet connection, the equipment you use to access our Website and usage details.
We collect this information:
Directly from you when you provide it to us.
Automatically as you navigate through the site. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies.
From third parties, for example, our members and business partners.
Information You Provide to Us
The information we collect on or through our Website may include:
Information that you provide by filling in forms on our Website. This includes information provided at the time you fill out our Get Started form, entering into any portal, dashboard, or registering to use our Website, subscribing to our service, or requesting further services. We may also ask you for information when you enter a contest or promotion sponsored by us, and when you report a problem with our Website.
Information that you provide by filling in forms on our Website. This includes information provided at the time you fill out our Get Started form, entering into any portal, dashboard, or registering to use our Website, subscribing to our service, or requesting further services. We may also ask you for information when you enter a contest or promotion sponsored by us, and when you report a problem with our Website.
Your responses to surveys that we might ask you to complete for research purposes.
Details of transactions you carry out through our Website on behalf of the business you represent and of the fulfillment of your orders. You may be required to provide financial information of the business you represent before placing an order through our Website.
Your search queries on the Website.
Through your client dashboard, you also may provide information to be published or displayed (hereinafter, "posted") on or transmitted to other members or users of the Website or third parties (collectively, "User Contributions"). Your User Contributions are posted on and transmitted to others at your own risk. Although we limit access to certain pages, please be aware that no security measures are perfect or impenetrable. Additionally, we cannot control the actions of other users of the Website with whom you may choose to share your User Contributions. Therefore, we cannot and do not guarantee that your User Contributions will not be viewed by unauthorized persons.
Information We Collect Through Automatic Data Collection Technologies
As you navigate through and interact with our Website, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:
Details of your visits to our Website, including traffic data, location data, logs, and other communication data and the resources that you access and use on the Website.
Information about your computer and internet connection, including your IP address, operating system, and browser type.
We also may use these technologies to collect information about your online activities on behalf of the business you represent over time on the Website and across third-party websites or other online services (behavioral tracking). Such automatic data collection is identified by the business you represent, not you individually. Please contact milkmoney at support.milkmoney.com for information on how you can opt out of behavioral tracking of your personal information, if any, on this website.
The information we collect automatically is statistical data and does not include consumer personal information, but we may maintain it or associate it with business information we collect or receive from third parties. It helps us to improve our Website and to deliver a better and more personalized service, including by enabling us to:
Estimate our audience size and usage patterns.
Store information about your business’s preferences, allowing us to customize our Website and make recommendations and suggestions according to your business’s specific interests.
Speed up your searches.
Recognize you when you return to our Website and your location.
Recommend other inventory you make prefer, and make other suggestions and recommendations to enhance your experience with MilkMoney and its Website
The technologies we use for this automatic data collection may include:
Flash Cookies. Certain features of our Website may use local stored objects (or Flash cookies) to collect and store information about your preferences and navigation to, from, and on our Website. Flash cookies are not managed by the same browser settings as are used for browser cookies.
Web Beacons. Pages of our the Website and our e-mails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).
Heap and Inspectlet technologies are used to track your online behavior, which may include recording your site and dashboard sessions.
Third-Party Use of Cookies and Other Tracking Technologies
Some content or applications, including advertisements, on the Website are served by third-parties, including advertisers, ad networks and servers, content providers, and application providers. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use our website. The information they collect may be associated with your business information or they may collect information, including business information, about your online activities over time and across different websites and other online services. They may use this information to provide you or your business with interest-based (behavioral) advertising or other targeted content.
We do not control these third parties' tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly.
How We Use Your Information
We use information that we collect about you or that you provide to us, including any business information:
To present our Website and its contents to you on behalf of the business you represent.
To provide you with information, products, or services that you request from us for the business you represent.
To provide you with notices about your business’s account, including expiration and renewal notices.
To carry out our obligations and enforce our rights arising from any contracts entered into between the business you represent and us, including for billing and collection.
To notify you about changes to our Website or any products or services we offer or provide though it.
For research and algorithms to improve our products.
To allow you to participate in interactive features on our Website.
In any other way we may describe when you provide the information.
