Houzz Pro Terms and Conditions
Effective as of 31st January, 2023.
Houzz Pro provides home industry professionals with a business management and marketing SaaS solution that helps them to win projects, collaborate with clients and teams, and run their business efficiently and profitably.
WE ENCOURAGE YOU TO REVIEW THESE TERMS CAREFULLY. THESE TERMS PROVIDE IMPORTANT INFORMATION TO YOU. BY ACCEPTING THESE TERMS YOU AGREE TO RESOLVE ANY DISPUTES BY INDIVIDUAL ARBITRATION, WHICH MEANS THAT YOU WAIVE ANY RIGHT TO HAVE THOSE DISPUTES DECIDED BY A JUDGE OR JURY, AND THAT YOU WAIVE YOUR RIGHT TO PARTICIPATE IN CLASS ACTIONS, CLASS ARBITRATIONS, OR ANY TYPE OF REPRESENTATIVE ACTIONS. ACCEPTANCE OF THESE TERMS ALSO MEANS THAT YOU AGREE TO GRANT US RIGHTS TO YOUR CONTENT, OUR LIMITATION OF LIABILITY TO YOU AND, IF YOU CHOOSE TO PROVIDE US WITH YOUR PHONE NUMBER, YOU AGREE TO RECEIVE CALLS AND TEXT MESSAGES FROM US IN ACCORDANCE WITH APPLICABLE LAW.
THESE TERMS ALSO COVER YOUR AGREEMENT TO MAKE FUTURE RECURRING PAYMENTS FOR CERTAIN PRO PLATFORM PURCHASES THAT MAY AUTOMATICALLY RENEW.
By accessing or using the Pro Platform in any way, you are agreeing to these Terms in their entirety. If you do not agree with any portion of the Terms, you may not use the Pro Platform. You agree that these Terms are enforceable like any other written agreement signed by you.
1. Changes To The Terms
We may revise these Terms from time to time, including any linked or referenced documents. The most current version of these Terms will govern your use of the Pro Platform. If we make material changes to these Terms, we will notify you by email or by posting a notice on the Pro Platform or by other means, to offer you an opportunity to review the changes before they become effective. If you do not agree to the revised Terms, you should stop accessing or using the Pro Platform. By continuing to access or use the Pro Platform after those changes become effective, you are subject to the new Terms.
2. Pro Platform
The Pro Platform consists of the Houzz Pro website, Houzz Pro mobile applications, as well as all other related products, software, services, programs, and networks, like our advertising or website services (collectively referred to as the “Pro Platform”).
- Advertising Services. “Advertising Services” means any advertising and marketing services provided through the Pro Platform, which may include premium features, sponsored ad placements, receiving leads from “Project Match”, “Select Match” , “Additional Leads Pool,” or similar features. If you purchased Advertising Services and you do not meet our minimum standards within 90 days of purchase, Houzz may forfeit your right to receive the Advertising Services and Houzz will have no further obligation to deliver the Advertising Services. Our Advertising Services enable Houzz to target “Ad Content”. Ad Content means advertising materials generated by or on behalf of Houzz using Your Content (defined below) often placed in standard templates for publication on the Pro Platform) to users oftentimes designated by you in designated regions (or sub-metros). Houzz in its reasonable discretion may determine if sponsored or promotional content is Ad Content if it is not reasonably clear from the context. Houzz may provide you with an estimate of how many impressions, clicks, or contacts, or how much market share you will receive. However, Houzz cannot guarantee these estimates, that Ad Content will always reach the designated audience, or that leads will contact you. You understand that users, automated computers, third parties and Houzz personnel may generate impressions, clicks or leads, and Houzz cannot guarantee that those impressions, clicks or leads reflect genuine interest. Houzz also cannot guarantee that the impressions, clicks or contacts will be uniformly distributed. Your exposure may change over time and Houzz does not guarantee that your revenue or profits will increase using Advertising Services or the Pro Platform.
- Website Services. “Website Services” means any website displaying Your Content (defined below) and other content provided by or on behalf of you into standard Houzz web templates with hosting managed by Houzz. If you have transferred your non-Houzz website domain to Houzz or requested Houzz to purchase a non-Houzz website domain ("Non-Houzz URL"), Houzz may renew the registration for the Non-Houzz URL as part of the Website Services. For clarity, Houzz does not make any representations or warranties regarding whether the website domain or content infringes the trademark or copyright of third parties. If you would like Houzz to transfer the Non-Houzz URL back to you, please send a written request to pronotices_UK@houzz.com and follow the instructions provided for Houzz to complete the transfer. If you cease to order Website Services, infringe on third party copy or trademarks, have payment amounts past due to Houzz, or these Terms are terminated, Houzz may immediately cease providing Website Services.
- Email Services. “Email Services” means tools that enable you to send emails and implement email marketing. Email Services may involve Third-Party Services (defined below). Email Services may not be used for the preparation or distribution of junk mail, spam, chain letters, pyramid schemes, or other deceptive or unsolicited bulk commercial email, or violate in any way the CAN-SPAM Act of 2003 or equivalent, or similar applicable law, or send emails implying they are being sent on behalf of Houzz. You agree that you have consent to send any email communication you send through the Houzz Email Services and will not violate any of the restrictions listed above. If you cease to order Email Services, have payment amounts past due to Houzz or these Terms are terminated, Houzz may immediately cease providing Email Services.
- Call Tracking. “Call Tracking” is a marketing service that allows you to track calls through the Pro Platform. Call Tracking or some of its features are not available in all locations. If you use the Call Tracking feature, Houzz will mask your phone number and may record information about the call, including the caller, time, and duration. In regions where Call Tracking is available, Call Tracking will automatically be enabled, unless you opt to disable this feature by notifying Houzz in writing at pronotices_UK@houzz.com at least 48 hours before the feature goes live. Thereafter, you can disable call tracking at any time by going to your Pro Account settings.
- Pro Spotlight. “Pro Spotlight” is a story about you considered to be Houzz Content, written by the Houzz Pro Spotlight team, that is available on your Pro Profile (defined below) and that may also be displayed publicly. “Pro Profile” refers to your professional public profile on the Pro Platform. If you purchase or receive a Pro Spotlight, you may be required to complete a questionnaire, interview, and/or provide Your Content for use in creating the Pro Spotlight. While you will have input, Houzz will have final editorial control over the content of the Pro Spotlight. Placement and designation of the Pro Spotlight will be determined by Houzz and may change from time to time. Houzz does not guarantee a particular number of Pro Spotlight views, impressions, clicks, or leads.
- Photography Services. “Photography Services” means professional photography of your project taken by a Houzz photographer or a third party photographer (“Outside Photographer”) during a period of time (“Photoshoot”) to make photos of your project (“Photos”) available to you. You understand and agree that you must redeem your Photoshoot within the then-current Term (defined below) in which the Photoshoot was purchased or received. If you do not redeem your Photoshoot within the applicable Term, then except as otherwise agreed in writing by Houzz, you will forfeit your right to receive the Photoshoot and Houzz will have no further obligation to deliver Photos or reimburse you for any Photoshoot. To the extent permitted by applicable law, any amounts paid for a Photoshoot are non-refundable. Furthermore, a photoshoot will only be made available to you if you have no payment amounts past due to Houzz. You understand and agree that to the extent you provide any Personal Data (defined below) to Houzz of homeowners or other individuals (for example, to schedule a Photoshoot), you represent and warrant that you have all rights and permissions necessary to provide such information to Houzz. Subject to your compliance with these Terms and any applicable Agreement (defined below), including without limitation any payment obligations and subject to the assignment to Houzz by such Outside Photographer, Houzz will assign those rights received from Outside Photographers in all Photos. You acknowledge and agree that Houzz may upload your Photos to your Pro Profile. If your Photos are uploaded or submitted to the Pro Platform by you or on your behalf (including by Houzz or by an Outside Photographer), you grant Houzz a worldwide, perpetual, irrevocable, royalty-free, fully paid up, transferable, and fully sub-licensable (through multiple tiers of sublicensees) licence to reproduce, process, distribute, transmit, modify, publish, adapt, create derivative works of, publicly display and publicly perform and fully exploit such Photos in accordance with these Terms. You are responsible for obtaining all rights and clearances necessary for the Photos prior to the Photoshoot. In connection with the Photography Services, you irrevocably grant to Houzz or the Outside Photographer, as applicable, the right and permission to photograph, film, or otherwise record your name, voice, and likeness, as well as any home, business, real estate or personal property that you make accessible to Houzz. You also represent and warrant that you have all permissions and releases necessary to photograph at the designated location(s) or otherwise appearing in the Photos and any persons, objects, goods, and products appearing in the Photos. If a Photoshoot is cancelled or rescheduled a fee may be charged in accordance with these Terms or an Agreement.