For any other purpose with your consent.
We may also use your information to contact you about our own and third-parties' goods and services that may be of interest to you. If you do not want us to use your personal information, if any, in this way, please contact us at support@milkmoney.com for information on how you can remove your personal information.
We may use the information we have collected from you to enable us to display advertisements to our advertisers' target audiences. Even though we do not disclose your personal information, if any, for these purposes without your consent, if you click on or otherwise interact with an advertisement, the advertiser may assume that you meet its target criteria.
Disclosure of Your Information
We may disclose aggregated information about our users without restriction.
We may disclose business information that we collect or you provide as described in this privacy policy:
To our licensor and affiliates.
To contractors, service providers, and other third parties we use to support our business and who are bound by contractual obligations to keep business information confidential and use it only for the purposes for which we disclose it to them.
To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of milkmoney, Inc.'s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which business information held by MilkMoney about our Website users is among the assets transferred.
To third parties to market their products or services to you if you have not opted out of these disclosures. We contractually require these third parties to keep business information confidential and use it only for the purposes for which we disclose it to them.
To fulfill the purpose within the Terms of Use for which you provide it. For any other purpose disclosed by us when you provide the information. With your consent.
We may also disclose your business information:
To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
To enforce or apply our Terms of Use this Privacy Policy, or agreements for advertising displays or services entered into with milkmoney, including for billing and collection purposes.
If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of MilkMoney, Inc., our customers, media owners, or others.
This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.
Choices About How We Use and Disclose Your Information
We strive to provide you with choices regarding the business information you provide to us. We have created mechanisms to provide you with the following control over your information:
Tracking Technologies and Advertising. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. To learn how you can manage your Flash cookie settings, visit the Flash player settings page on Adobe's website. If you disable or refuse cookies, please note that some parts of this site may then be inaccessible or not function properly.
Disclosure of Your Information for Third-Party Advertising. If you do not want us to share your business information with unaffiliated or non-agent third parties for promotional purposes, you can opt-out by sending us an email stating your request to support@milkmoney.com.
Promotional Offers from the Company. If you do not wish to have your email address/contact information used by the Company to promote our own or third parties' products or services, you can opt-out by sending us an email stating your request to support@milkmoney.com. If we have sent you a promotional email, you may send us a return email asking to be omitted from future email distributions. This opt out does not apply to information provided to the Company as a result of a product purchase, warranty registration, product service experience or other transactions in connection with an agreement, or agreements, for advertising displays or services entered into with milkmoney.
Targeted Advertising. If you do not want us to use information that we collect or that you provide to us to deliver advertisements according to our advertisers' target-audience preferences, you can opt-out by sending us an email stating your request to support@milkmoney.com.
We do not control third parties' collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can opt out of receiving targeted ads from members of the Network Advertising Initiative ("NAI") on the NAI's website
Accessing and Correcting Your Information
You can review and change your business information by logging into the Website and visiting your account profile page.
You may also send us an email at support@milkmoney.com to request access to, correct or delete any business information that you have provided to us. We cannot delete your business information except by also deleting your user account. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.
If you delete your User Contributions from the Website, copies of your User Contributions may remain viewable in cached and archived pages, or might have been copied or stored by other Website users. Proper access and use of information provided on the Website, including User Contributions, is governed by our Terms of Use, Privacy Policy, and agreements for advertising displays and services entered into with milkmoney.
California Civil Code Section § 1798.83 permits users of our Website that are California residents to request certain information regarding our disclosure of business information to third parties for their direct marketing purposes. To make such a request, please send an email to support@milkmoney.com.
Data Security
We have implemented measures designed to secure your business information from accidental loss and from unauthorized access, use, alteration, and disclosure. All information you provide to us is stored on our secure servers behind firewalls. Any payment transactions will be encrypted using SSL technology.
The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Website, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We urge you to be careful about giving out information in public areas of the Website like message boards. The information you share in public areas may be viewed by any user of the Website.
Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your business information, we cannot guarantee the security of your business information transmitted to our Website. Any transmission of business information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Website
Milkmoney is and will at all times remain a “Processor” with regard to customer data collected and stored in connection with the use of this Website and any agreement for advertising displays and services entered into with milkmoney. Milkmoney is responsible for compliance with its obligations as a Processor under applicable data protections law. For transactions affected by the European Union General Data Protection Regulation (EU 2016/679), our obligations as a Processor and your obligations as a “Controller” are set forth in detail in EU Addendum [below].
Milkmoney has implemented generally accepted industry standard systems and procedures to ensure the security and confidentiality of the data that you store in the Website, protect against anticipated threats or dangers to the security or integrity of customer data, and protect against unauthorized access to or use of customer data.
The principal storage of customer data will be in secure facilities operated by Google and/or HubSpot in the United States. Milkmoney has a contractual relationship with Google and HubSpot as a 3rd party cloud hosting providers for the operation of the milkmoney Website, and related portals, including the secure storage and transmission of customer data. Milkmoney may change its 3rd party cloud hosting provider or the location at which customer data is stored at its sole discretion without notice.
Customer data is stored in protected format, and is encrypted during transmission from its storage facility to you when you access it. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, while we strive to use reasonable means to protect customer data, milkmoney cannot guarantee its absolute security.
Neither milkmoney (including any of its employees or agents) nor anyone acting on its behalf will access customer data in a manner in which it is intelligible or recognizable, unless:
Required or permitted to do so by law, valid search warrant or court order (or equivalent); or Requested to do so by you (or someone with your authorization); provided that if you request milkmoney to provide you with technical support on an issue relating to customer data, that will be taken as a request by you to access customer data for that limited purpose.
If MilkMoney is served with a legal request to produce or disclose any of customer data (such as by subpoena or court order), we will endeavor to notify you of the disclosure request so as to provide you with the opportunity to intervene, unless we are prohibited from doing so by law.
The Website operates and customer data is stored on redundant servers for each component of the system, so that if any server goes down, another server steps in to provide the same functionality. In addition, the entire system is mirrored to a second geographical location, so that should the primary location suffer a total physical catastrophe, you can continue to use the Website.
While all these steps provide you with a tremendous amount of security in customer data, you acknowledge that you are also responsible for taking reasonable steps to access customer data in a manner that protects its security. This includes that you are responsible for using secure Internet connections, and recognize that unsecure connections (for example public hotspots) are more open to malicious interception.
Changes to Our Privacy Policy
It is our policy to post any changes we make to our privacy policy on this page with a notice that the privacy policy has been updated on the Website home page. The date the privacy policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our Website and this Privacy Policy to check for any changes.
Contact Information
To ask questions or comment about this Privacy Policy and our privacy practices, contact us at:
MilkMoney, Inc., 6100 Wilshire Blvd, Ste 1200 Los Angeles, CA 90048.
GDPR ADDENDUM
Scope, Order of Precedence and Term
This GDPR Addendum shall be incorporated into the MilkMoney, Inc.’s Privacy Policy (“Privacy Policy”).
This GDPR shall be applicable to Data Controllers established in the EU. As provided by MilkMoney’s Terms of Use, MilkMoney anticipates it will primarily offer advertising displays and services located in the United States for commercial purposes to businesses principally located within the United States. MilkMoney anticipates its advertising displays and services may also be purchased for commercial purposes by businesses located outside the United States. If Personal Data is received from businesses established in the EU for such purposes, then the provisions of this GDPR Addendum will apply to supplement the Privacy Policy.
If this GDPR Addendum is applicable, in the event of any conflict between the terms of the Privacy Policy, including any policies or schedules referenced therein, and the terms of this GDPR Addendum, the relevant terms of this GDPR Addendum shall take precedence.
Definitions
“MilkMoney” means MilkMoney, Inc., together with its Affiliates.
“Affiliate,” or “Affiliates” means any entity which is controlled by, controls or is in common control with MilkMoney.
“Applicable Data Protection Law” means (i) Directive 95/46/EC of October 24, 1995, as amended, on the protection of individuals with regard to the Processing of Personal Data and on the free movement of such data (‘Directive’) until such time that it is replaced by GDPR, applicable as of May 25, 2018; (ii) the GDPR.; and (iii) any other data privacy or data protection law or regulation that applies to the processing of Personal Data under this Addendum.