- Professional Documents. The Pro Platform may allow you to create renderings, mood boards, floor plans, estimates, proposals, invoices, change orders, contracts, and other similar business documents (collectively “Pro Documents”). These Pro Documents can be made available for review and signature (including e-signature) to your suppliers, sub-contractors, customers, clients, potential clients, leads or similar individuals or businesses (collectively “Clients”). You are responsible for any Pro Documents and delivering to your Clients any services or materials purchased on their behalf.
- Payment Processing Services. Houzz may provide tools that enable Clients to transact with Professionals (“Payment Processing Services”). As a condition of our enabling Payment Processing Services, you represent and warrant that the information you provide to us in connection with transactions made on the Pro Platform (“Payment Information”) is accurate and complete at all times. Furthermore, you represent and warrant that your use of the Pro Platform does not violate any applicable laws or terms to which you are subject. You agree that you are responsible for paying for all purchases made on behalf of your Clients. To the extent that you receive payment from Clients through the Pro Platform, payments will be disbursed to you according to certain schedules. Please note that any payments or transactions between you and a Client made via the Pro Platform are facilitated through a third-party payment processor whose terms will apply. Clients might be enabled to pay your payable documents like estimates, invoices, and change orders online. You can opt out of receiving online payments anytime by going to your Online Payments Settings.
- Payment Information. Payment Information and other sensitive financial information may not be shared or sent using the Pro Platform except via the dedicated methods specifically made available by Houzz for those purposes. You agree that you are authorised to share Payment Information and other information about you, your business, and your transactions with us and our third party payment processors. Please see the Third Party Services (below) for more details. If you believe that any data related to Payment Processing Services was accessed or disclosed without permission you agree to promptly notify Houzz.
- Disputes and Repayment Risks. If you are involved in a credit card dispute involving a payment made through or in connection with the Pro Platform, such as a chargeback, you agree to provide us and our third-party payment processor with all information relevant to the dispute. If any funds are withdrawn from Pro Accounts as a result of the dispute or chargeback, you agree to reimburse us within 48-hours of the date the dispute was initiated. To the maximum extent permitted by applicable law, Houzz may obtain reimbursement of any amounts owed to us by instructing our payment processor to deduct such amounts from your payment method(s), deduct amounts from any of your stored payment methods, deduct amounts from future payments owed to you, or by reversing any credits to your Pro Account balance, or through any other lawful means, including by using third-party collections services. You authorise Houzz to use any or all of the foregoing methods to seek reimbursement. It is Houzz's business practice to identify and investigate disputed transactions, suspected fraud, and transactions with repayment risk. Houzz reserves the right to withhold disbursements until Houzz completes investigations of disputed or risky transactions.
- Refunds. If you agree to refund a Client any fees, you are responsible for and will pay us (and we may retain) any transaction costs associated with such refund.
- Fees. There may be fees and surcharges related to the Payment Processing Services. Payment processing fees shall be deducted automatically from payments made to you via the Pro Platform.
- Trade Programme. Any participation in our Houzz Trade Programme and Business Programme is subject to the Houzz Trade Programme and Business Trade Programme Terms and Conditions.
- Service Availability. Not all Pro Platform services or features are available on all plans, in all regions, or on all devices. While Houzz may provide prior notice where practicable, you acknowledge and agree that any and all of the services and features available on the Pro Platform may be modified, updated, interrupted, suspended or discontinued at any time without notice or liability. Houzz may also provide you with certain services or features for a limited, promotional, or trial period only.
- Third Party Services. Certain aspects of the Pro Platform may integrate with products or services provided by third parties (“Third-Party Services”). Houzz does not operate, control, approve of, or endorse any of the Third-Party Services, including their security, availability, or accuracy. Your use of Third-Party Services may be subject to the terms and policies of those third parties. It is your responsibility to familiarise yourself and comply with any applicable third-party terms. Houzz is not responsible for any Third-Party Services. Your use and reliance on any Third-Party Service is at your own risk.
- Electronic Signature Services. Houzz may provide you with services that enable you or your Clients to sign documents electronically (“E-Sign Services”). The requirements for a valid, legally enforceable electronic signature differ based on the jurisdiction. Houzz will not be liable or responsible for the document or for any losses incurred due to an unenforceable electronic signature. You are solely responsible for your communications and interactions and any damages incurred by using any of our E-Sign Services.
- Visual Tools. Houzz may provide a wide variety of “Visual Tools” or software features that help you graphically or digitally represent ideas, conceptual relationships, or drawings. Some of these Visual Tools include: 3D Ruler Tool, Mood Boards, Room Planner, 3D Floor Planner, dimensional information, and Room Scanning or other LiDAR technologies. Keep in mind that the Visual Tools are intended only to assist you and are not a substitute for your professional judgement, independent design, analysis, simulation, estimation, testing or other activities, including those with respect to safety and utility. Houzz will not be responsible or liable in any manner whatsoever for use of the Visual Tools, including the accuracy of measurements or any personal injury or damage to property. To reduce the risk of injury, only use the tools as intended, in a safe and controlled manner. Always be aware of your surroundings before beginning use and while using the Visual Tools. Use caution to avoid injury. Serious injuries can occur from tripping or striking walls, furniture, other objects or people. Houzz recommends clearing an area for safe use before using the Visual Tools. Remember that the objects you see in the virtual environment do not exist in the real world, and you should not attempt to sit or stand on them or use them for support. Take special care to ensure that you are not near other people, objects, stairs or steps, ramps, sidewalk(s), balconies, open doorways, windows, furniture, open flames (like candles or fireplaces), ceiling fans or light fixtures, televisions or monitors, or other items that you may impact or strike when using – or immediately after using – the Visual Tools. Remember that while using the Visual Tools you may be unaware that people and pets may enter your immediate area. Never use the Visual Tools in situations that require attention, such as walking, bicycling, or driving.
3. Professional Responsibilities
- Cooperation. You agree to cooperate promptly and reasonably with requests by Houzz related to our Pro Platform. You recognise that some of the Pro Platform services cannot be provided without your complete cooperation (e.g., for Website Services or Pro Spotlight) and in those instances you agree to provide Houzz with all of the content necessary for us to provide the Pro Platform services to you. If you do not provide us with the necessary content then we may not be able to provide you with the applicable service.
- Pro Account. You must create a Pro Account and provide certain information about yourself in order to use and access the Pro Platform. A “Pro Account” is the digital platform that provides you (and others) access to the Pro Platform. You are required to provide accurate Pro Account information including the professional category you select (such as “architect” or “general contractor”). You are solely responsible for the professional category you select. If the category requires a specific licence or other requirements to be met you cannot select that category without having that licence or without meeting those requirements. Houzz does not verify your professional category. You are responsible for maintaining the confidentiality and security of any Pro Account username(s) or password(s). You agree to notify us immediately of any unauthorised use of your Pro Account or Pro Platform. In some instances, access to your Pro Account may be limited. Houzz reserves the right to monitor Pro Account access and block access to anyone that exceeds the allowable number of persons authorised to access the Pro Account or close the Pro Account in its entirety. If your Pro Account is accessed by a number of persons that exceeds the number of persons allowed to access your Pro Account, Houzz reserves the right to charge you for those persons either by automatically charging you or changing your plan to a plan that corresponds to the amount of persons that you have accessing your Pro Account. The number of people allowed to access your Pro Account can be found in at least one of several ways: (i) your plan Agreement, (ii) your Pro Account, or (iii) on our Prices and Plans webpage.
- User Data. You may have access to or receive data through the Pro Platform pertaining to Clients or anyone else (referred to collectively as "User Data"). You may use the User Data only for the intended purpose for which it was provided (i.e. to respond to the applicable person in a timely manner or as otherwise authorised) in accordance with these Terms, and all applicable data protection laws. You may share such User Data only to the extent authorised by the person to which such data relates provided that you are and remain responsible for ensuring compliance with this provision and all applicable laws. Without limiting the foregoing, you shall not sell User Data. You shall protect the confidentiality of User Data and use appropriate security safeguards to protect User Data against unauthorised or unlawful processing and against accidental loss, destruction, alteration, disclosure of or access to User Data. You will honour requests by individuals exercising their rights under applicable law (e.g. with respect to not contacting the individual further, withdrawing their consent, data deletion or data access etc.). If you receive any privacy enquiry or complaint from an individual, regulator or other party related to the use of User Data, you will promptly inform Houzz of such enquiry or complaint and will cooperate reasonably and in good faith to respond to such enquiry or complaint. If Houzz makes User Data available to you, for example, in the form of leads from our "Project Match" tool, “Additional Leads Pool” or similar features, Houzz has informed the individuals to which such User Data relates that their information will be provided to you for such purposes.
- Communications with Clients. All communications taking place via the Pro Platform must comply with applicable laws including all opt-out and unsubscribe requests. If Clients don’t affirmatively respond to or are not otherwise receptive to your communications, you agree that you will cease communicating to such Clients. You agree to obtain proper legal consent before sending any communications to anyone. If Houzz shares contact information with you and then asks you not to use that contact information anymore for legal reasons, you may not contact that Client. You understand and agree that you are the sender of, and responsible for, any of your communications sent via the Pro Platform, and Houzz is not the sender of your communications.
- User Disputes. You agree that you are solely responsible for your Communications with Clients or Pro Documents. Houzz has no liability or responsibility in connection with such interactions or documents. We reserve the right, but have no obligation to become involved in any complaints, disputes, or disagreements between you and any other user of the Pro Platform or your Clients.
- Reviews. You understand and acknowledge that others may post content about your business on the Pro Platform, including ratings and reviews. You agree that you will not, or will not assist, incentivise, encourage, or enable others to post any fake or defamatory reviews, post on behalf of a Client or other party, trade reviews with other users or Clients, or compensate someone or be compensated to post, refrain from posting, or attempt to remove a review, or post a review that violates the Houzz Review Policy. You understand and acknowledge that Houzz may employ automated software in an effort to showcase the most reliable and useful reviews while displaying other reviews less prominently. You understand and acknowledge that while Houzz tries to identify and suppress potentially less helpful reviews, Houzz may sometimes suppress legitimate reviews or fail to detect illegitimate reviews. You understand and acknowledge that any purchase of any paid services from Houzz will not allow or enable you, directly or indirectly, to alter reviews or impact whether reviews appear.
- Partnership Programmes. If you earn money, reimbursements, credits, or discounts from supporting manufacturers on the Pro Platform (known as being part of a “Dealer Programme”) you are solely responsible for ensuring your eligibility directly with the supporting manufacturer. Houzz is not responsible for ensuring you are properly compensated.
4. Billing and Payment
- Amounts Due. You agree to pay for anything you purchase on the Pro Platform. If you purchase a Houzz Pro plan, you may enter into an additional Agreement entitled the Pro Services Agreement, which includes details about the cost and duration of the plan you purchased. You agree that your purchase may be subject to additional fees or surcharges including but not limited to: recurring fees, usage-based fees, transaction fees deducted automatically, one-time fees, Pro Account set-up fees, and surcharges for using a payment card.
- Promotions, Discounts, and Free-Trials. For clarity, unless otherwise expressly provided, any promotion or discount will only apply during the Initial Term for which the promotion or discount is applicable. Unless otherwise expressly provided, the “Initial Term” is a 12-month period beginning on the date you start paying for a plan. Free Trials will only be provided for the length of time listed in the promotional materials (e.g., 14 or 30 days). Free Trials are only available for new customers who are signing-up for Houzz Pro for the first time. Any free services provided in conjunction with a paid service will be provided only so long as you do not have payment amounts past due to Houzz.
- Non-Refundable. To the maximum extent permitted by applicable law, all amounts payable to Houzz are non-refundable unless expressly provided otherwise. Houzz may set off amounts payable by Houzz to you against amounts payable by you to Houzz.
- Recurring Billing. IF YOU PAID FOR A HOUZZ PRO PLAN YOUR PLAN WILL RENEW AUTOMATICALLY WITHOUT ADDITIONAL NOTICE FOR SUCCESSIVE 12-MONTH TERMS (EACH, A "RENEWAL TERM”) UNLESS YOU PROVIDE A NOTICE OF NON-RENEWAL AT LEAST 30 DAYS BEFORE THE EXPIRATION OF THE THEN-CURRENT INITIAL TERM OR RENEWAL TERM BY EMAILING PRONOTICES_UK@HOUZZ.COM.
- Price Increase. HOUZZ RESERVES THE RIGHT TO INCREASE PRICES FROM TIME TO TIME. IN THE EVENT OF A PRICE INCREASE, HOUZZ SHALL PROVIDE YOU WITH WRITTEN NOTICE AT LEAST FORTY-FIVE (45) DAYS PRIOR TO THE INCREASE VIA THE EMAIL ADDRESS ASSOCIATED WITH YOUR PRO ACCOUNT. SUCH CHANGE SHALL NOT REQUIRE ANY ADDITIONAL APPROVAL BY YOU AND WILL GO INTO EFFECT AS LISTED ON THE NOTICE. IF YOU DO NOT ACCEPT THE PRICE INCREASE YOU MUST CANCEL AND CEASE ACCESSING THE PRO PLATFORM BEFORE THE END OF YOUR THEN-CURRENT TERM. CONTINUED USE OF THE PRO PLATFORM AFTER THAT TIME WILL BE TAKEN AS ACCEPTANCE OF THE INCREASED PRICE.
- Late Fees. If we are unable to collect any amounts owed by you, we may limit your use of the Pro Platform. We may collect those amounts owed using any legal manner without prejudice to any other right or remedy we may be entitled to under these Terms or by law. In the event that Houzz brings any action or suit to collect any amounts owed, Houzz will be entitled to recover its costs, including reasonable attorneys' fees incurred in such collection. Any amounts past due will be subject to a late fee of the lesser of 1.5% per month or the maximum amount permitted by law. In the event that these Terms or any Agreement is breached due to non-payment, and then you subsequently pay the amounts due, these Terms and any Agreement(s) shall be automatically reinstated unless Houzz informs you otherwise.