“Data Controller” means You, the entity which determines the purposes and means of the Processing of Personal Data.
“Data Processor” means MilkMoney, the entity which Processes Personal Data on behalf of the Data Controller.
“Data Subject” “means the individual, who is your employee, agent, customer, client, supplier, or representative, to whom Personal Data relates.
“GDPR” means the General Data Protection Regulation (EU 2016/679).
“Personal Data” means any information relating to an identified or identifiable person that MilkMoney may Process on Your behalf under the Privacy Policy.
“Processing,” “Process,” “Processes” and “Processed” mean any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.
“Supervisory Authority” means an independent public authority which is established by an EU Member State.
“Third Party Sub-processor” means a third-party subcontractor, other than a MilkMoney Affiliate, engaged by MilkMoney and which may Process Personal Data as set forth in Section 3.3.
“You” means the business entity (whether sole proprietorship, partnership, corporation, limited liability company, or other entity) that uses the MilkMoney Website and/or enters into agreements with MilkMoney for advertising displays and services, which is established in the EU.
Other capitalized terms have the definitions provided for them in the Privacy Policy or as otherwise specified below.
Controller and Processor of Personal Data and Purpose of Processing
You are and will at all times remain the Controller of the Personal Data Processed by MilkMoney. You are responsible for compliance with Your obligations as a Controller under Applicable Data Protection Law, in particular for justification of any transmission of Personal Data to MilkMoney (including providing any required notices and obtaining any required consents and/or authorizations, or otherwise securing an appropriate legal basis under Applicable Data Protection Law), and for Your decisions and actions concerning the Processing of such Personal Data.
MilkMoney is and will at all times remain a Processor with regard to the Personal Data provided by You to MilkMoney. MilkMoney is responsible for compliance with its obligations as a Processor under Applicable Data Protections Law.
MilkMoney and any persons acting under the authority of MilkMoney, including any MilkMoney Affiliates and Third-Party Sub-processors as set forth in Section 7.3, will Process Personal Data solely for the purpose of (i) providing advertising displays and services in accordance with the agreements entered into with MilkMoney AND IN ACCORDANCE WITH PRIVACY POLICY (ii) complying with Your documented written instructions in accordance with Section 5, or (iii) complying with MilkMoney’s regulatory obligations in accordance with Section 13.
As the Data Controller, You warrant, represent and undertake to MilkMoney that You have lawful grounds for the processing of Personal Data in accordance with MilkMoney’s Terms of Use and Privacy Policy.
Categories of Personal Data and Data Subjects
In order to provide You with the advertising displays and services and depending on the services You have ordered, MilkMoney may Process some or all of the following categories of Personal Data: personal contact information such as name, contact address, contact telephone, including mobile number, fax number, email address, user name and passwords ;business contact details; financial details of the business; goods and services provided to the business; unique IDs collected from mobile devices, network carriers or data providers, IP addresses, and online behavior and interest data identified with the business you represent.
Categories of Data Subjects whose Personal Data may be Processed in order to perform the agreements for advertising displays and services entered into with MilkMoney may include, among others, Your representatives, Your employees, suppliers, customers and clients.
Additional categories of Personal Data and/or Data Subjects may be described in the agreements entered into with MilkMoney Unless otherwise specified in those agreements , Your content may not include any sensitive or special personal data that imposes specific data security or data protection obligations on MilkMoney in addition to or different from those specified in those agreements.
Processing of Personal Data
MilkMoney will Process Personal Data as specified in the Privacy Policy and this GDPR Addendum.
You may provide additional instructions in writing to MilkMoney with regard to Processing of Personal Data in accordance with Applicable Data Protection Law. MilkMoney will comply with all such instructions to the extent necessary for MilkMoney to (i) comply with its Processor obligations under Applicable Data Protection Law; or (ii) assist You to comply with Your Controller obligations under Applicable Data Protection Law relevant to Your use of the Website and advertising displays and services, including assistance with notifying Personal Data breaches as set forth in Section 11, and Data Subject requests as set forth in Section 6.