- Taxes. You are responsible for paying all taxes, excluding only taxes based on Houzz's net income. If Houzz has the legal obligation to pay or collect taxes for which you are responsible, the appropriate amount shall be invoiced to and paid by you, unless you provide Houzz with a valid tax exemption certificate authorised by the appropriate taxing authority. Houzz may begin invoicing and charging such taxes to you at any time, which amount may vary based on changes to the tax rate or applicability. Your invoice will reflect the final total taxes in effect at the time of invoicing and for this reason may differ from other amounts listed. Houzz may issue a 1099-K form to certain U.S. Pros to comply with IRS and applicable state requirements. You may opt in to receive your 1099-K form electronically.
- Outstanding Balances. For any amounts owed by you to Houzz, including for any chargebacks from Clients, refunds, or other amounts (collectively, "Outstanding Balances"), Houzz may (a) charge your credit card in the amount of any Outstanding Balances, (b) submit an invoice to you for any Outstanding Balances, or (c) collect payment or reimbursement for any Outstanding Balances from you by any other lawful means. You authorise Houzz to use any or all of these methods to recover any Outstanding Balances.
5. Term and Termination
- Term. These Terms will continue to apply for any of your use or access of the Pro Platform. If you entered into another Agreement with Houzz, that other Agreement may include other details about terms for particular services. For example, if you paid for a Houzz Pro plan, it likely commences on the Effective Date (defined in the Agreement you received) and will continue for twelve months from the Effective Date. Thereafter the term would automatically renew without additional notice for successive 12-month terms (Renewal Terms) unless you provide notice of cancellation at least 30 days before the expiration of the then-current Initial or Renewal Term.
- Termination by Professional. If you only have a free Pro Account you may terminate your agreement to these Terms by ceasing to access or use the Pro Platform, however certain provisions of the Terms will survive termination, as detailed below. If you entered into another Agreement with Houzz, that other Agreement may include additional details about termination for that particular service. For example, if you paid for a Houzz Pro plan and wish to terminate that paid plan, your Agreement likely requires you to email Houzz at pronotices_UK@houzz.com and follow the instructions provided by Houzz in order for Houzz to process the termination.
- Termination by Houzz. In the event of your material breach of these Terms, Houzz may immediately terminate these Terms and any applicable Agreements between you and Houzz by providing written notice to you. If Houzz terminates these Terms for your material breach, Houzz has no obligation to refund any amounts to you and you shall immediately pay any additional amounts due to Houzz. These Terms may also be terminated by Houzz for any reason by providing you 30 days prior written notice. In such a case, Houzz will promptly refund you any prepaid amounts, on a pro rata basis, for services not delivered.
- Effect of Termination. In the event of any termination of these Terms, whether by you or us, those sections that by their nature are intended to survive termination or expiration of this Agreement shall so survive in full force and effect including but not limited to sections 2(h), 3(b), 3(d), 3(e), 4, 5(d), and 6-19. Furthermore, at Houzz's discretion, Your Content may continue to be published provided, however, upon your written request, Houzz will not attribute Your Content to you by name or contact information. Houzz may, but is under no obligation to keep any data collected from you. If Houzz provides a copy to any data, Houzz reserves the right to charge a fee for such requests, as permitted by applicable law. Houzz retains the licence to Your Content described in Section 6 after termination.
6. Intellectual Property and Proprietary Rights
- Your Content. Professional, or your licensors, as applicable, retain ownership of Your Content, subject to the following licence granted to Houzz. Professional hereby grants to us and our affiliates, licensees and sublicensees, without compensation to you or others, a non-exclusive, perpetual, irrevocable, royalty-free, fully paid-up, worldwide licence (including the right to sublicense through multiple tiers) to use, reproduce, process, adapt, publicly perform, publicly display, modify, prepare derivative works, publish, transmit and distribute Your Content, or any portion thereof, throughout the world in any format, media or distribution method (whether now known or hereafter created) for the duration of any copyright or other rights in Your Content. Such permission will be perpetual and may not be revoked for any reason, including in the event of termination of any applicable Houzz program or service, to the maximum extent permitted by law. Further, to the extent permitted under applicable law, you waive and release and covenant not to assert any moral rights that you may have in Your Content. If you identify yourself by name or provide a picture or audio or video recording of yourself, you further authorise us and our affiliates, licensees and sublicensees, without compensation to you or others, to reproduce, print, publish and disseminate in any format or media (whether now known or hereafter created) your name, voice and likeness throughout the world, and such permission will be perpetual and cannot be revoked for any reason, except as required by applicable law. You further agree that we may use Your Content in any manner that we deem appropriate or necessary. For clarity, Houzz will not make your proposals, invoices, to-do lists, schedules, change orders, or time and expense tracking, publicly available except at your direction.
- Houzz Content and Houzz Materials. Houzz retains all rights, title and interest in and to the Pro Platform, Houzz technology, and any content and information created or made available by Houzz (together “Houzz Content”). Except for the express licences set forth in these Terms, there are no other licences granted to you, express, implied or by way of estoppel. All rights not granted in these Terms are reserved by Houzz.
- Professional Restrictions. You may not use Houzz Content, Pro Spotlight, Ad Content or other Houzz created content outside of the Pro Platform. You will not decompile, reverse engineer, disassemble or otherwise attempt to derive the source code for the Pro Platform and will not use the Pro Platform in a manner that is not expressly allowed under these Terms.
- Press Releases; Use of Houzz Marks. Without Houzz's prior written consent, you will not issue any press releases or public statements concerning Houzz or the Pro Platform, including the Terms, or use, display or modify Houzz's trademarks.
7. Representations and Warranties
- You represent and warrant to Houzz that:
- You have the necessary power and authority to enter into these Terms. If you access the Pro Platform on behalf of another entity or business, you represent and warrant that you have the authority to bind such entity or business to these Terms and that both you and such entity or business are jointly and severally liable;
- Houzz's use of Your Content and Ad Content does not violate or infringe any intellectual property right, right of privacy, right of publicity, or any other proprietary or personal right of any third party, or constitute false advertising, fraud or misrepresentation;
- You have all necessary rights and authority to grant Houzz the rights granted under these these Terms with respect to Your Content;
- Your Content does not contain content that is obscene, defamatory, libellous, or slanderous, or otherwise harmful to, any person, corporation or other entity or violate applicable law;
- Your use of the Pro Platform, User Data, and any offer or provision of services and products in connection with the Pro Platform, does not violate any applicable laws, ordinances, rules or regulations;
- You may not access or use the Pro Platform if you are a competitor of Houzz, or if we have previously suspended you from the Pro Platform;
- You will comply at all times with the intellectual property restrictions set forth in these Terms; and
- You will not misrepresent your identity or affiliation to anyone in connection with Houzz.
- You also represent and warrant that you will not, and will not assist, encourage, or enable others to use the Pro Platform to:
- Violate our Terms;
- Create multiple Pro Accounts for the same business in the same or different markets, or create Pro Accounts for businesses or services that are not supported by the Pro Platform;
- Post any fake or defamatory review, trade reviews with others, or compensate someone or be compensated to post, refrain from posting, or remove a review;
- Violate any third party’s rights, including any breach of confidence, copyright, trademark, patent, trade secret, moral right, privacy right, right of publicity, or any other intellectual property or proprietary right;
- Threaten, stalk, harm, or harass others, or promote bigotry or discrimination;
- Solicit personal information from minors;
- Violate any applicable law;
- Modify, adapt, appropriate, reproduce, distribute, translate, create derivative works or adaptations of, publicly display, sell, trade, or in any way exploit the Pro Platform, Ad Content, or Your Content, except as expressly authorised by Houzz;
- Use any robot, spider, service search/retrieval application, or other automated device, process or means to access, retrieve, copy, scrape, or index any portion of the Pro Platform or any Ad Content, except as expressly permitted by Houzz;
- Reverse engineer any portion of the Pro Platform, unless applicable law prohibits this restriction, in which case you agree to provide us with 30 days’ prior written notice by sending an email to email@example.com;
- Record, process, or mine information about Clients or Pro Platform users;
- Access, retrieve or index any portion of the Pro Platform for purposes of constructing or populating your own database of business reviews, or potential Clients;
- Reformat or frame any portion of the Pro Platform;
- Take any action that imposes, or may impose, in our discretion, an unreasonable or disproportionately large load on Houzz’s technology infrastructure or otherwise make excessive traffic demands;
- Attempt to gain unauthorised access to the Pro Platform, Pro Account, computer systems or networks connected to the Pro Platform through hacking, password mining or any other means;
- Use the Pro Platform or any Ad or Your Content to transmit any computer viruses, worms, defects, Trojan horses, malicious code, spyware, malware or other items of a destructive or harmful nature;
- Use any device, software or routine that interferes with the proper working of the Pro Platform, or otherwise attempt to interfere with the proper working of the Pro Platform;
- Use the Pro Platform to violate the security of any computer network, crack passwords or security encryption codes, disrupt or interfere with the security of, or otherwise cause harm to, the Pro Platform or Ad Content; or
- Remove, circumvent, disable, damage or otherwise interfere with any security-related features, features that prevent or restrict the use or copying of content, or features that enforce limitations on the use of the Pro Platform.
8. Indemnification and Defense
- Indemnification and Defense. You hereby agree to fully indemnify, defend, and hold harmless Houzz, its parents, subsidiaries, officers, directors, employees, agents, affiliates, distributors, service providers, partners, licensors, contractors, representatives and content providers (collectively, "Houzz Indemnified Parties") from and against any and all third-party claims, actions, demands, losses, damages, costs (including, without limitation, reasonable attorneys' fees), liabilities, expenses, and proceedings ("Claims") arising out of or relating to (i) your access to or use of the Pro Platform, including Your Content, (ii) your violation of a material term of these Terms, (iii) your breach of your express representations and warranties provided under these Terms, (iv) any third party products or services purchased or obtained by you in connection with the Pro Platform, (v) your products or services, or the marketing or provision thereof to any Client, (vi) any breach or mishandling of data by you, (vii) not complying with Houzz’s request to remove personal data, or (viii) the infringement by you, or any third party using your Pro Account, or by the Photos, User Data, or Your Content of any intellectual property or other right of any person or entity. Your counsel defending such Claim will be subject to Houzz's prior written approval, not to be unreasonably withheld. Houzz reserves the right to participate fully in and assume joint control of the defence of any Action. You agree not to settle any such matter without the prior written consent of Houzz. Houzz will use reasonable efforts to notify you of any such claim, action or proceeding upon becoming aware of it.
9. Limitation of Liability and Disclaimer
PLEASE READ THIS SECTION CAREFULLY BECAUSE IT LIMITS THE LIABILITY OF HOUZZ TO YOU. EACH OF THE SUBSECTIONS BELOW ONLY APPLIES UP TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW. NOTHING HEREIN IS INTENDED TO LIMIT ANY RIGHTS YOU MAY HAVE WHICH MAY NOT BE LAWFULLY LIMITED. BY ACCESSING OR USING THE PRO PLATFORM, YOU REPRESENT THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO THESE TERMS, INCLUDING THIS SECTION. YOU ARE GIVING UP SUBSTANTIAL LEGAL RIGHTS BY AGREEING TO THESE TERMS.
- DISCLAIMER OF WARRANTIES. WHILE HOUZZ TAKES REASONABLE CARE TO PROVIDE THE SERVICES TO YOU, THE PRO PLATFORM AND AD CONTENT ARE MADE AVAILABLE TO YOU ON AN “AS IS”, “WITH ALL FAULTS” AND “AS AVAILABLE” BASIS, WITH THE EXPRESS UNDERSTANDING THAT HOUZZ MAY NOT MONITOR, CONTROL, OR VET YOUR CONTENT OR THIRD PARTY CONTENT. AS SUCH, YOUR USE OF THE PRO PLATFORM IS AT YOUR OWN DISCRETION AND RISK. HOUZZ MAKES NO CLAIMS OR PROMISES ABOUT THE QUALITY, COMPLETENESS, ACCURACY, OR RELIABILITY OF THE PRO PLATFORM ITS SAFETY OR SECURITY, INCLUDING WITHOUT LIMITATION THE SECURITY OF YOUR DATA, OR THE AD CONTENT. ACCORDINGLY, HOUZZ IS NOT LIABLE TO YOU FOR ANY PERSONAL INJURY, LOSS OR DAMAGE THAT MIGHT ARISE, FOR EXAMPLE, FROM THE SERVICE’S INOPERABILITY, SERVICE UNAVAILABILITY, SECURITY VULNERABILITIES OR FROM YOUR RELIANCE ON THE QUALITY, ACCURACY, OR RELIABILITY, METRICS OR OTHER CONTENT FOUND ON, USED ON, OR MADE AVAILABLE THROUGH THE PRO PLATFORM. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, HOUZZ SPECIFICALLY DISCLAIMS ANY AND ALL REPRESENTATIONS OR WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, REGARDING THE SERVICES, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, HOUZZ SPECIFICALLY DISCLAIMS ANY WARRANTY OR LIABILITY REGARDING THE FOLLOWING: (i) THE NUMBER OF PERSONS OR PERCENTAGE OF A USER POPULATION WHO WILL ACCESS, VIEW OR INTERACT WITH YOUR PRO ACCOUNT, YOUR CONTENT, HOUZZ CONTENT, PRO PLATFORM, OR HOUZZ PLATFORM, (ii) SPECIFIC RESULTS OR PERFORMANCE (INCLUDING LEADS, IMPRESSIONS, CLICKS OR REVENUE) YOU MIGHT OBTAIN FROM THE SERVICES, (iii) THE HOUZZ CONTENT OR THE PRO PLATFORM OR THIRD PARTY SERVICES, (iv) THAT THE PRO PLATFORM PROVIDED UNDER THESE TERMS OR THIRD PARTY SERVICES WILL BE UNINTERRUPTED, ERROR FREE, SECURE, ACCURATE, RELIABLE OR COMPLETE, (v) YOUR CONTENT WILL NOT BE LOST OR DAMAGES, (vi) ERRORS WILL BE CORRECTED OR ANY PARTICULAR SUPPORT REQUESTS WILL BE RESOLVED TO MEET YOUR NEEDS, OR (vii) ANY REFERENCE TO “UNLIMITED” ACCESS, USE, OR STORAGE OF YOUR CONTENT, PRO DOCUMENTS, OR THE PRO PLATFORM IS SUBJECT TO TECHNICAL LIMITATIONS.
- THIRD-PARTIES. HOUZZ MAKES NO CLAIMS OR PROMISES WITH RESPECT TO ANY THIRD PARTY AVAILABLE ON THE PRO PLATFORM. ACCORDINGLY, HOUZZ IS NOT LIABLE TO YOU FOR ANY PERSONAL INJURY, LOSS OR DAMAGE THAT MIGHT ARISE FROM ANY SUCH THIRD PARTY’S ACTIONS OR OMISSIONS, INCLUDING, FOR EXAMPLE, IF ANOTHER USER OR CLIENT MISUSES YOUR CONTENT, IDENTITY OR PERSONAL INFORMATION, OR IF YOU HAVE A NEGATIVE EXPERIENCE WITH ONE OF THE THIRD PARTIES. YOUR PURCHASE AND USE OF PRODUCTS OR SERVICES OFFERED BY THIRD PARTIES THROUGH THE PRO PLATFORM IS AT YOUR OWN DISCRETION AND RISK.