To the extent required by Applicable Data Protection Law, MilkMoney will immediately inform You if, in its opinion, Your instruction infringes Applicable Data Protection Law. You acknowledge and agree that MilkMoney is not responsible for performing legal research and/or for providing legal advice to You.
Without prejudice to MilkMoney’s obligations under this Section 5, the parties will negotiate in good faith with respect to any charges or fees that may be incurred by MilkMoney to comply with instructions with regard to the Processing of Personal Data that require the use of resources different from or in addition to those required for the provision of the advertising displays and services.
Rights of Data Subjects
MilkMoney will grant You the right to enable You to respond to requests from Data Subjects to exercise their rights under Applicable Data Protection Law to “opt out”, including requests to access, delete or erase, restrict, rectify, receive and transmit, block access to or object to Processing of specific Personal Data or sets of Personal Data.
Please contact MilkMoney for information on how You can comply with Data Subjects “opt out” requests regarding their Personal Data. You can submit a “service request” via email at support@MilkMoney.com to provide detailed written instructions to MilkMoney, including the Personal Data necessary to identify the Data Subject, on how to assist with such Data Subject requests in relation to Personal Data held in our cloud services environment. MilkMoney will promptly follow such instructions. If applicable, the parties will negotiate in good faith with respect to any charges or fees that may be incurred by MilkMoney to comply with instructions that require the use of resources different from or in addition to those required for the provision of the advertising displays and services.
If MilkMoney directly receives any Data Subject requests regarding Personal Data, it will promptly pass on such requests to You without responding to the Data Subject if the Data Subject identifies You as the Data Controller. If the Data Subject does not identify You, MilkMoney will instruct the Data Subject to contact the entity responsible for collecting their Personal Data.
Personal Data Transfers
Personal Data held in our cloud services environment will be hosted in the United States. MilkMoney will not migrate our cloud services environment to a different data center region without Your prior written authorization.
Without prejudice to Section 7.1, MilkMoney may access and Process Personal Data on a global basis as necessary to provide the advertising displays and services under the agreements entered into with MilkMoney and the Website, including for IT security purposes, maintenance and related infrastructure, technical support and change management.
To the extent such global access involves a transfer of Personal Data originating from the European Economic Area (“EEA”) or Switzerland to MilkMoney Affiliates or Third-Party Sub-processors located in countries outside the EEA or Switzerland that have not received a binding adequacy decision by the European Commission or by a competent national EEA data protection authority, such transfers are subject to EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework.
MilkMoney Affiliates and Third-Party Sub-processors
Subject to the terms and restrictions specified in Sections 3.3, 7 and 7.3, You agree that MilkMoney may engage MilkMoney Affiliates and Third-Party Sub-processors to assist in furnishing advertising displays and services under the agreements entered into with MilkMoney and the Website.
Within fourteen (14) calendar days of MilkMoney providing such notice to You, You may object to the intended involvement of a Third Party Sub-processor or MilkMoney Affiliate providing objective justifiable grounds related to the ability of such Third Party Sub-processor or MilkMoney Affiliate to adequately protect Personal Data in accordance with Applicable Data Protection Law in writing by submitting a “service request” via email at support@MilkMoney.com. In the event Your objection is justified, You and MilkMoney will work together in good faith to find a mutually acceptable resolution to address such objection, including but not limited to reviewing additional documentation supporting the Third-Party Sub-processors’ or MilkMoney Affiliate’s compliance with this GDPR Addendum and Applicable Data Protection Law, or delivering products and services contemplated without the involvement of such Third-Party Sub-processor. To the extent You and MilkMoney do not reach a mutually acceptable resolution within a reasonable timeframe, You shall have the right to terminate the relevant services (i) upon serving prior notice in accordance with the terms of the agreements entered into with MilkMoney; (ii) without liability to You and MilkMoney and (iii) without relieving You from Your payment obligations under the agreements entered into with MilkMoney up to the date of termination.
The MilkMoney Affiliates and Third-Party Sub-processors are required to abide by the same level of data protection and security as MilkMoney under this GDPR Addendum as applicable to their Processing of Personal Data. You may request that MilkMoney audit a Third-Party Sub-processor or provide confirmation that such an audit has occurred (or, where available, obtain or assist customer in obtaining a third-party audit report concerning the Third-Party Sub-processor’s operations) to verify compliance with such obligations. You will also be entitled, upon written request, to receive copies of the relevant privacy and security terms of MilkMoney’s agreement with any Third-Party Sub-processors and MilkMoney Affiliates that may Process Personal Data.
MilkMoney remains responsible at all times for the performance of the MilkMoney Affiliates’ and Third-Party Sub-processors’ obligations in compliance with the terms of this GDPR Addendum and Applicable Data Protection Law.
Technical and Organizational Measures, and Confidentiality of Processing
MilkMoney has implemented and will maintain appropriate technical and organizational security measures for the Processing of Personal Data. These measures take into account the nature, scope and purposes of Processing as specified in this GDPR Addendum, and are intended to protect Personal Data against the risks inherent to the Processing of Personal Data in the performance of the obligations set forth in the Outdoor Advertising Agreement, in particular risks from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored or otherwise Processed.
In particular, MilkMoney has implemented the physical access, system access, data access, transmission and encryption, input, data backup, data segregation and security oversight, enforcement and other security controls and measures specified in the Privacy Policy. You are advised to carefully review the Privacy Policy to understand which specific security measures and practices apply to You, and to ensure that these measures and practices are appropriate for the Processing of Personal Data pursuant to this GDPR Addendum.
All MilkMoney and MilkMoney Affiliate staff, as well as any Third-Party Sub-processors that may have access to Personal Data are subject to appropriate confidentiality arrangements.
Audit Rights and Cooperation with You and Your Supervisory Authorities
You may audit MilkMoney’s compliance with its obligations under this GDPR Addendum up to once per year. In addition, to the extent required by Applicable Data Protection Law, including where mandated by Your Supervisory Authority, You or Your Supervisory Authority may perform more frequent audits, including inspections of the Cloud Service data center facility that Processes Personal Data. MilkMoney will contribute to such audits by providing You or Your Supervisory Authority with the information and assistance reasonably necessary to conduct the audit, including any relevant records of Processing activities applicable to the Outdoor Advertising Agreement ordered by You.
If a third party is to conduct the audit, the third party must be mutually agreed to by You and MilkMoney (except if such Third Party is a competent Supervisory Authority). MilkMoney will not unreasonably withhold its consent to a third-party auditor requested by You. The third party must execute a written confidentiality agreement acceptable to MilkMoney or otherwise be bound by a statutory confidentiality obligation before conducting the audit.
To request an audit, You must submit a detailed proposed audit plan to MilkMoney at least two weeks in advance of the proposed audit date. The proposed audit plan must describe the proposed scope, duration, and start date of the audit. MilkMoney will review the proposed audit plan and provide You with any concerns or questions (for example, any request for information that could compromise MilkMoney security, privacy, employment or other relevant policies). MilkMoney will work cooperatively with You to agree on a final audit plan.
If the requested audit scope is addressed in a SSAE 16/ISAE 3402 Type 2, ISO, NIST, PCI DSS, HIPAA or similar audit report issued by a qualified third party auditor within the prior twelve months and MilkMoney provides such report to You confirming there are no known material changes in the controls audited, You agree to accept the findings presented in the third party audit report in lieu of requesting an audit of the same controls covered by the report.
The audit must be conducted during regular business hours at the applicable facility, subject to the agreed final audit plan and MilkMoney’s health and safety or other relevant policies, and may not unreasonably interfere with MilkMoney business activities.
You will provide MilkMoney any audit reports generated in connection with any audit under this Section 10, unless prohibited by Applicable Data Protection Law or otherwise instructed by a Supervisory Authority. You may use the audit reports only for the purposes of meeting Your regulatory audit requirements and/or confirming compliance with the requirements of this GDPR Addendum. The audit reports shall be and shall remain the Confidential Information of the parties under the terms of the Outdoor Advertising Agreement.
All audits are at Your expense. The parties will negotiate in good faith with respect to any charges or fees that may be incurred by MilkMoney to provide assistance with an audit that requires the use of resources different from or in addition to those required for the provision of advertising displays and services associated with the Outdoor Advertising Agreement.
Incident Management and Personal Data Breach Notification
MilkMoney promptly evaluates and responds to incidents that create suspicion of or indicate unauthorized access to or Processing of Personal Data (“Incident”). All MilkMoney and MilkMoney Affiliates staff that have access to or Process Personal Data are instructed on responding to Incidents, including prompt internal reporting, escalation procedures, and chain of custody practices to secure relevant evidence. MilkMoney’s agreements with Third Party Sub-processors contain similar Incident reporting obligations.
In order to address an Incident, MilkMoney defines escalation paths and response teams involving internal functions such as Information Security and Legal. The goal of MilkMoney’s Incident response will be to restore the confidentiality, integrity, and availability of Your cloud services environment and the Personal Data that may be contained therein, and to establish root causes and remediation steps. Depending on the nature and scope of the Incident, MilkMoney may also involve and work with You and outside law enforcement to respond to the Incident.
To the extent MilkMoney becomes aware and determines that an Incident qualifies as a breach of security leading to the misappropriation or accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed on MilkMoney systems or cloud services environment that compromises the security, confidentiality or integrity of such Personal Data (“Personal Data Breach”), MilkMoney will inform You of such Personal Data Breach without undue delay but at the latest within 24 hours.
MilkMoney will take reasonable measures designed to identify the root cause(s) of the Personal Data Breach, mitigate any possible adverse effects and prevent a recurrence. As information regarding the Personal Data Breach is collected or otherwise reasonably becomes available to MilkMoney and to the extent permitted by law, MilkMoney will provide You with (i) a description of the nature and reasonably anticipated consequences of the Personal Data Breach; (ii) the measures taken to mitigate any possible adverse effects and prevent a recurrence; (iii) where possible, the categories of Personal Data and Data Subjects including an approximate number of Personal Data records and Data Subjects that were the subject of the Personal Data Breach; and (iv) other information concerning the Personal Data Breach reasonably known or available to MilkMoney that You may be required to disclose to a Supervisory Authority or affected Data Subject(s).
Unless otherwise required under Applicable Data Protection Law, the parties agree to coordinate in good faith on developing the content of any related public statements or any required notices for the affected Data Subjects and/or notices to the relevant Supervisory Authorities.
Return and Deletion of Personal Data upon Termination of the Outdoor Advertising Agreement.
12.1. Following termination of the services covered by the Outdoor Advertising Agreement, MilkMoney will return or otherwise make available for retrieval Your Personal Data then available in Your cloud services environment, unless otherwise expressly stated in the Outdoor Advertising Agreement. For cloud services for which no data retrieval functionality is provided by MilkMoney as part of the Outdoor Advertising Agreement, You are advised to take appropriate action to back up or otherwise store separately any Personal Data while the cloud services environment is still active prior to termination.
12.2. Upon termination of the advertising display and services covered by the Outdoor Advertising Agreement or upon expiry of the retrieval period following termination of the advertising display and services covered (if available), MilkMoney will promptly delete all copies of Personal Data from Your cloud services environment by rendering such Personal Data unrecoverable, except as may be required by law. MilkMoney’s data deletion practices are described in more detail in the Privacy Policy.
Legally Required Disclosure Requests
13.1. If MilkMoney receives any subpoena, judicial, administrative or arbitral order of an executive or administrative agency, regulatory agency, or other governmental authority which relates to the Processing of Personal Data (“Disclosure Request”), it will promptly pass on such Disclosure Request to You without responding to it, unless otherwise required by applicable law (including to provide an acknowledgement of receipt to the authority that made the Disclosure Request).
13.2. At Your request, MilkMoney will provide You with reasonable information in its possession that may be responsive to the Disclosure Request and any assistance reasonably required for You to respond to the Disclosure Request in a timely manner.
Contact
14.1. If you have any questions or concerns regarding the terms and conditions set forth in this GDPR Addendum, you may write to us at support@MilkMoney.com.