- REMEDY. YOUR SOLE AND EXCLUSIVE RIGHT AND REMEDY IN CASE OF DISSATISFACTION WITH THE PRO PLATFORM OR ANY OTHER GRIEVANCE SHALL BE, WHERE REASONABLY FEASIBLY, OUR RE-PERFORMANCE OF SUCH SERVICES OR YOUR TERMINATION AND DISCONTINUATION OF ACCESS TO, OR USE OF THE PRO PLATFORM. IN CASES OF MATERIAL BREACH OF THESE TERMS SUCH TERMINATION SHALL BE WITHOUT PENALTY.
- LIMITATION OF LIABILITY. EITHER PARTY’S LIABILITY SHALL BE LIMITED TO THE MAXIMUM EXTENT PERMITTED BY LAW, AND EITHER PARTY WILL NOT BE LIABLE TO THE OTHER PARTY FOR ANY (i) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, EXEMPLARY, RELIANCE, OR CONSEQUENTIAL DAMAGES, (ii) LOSS OF PROFITS OR REVENUE, (iii) BUSINESS INTERRUPTION, (iv) REPUTATIONAL HARM, OR (v) LOSS OF INFORMATION OR DATA. THE WAIVERS AND LIMITATIONS SPECIFIED IN THIS SECTION 9 WILL SURVIVE AND APPLY REGARDLESS OF THE FORM OF ACTION, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHERWISE.
- MAXIMUM LIABILITY. EXCEPT FOR YOUR INDEMNITY OBLIGATIONS, A PARTY’S MAXIMUM AGGREGATE LIABILITY TO THE OTHER PARTY FOR LOSSES OR DAMAGES THAT THE OTHER PARTY SUFFERS IN CONNECTION WITH THE PRO PLATFORM OR THESE TERMS IS LIMITED TO THE GREATER OF THE AMOUNT PAID, IF ANY, BY YOU TO HOUZZ IN CONNECTION WITH THE SERVICE IN THE 12 MONTHS PRIOR TO THE ACTION GIVING RISE TO LIABILITY. NOTHING IN THIS SECTION 9 WILL BE DEEMED TO LIMIT YOUR OBLIGATIONS IN SECTION 8.
- Consent. As part of accessing the Pro Platform, and subject to compliance with applicable laws, you agree that Houzz and its affiliates may communicate with you via text message, call, email, or push notification and pre-recorded messages. Standard text message charges applied by your telephone carrier may apply to text messages we send. You also agree to receive promotional text messages, calls and pre-recorded messages, any of which may be generated by automatic telephone dialling systems. You are not required to agree to receive these promotional communications as a condition of purchasing/accessing the Pro Services Platform. If you wish to stop receiving promotional emails or promotional text messages, we provide the following methods for you to opt-out or unsubscribe: (i) follow the instructions we provide in the email or initial text message for that category of promotional emails or text messages, or (ii) opt-out or unsubscribe using your device settings.
- Independent Contractors. You are not an agent, representative or partner of Houzz, and you have no authority to enter into any agreement to bind Houzz. Houzz and you are independent contractors as it relates to these Terms. Furthermore, Houzz does not provide any legal, financial, Pro Accounting, or tax advice.
12. Controlling Law and Jurisdiction
- Choice of Law. These Terms will be interpreted in accordance with the laws of the State of California and the United States of America, without regard to their conflict-of-law provisions. You and Houzz agree to submit to the personal jurisdiction of a federal or state court located in San Francisco, California for any actions for which the arbitration provision, as set forth in Section 16, does not apply.
- EEA and UK Residents. If you are a resident of the United Kingdom or a country located in the EEA, United Kingdom law will govern these Terms, as well as any disputes that may arise between you and Houzz. You agree that any subpoena, third-party discovery request, or other third-party process directed to Houzz must issue from, or be domesticated by, the state or federal courts located within San Francisco County, California and you agree to submit to the jurisdiction of each of these courts for any related proceedings.
- Translation. We may translate these Terms into other languages for your convenience. Nevertheless, the English version governs your relationship with Houzz and any inconsistencies among the different versions will be resolved in favour of the English version available here.
14. Assignment and Waiver
- Assignment. These Terms are not assignable in whole or in part by you without the prior written consent of Houzz. Houzz may delegate any or all of its obligations under these Terms. Houzz may assign or transfer these terms to any of its affiliates or in connection with a sale of all or substantially all of its assets, restructuring, change of control, merger, acquisition of Houzz, its affiliates or any of their respective businesses. These Terms will be binding on, inure to the benefit of, and be enforceable against the parties and their respective successors and assigns.
- Waiver. Waiver of rights resulting from breach of any provision hereof will not be deemed to constitute a waiver of rights resulting from any previous or succeeding breach of the same or any other provision. Houzz will not be deemed to waive any of its rights under these Terms unless expressly waived in a signed writing by Houzz.
15. Other Agreements
16. Dispute Resolution
- Informal Resolution. If you have a dispute with Houzz, you agree to attempt to resolve the issue informally first by contacting your Houzz representative at pronotices_UK@houzz.com. If the Houzz representative cannot resolve your issue they may in their reasonable discretion escalate the issue to the Houzz Legal Team and/or the Houzz Leadership Team. If we are not able to resolve the dispute informally, then the below sub-sections will govern any legal dispute that relates to the Pro Platform.
- Binding Arbitration. You and Houzz agree that any dispute, claim or controversy arising out of or relating to these Terms or any Agreement between you and Houzz or to your use of the Pro Platform (collectively "Disputes") will be settled by binding arbitration, except that each party retains the right to seek injunctive or other equitable relief in a court of competent jurisdiction to prevent the actual or threatened infringement, misappropriation, or violation of a party's copyrights, trademarks, trade secrets, patents, or other intellectual property rights. This means that you and Houzz both agree to waive the right to a trial by jury.
- Class Action Waiver. You and Houzz agree that any proceedings to resolve Disputes will be conducted on an individual basis and not in a class, consolidated, or representative action. This means that, in connection with any Dispute, you and Houzz both agree to waive the right to participate as a plaintiff as a class member in any class action proceeding. Further, unless you and Houzz agree otherwise in writing, the arbitrator in any Dispute may not consolidate more than one person's claims and may not preside over any form of class action proceeding.
- Arbitration Administration and Rules. The arbitration will be administered by the American Arbitration Association ("AAA") in accordance with the Commercial Arbitration Rules then in effect (the "AAA Rules"), except as modified by this "Dispute Resolution" section. (The AAA Rules are available at http://www.adr.org.)
- Arbitration Process. A party who desires to initiate the arbitration must provide the other party with a written Demand for Arbitration as specified in the AAA Rules. The arbitrator will be either a retired judge or an attorney licensed to practice law and will be selected by the parties from the AAA's roster of arbitrators with relevant experience. If the parties are unable to agree upon an arbitrator within 7 days of delivery of the Demand for Arbitration, then the AAA will appoint the arbitrator in accordance with AAA Rules.
- Arbitration Location and Procedure. The seat of the arbitration shall be in San Francisco, California unless you and Houzz agree otherwise or the AAA Rules provide otherwise. If your claim does not exceed USD$10,000, then the arbitration will be conducted solely on the basis of documents you and Houzz submit to the arbitrator, unless you request a hearing and the arbitrator then determines that a hearing is necessary. If your claim exceeds USD$10,000, your right to a hearing will be determined by AAA Rules. Subject to AAA Rules, the arbitrator will have the discretion to direct a reasonable exchange of information by the parties, consistent with the expedited nature of the arbitration. Hearings may be conducted by telephone or video conference, if requested and agreed to by the parties.
- Arbitrator's Decision and Governing Law. The arbitrator shall apply California law consistent with the Federal Arbitration Act and applicable statutes of limitations, and shall honour claims of privilege recognised by law. The arbitrator will render an award within the timeframe specified in the AAA Rules. Judgement on the arbitration may be entered in any court having jurisdiction thereof. Any award of damages by an arbitrator must be consistent with the "Limitation of Liability; Disclaimer" section above. The arbitrator may award declaratory or injunctive relief in favour of the claimant only to the extent necessary to provide relief warranted by the claimant's individual claim.
- Fees. Each party's responsibility to pay the arbitration filing, administrative and arbitrator fees will depend on the circumstances of the arbitration and are set forth in the AAA Rules.
17. Force Majeure
- Force Majeure. Except for payment obligations, neither party will be considered in default due to any delay or failure in performance based on any event or circumstances beyond its reasonable control, including, but not limited to failure of the Internet or related networks, fire, strike, embargo, requirement of governmental, civil or military authority, act of God, or failure of suppliers. When the delaying cause ceases, each party will resume performance, subject to an equitable schedule adjustment if necessary.
- Severability. In the event that any portion of these Terms is deemed illegal or unenforceable under applicable law, such provision shall be severed and the remainder of these Terms shall be given full force and effect.
STANDARD CONTRACTUAL CLAUSES – MODULE ONE: Transfer Controller to Controller (C2C)
Purpose and scope
- The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)1 for the transfer of personal data to a third country.
- The Parties:
- the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A. (hereinafter each “data exporter”), and
- the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A. (hereinafter each “data importer”)
- These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
- The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
have agreed to these standard contractual clauses (hereinafter: “Clauses”).
Effect and invariability of the Clauses
- These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46 (2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
- These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
- Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
- Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
- Clause 8 - Clause 8.5 (e) and Clause 8.9(b);
- Clause 9 - [not used in Module One (C2C) Standard Contractual Clauses];
- Clause 12 - Clause 12(a) and (d);
- Clause 13;
- Clause 15.1(c), (d) and (e);
- Clause 16(e);
- Clause 18 - Clause 18(a) and (b).
- Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
- Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
- These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
- These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
- An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.
- Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.
- The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party.
SECTION II - OBLIGATIONS OF THE PARTIES
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B. It may only process the personal data for another purpose:
- where it has obtained the data subject’s prior consent;
- where necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or
- where necessary in order to protect the vital interests of the data subject or of another natural person.
- In order to enable data subjects to effectively exercise their rights pursuant to Clause 10, the data importer shall inform them, either directly or through the data exporter:
- of its identity and contact details;
- of the categories of personal data processed;
- of the right to obtain a copy of these Clauses;
- where it intends to onward transfer the personal data to any third party/ies, of the recipient or categories of recipients (as appropriate with a view to providing meaningful information), the purpose of such onward transfer and the ground therefore pursuant to Clause 8.7.
- Paragraph (a) shall not apply where the data subject already has the information, including when such information has already been provided by the data exporter, or providing the information proves impossible or would involve a disproportionate effort for the data importer. In the latter case, the data importer shall, to the extent possible, make the information publicly available.
- On request, the Parties shall make a copy of these Clauses, including the Appendix as completed by them, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the Parties may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.
- Paragraphs (a) to (c) are without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.
- Each Party shall ensure that the personal data is accurate and, where necessary, kept up to date. The data importer shall take every reasonable step to ensure that personal data that is inaccurate, having regard to the purpose(s) of processing, is erased or rectified without delay.
- If one of the Parties becomes aware that the personal data it has transferred or received is inaccurate, or has become outdated, it shall inform the other Party without undue delay.
- The data importer shall ensure that the personal data is adequate, relevant and limited to what is necessary in relation to the purpose(s) of processing.
The data importer shall retain the personal data for no longer than necessary for the purpose(s) for which it is processed. It shall put in place appropriate technical or organisational measures to ensure compliance with this obligation, including erasure or anonymisation2 of the data and all back-ups at the end of the retention period.
- The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the personal data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access (hereinafter “personal data breach”). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subject. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner.
- The Parties have agreed on the technical and organisational measures set out in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
- The data importer shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
- In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the personal data breach, including measures to mitigate its possible adverse effects.
- In case of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the data importer shall without undue delay notify both the data exporter and the competent supervisory authority pursuant to Clause 13. Such notification shall contain i) a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), ii) its likely consequences, iii) the measures taken or proposed to address the breach, and iv) the details of a contact point from whom more information can be obtained. To the extent it is not possible for the data importer to provide all the information at the same time, it may do so in phases without undue further delay.
- In case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the data importer shall also notify without undue delay the data subjects concerned of the personal data breach and its nature, if necessary in cooperation with the data exporter, together with the information referred to in paragraph (e), points ii) to iv), unless the data importer has implemented measures to significantly reduce the risk to the rights or freedoms of natural persons, or notification would involve disproportionate efforts. In the latter case, the data importer shall instead issue a public communication or take a similar measure to inform the public of the personal data breach.
- The data importer shall document all relevant facts relating to the personal data breach, including its effects and any remedial action taken, and keep a record thereof.
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions or offences (hereinafter “sensitive data”), the data importer shall apply specific restrictions and/or additional safeguards adapted to the specific nature of the data and the risks involved. This may include restricting the personnel permitted to access the personal data, additional security measures (such as pseudonymisation) and/or additional restrictions with respect to further disclosure.
The data importer shall not disclose the personal data to a third party located outside the European Union3 (in the same country as the data importer or in another third country, hereinafter “onward transfer”) unless the third party is or agrees to be bound by these Clauses, under the appropriate Module. Otherwise, an onward transfer by the data importer may only take place if:
- it is to a country benefiting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;
- the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU) 2016/679 with respect to the processing in question;
- the third party enters into a binding instrument with the data importer ensuring the same level of data protection as under these Clauses, and the data importer provides a copy of these safeguards to the data exporter;
- it is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings;
- it is necessary in order to protect the vital interests of the data subject or of another natural person; or
- where none of the other conditions apply, the data importer has obtained the explicit consent of the data subject for an onward transfer in a specific situation, after having informed him/her of its purpose(s), the identity of the recipient and the possible risks of such transfer to him/her due to the lack of appropriate data protection safeguards. In this case, the data importer shall inform the data exporter and, at the request of the latter, shall transmit to it a copy of the information provided to the data subject.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
The data importer shall ensure that any person acting under its authority, including a processor, processes the data only on its instructions.
- Each Party shall be able to demonstrate compliance with its obligations under these Clauses. In particular, the data importer shall keep appropriate documentation of the processing activities carried out under its responsibility.
- The data importer shall make such documentation available to the competent supervisory authority on request.
Use of sub-processors
[Not used in Module One (C2C) Standard Contractual Clauses]
Data subject rights
- The data importer, where relevant with the assistance of the data exporter, shall deal with any enquiries and requests it receives from a data subject relating to the processing of his/her personal data and the exercise of his/her rights under these Clauses without undue delay and at the latest within one month of the receipt of the enquiry or request4. The data importer shall take appropriate measures to facilitate such enquiries, requests and the exercise of data subject rights. Any information provided to the data subject shall be in an intelligible and easily accessible form, using clear and plain language.
- In particular, upon request by the data subject the data importer shall, free of charge:
- provide confirmation to the data subject as to whether personal data concerning him/her is being processed and, where this is the case, a copy of the data relating to him/her and the information in Annex I; if personal data has been or will be onward transferred, provide information on recipients or categories of recipients (as appropriate with a view to providing meaningful information) to which the personal data has been or will be onward transferred, the purpose of such onward transfers and their ground pursuant to Clause 8.7; and provide information on the right to lodge a complaint with a supervisory authority in accordance with Clause 12(c)(i);
- rectify inaccurate or incomplete data concerning the data subject;
- erase personal data concerning the data subject if such data is being or has been processed in violation of any of these Clauses ensuring third-party beneficiary rights, or if the data subject withdraws the consent on which the processing is based.
- Where the data importer processes the personal data for direct marketing purposes, it shall cease processing for such purposes if the data subject objects to it.
- The data importer shall not make a decision based solely on the automated processing of the personal data transferred (hereinafter “automated decision”), which would produce legal effects concerning the data subject or similarly significantly affect him/her, unless with the explicit consent of the data subject or if authorised to do so under the laws of the country of destination, provided that such laws lays down suitable measures to safeguard the data subject’s rights and legitimate interests. In this case, the data importer shall, where necessary in cooperation with the data exporter:
- inform the data subject about the envisaged automated decision, the envisaged consequences and the logic involved; and
- implement suitable safeguards, at least by enabling the data subject to contest the decision, express his/her point of view and obtain review by a human being.
- Where requests from a data subject are excessive, in particular because of their repetitive character, the data importer may either charge a reasonable fee taking into account the administrative costs of granting the request or refuse to act on the request.
- The data importer may refuse a data subject’s request if such refusal is allowed under the laws of the country of destination and is necessary and proportionate in a democratic society to protect one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679.
- If the data importer intends to refuse a data subject’s request, it shall inform the data subject of the reasons for the refusal and the possibility of lodging a complaint with the competent supervisory authority and/or seeking judicial redress.
- The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
- In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
- Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:
- lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;
- refer the dispute to the competent courts within the meaning of Clause 18.
- The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
- The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
- The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.
- Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
- Each Party shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages that the Party causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter under Regulation (EU) 2016/679.
- Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
- The Parties agree that if one Party is held liable under paragraph (c), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its / their responsibility for the damage.
- The data importer may not invoke the conduct of a processor or sub-processor to avoid its own liability.
- The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
- The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
SECTION III - LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Local laws and practices affecting compliance with the Clauses
- The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
- The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:
- the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;
- the laws and practices of the third country of destination- including those requiring the disclosure of data to public authorities or authorising access by such authorities - relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards5;
- any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.
- The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.
- The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.
- The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).
- Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.
Obligations of the data importer in case of access by public authorities
- The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:
- receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or
- becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.
- If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.
- Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authorities, whether requests have been challenged and the outcome of such challenges, etc.).
- The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent suspensory authority on request.
- Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.
- The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
- The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.
- The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.
SECTION IV - FINAL PROVISIONS
Non-compliance with the Clauses and termination
- The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
- In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
- The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
- the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;
- the data importer is in substantial or persistent breach of these Clauses; or
- the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.
- Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
- Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.
In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Germany.
Choice of forum and jurisdiction
- Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
- The Parties agree that those shall be the courts of Germany.
- A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.
- The Parties agree to submit themselves to the jurisdiction of such courts.
1 Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295 of 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision […].
2 This requires rendering the data anonymous in such a way that the individual is no longer identifiable by anyone, in line with recital 26 of Regulation (EU) 2016/679, and that this process is irreversible
3 The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union's internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses.
4 That period may be extended by a maximum of two more months, to the extent necessary taking into account the complexity and number of requests. The data importer shall duly and promptly inform the data subject of any such extension.
5 As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.
A. LIST OF PARTIES
|1.||Name:||As detailed in Customer’s Pro Profile.|
|Address:||As detailed in Customer’s Pro Profile.|
|Contact person’s name, position and contact details:||As detailed in Customer’s Pro Profile.|
|Activities relevant to the data transferred under these Clauses:||Providing the personal data necessary to execute the Houzz Pro Terms and Conditions.|
|Signature and date:||At the same time as the Data Exporter is entering into the Houzz Pro Terms and Conditions, also the SCCs, which forms an integral part of the Houzz Pro Terms and Conditions, are concluded.|
Data importer(s): [Identity and contact details of the data importer(s), including any contact person with responsibility for data protection]
|Address:||285 Hamilton Avenue, Palo Alto, CA, USA 94301|
|Contact person’s name, position and contact details:||EUprivacy@houzz.com|
|Activities relevant to the data transferred under these Clauses:||Processing the personal data necessary to execute the Houzz Pro Terms and Conditions.|
|Signature and date:||At the same time as the Data Exporter is entering into the Houzz Pro Terms and Conditions, also the SCCs, which forms an integral part of the Houzz Pro Terms and Conditions, are concluded.|
В. DESCRIPTION OF TRANSFER
|Categories of data subjects whose personal data is transferred||The employees, representatives, suppliers, service providers, subcontractors, customers and prospective customers of Data Exporter.|
|Categories of personal data transferred||Identification data including, without limitation, first and last name, email address, telephone number, address (business or personal); online usage data; communications data; electronic identification data including location data; financial data (if provided); affiliations, education and training (if provided); and profession and job data.|
|Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.||N/A|
|The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).||Continuous basis|
|Nature of the processing||Collection, recording, organisation, storage, use, disclosure by transmission, dissemination or otherwise making available|
|Purpose(s) of the data transfer and further processing||For Data Importer to perform the Services, improve and customise the Services and Houzz Platform, and for any other purposes described in Section 2(b) and Section 10(b) of the Agreement.|
|The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period||For the duration of the Houzz account|
|For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing||N/A|
C. COMPETENT SUPERVISORY AUTHORITY
|Identify the competent supervisory authority/ies in accordance with Clause 13||The competent supervisory authority/ies depends on the location of the data exporter as detailed in Customer’s Pro Profile.|
ANNEX II - TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
|Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services||A periodic business continuity review is conducted between business, product, legal, and engineering stakeholders. Security and data privacy for all third-party data processing is reviewed as part of the vendor risk assessment process. Various technical controls are implemented to ensure the security of processing systems and services, including (but not limited to): endpoint detection and response (EDR) agents on production hosts, anti-virus agents on corporate endpoints, mobile device management (MDM) on corporate endpoints, production access via software-defined-perimeter (SDP), separate development and production environments, and centralised system event logging and aggregation.|
|Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident||Engineering has implemented regular exports of platform and user data from runtime databases. These exports are securely backed up into archival data storage to allow for access and restoration when needed.|
|Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing||Systems, applications, and procedures are subject to periodic internal and external audits. Examples include vulnerability scanning of the platform web application.|
|Measures for user identification and authorisation||Authentication for systems is handled via centralised single-sign-on with defined policies for credential strength and multi-factor-authentication. Authorisation to sensitive platform functionality is limited via defined roles to personnel with authority and access under documented procedures.|
|Measures for the protection of data during transmission||Platform access (e.g. websites and native applications) is only allowed via encrypted client connections (HTTPS protocol). Only secure encryption schemes are supported (for example, TLS v1.1 and below and SSL are not supported due to known vulnerabilities).|
|Measures for the protection of data during storage||Sensitive data is protected in systems using cryptographically strong encryption. Access to production systems is done via software-defined-perimeter (SDP) and centralised single-sign-on account management. IaaS account access enforces best practices for authentication, including multi-factor-authentication and key rotation.|
|Measures for ensuring physical security of locations at which personal data are processed||Individual key fob access is required for physical entry.|
|Measures for ensuring events logging||Continuous monitoring, review, and remediation of event processing and data quality is performed by data analysts and Head of Data Governance.|
|Measures for internal IT and IT security governance and management||Policies and procedures are implemented and reviewed regularly by engineering leadership, Head of IT, and Head of Security|
|Measures for ensuring data minimisation||Regular product reviews and consultation sessions are held between legal, product and engineering teams.|
|Measures for ensuring limited data retention||The defined data retention policy is reviewed regularly by legal, Head of IT, Head of Security, and engineering leadership.|
|Measures for allowing data portability and ensuring erasure||Data privacy program policies and procedures are regularly reviewed by Privacy Program Manager and Engineering leadership.|
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter