Houzz Pro Services Terms and Conditions

Effective as of 15 February, 2022.

Introduction

Welcome to Houzz Pro! Houzz Pro is an all-in-one software solution for home design, renovation and construction professionals. Houzz Pro enables builders, designers, and other home professionals to manage their full project life cycle, including attracting and converting new clients, creating estimates, communicating with clients, and handling billing all in one place.

These Houzz Pro Services Terms and Conditions (the “Terms”) apply to your use of the Houzz Pro website and Houzz Pro mobile applications (both the “Pro Platform”), as well as all other related products and services like our advertising or website services (all collectively referred to as our “Pro Services”). These terms are a binding legal agreement between you (“Professional”, “you”, or “your”) and Houzz Inc., its subsidiaries, affiliates, successors or assigns, (together “Houzz”, “we”, “us”, or “our”).

WE ENCOURAGE YOU TO REVIEW THESE TERMS CAREFULLY. THESE TERMS PROVIDE IMPORTANT INFORMATION TO YOU, INCLUDING YOUR AGREEMENT TO RESOLVE ANY DISPUTES BY INDIVIDUAL ARBITRATION, WHICH MEANS THAT YOU WAIVE ANY RIGHT TO HAVE THOSE DISPUTES DECIDED BY A JUDGE OR JURY, AND THAT YOU WAIVE YOUR RIGHT TO PARTICIPATE IN CLASS ACTIONS, CLASS ARBITRATIONS, OR ANY TYPE OF REPRESENTATIVE ACTIONS. THE TERMS ALSO COVER YOUR AGREEMENT TO GRANT US RIGHTS TO YOUR CONTENT, OUR LIMITATION OF LIABILITY TO YOU AND, IF YOU CHOOSE TO PROVIDE US WITH YOUR PHONE NUMBER, YOUR AGREEMENT TO RECEIVE CALLS AND TEXT MESSAGES FROM US IN ACCORDANCE WITH APPLICABLE LAW.

THESE TERMS ALSO COVER YOUR AGREEMENT TO MAKE FUTURE RECURRING PAYMENTS FOR CERTAIN PRO SERVICES YOU PURCHASE THAT MAY AUTOMATICALLY RENEW.

By accessing or using Pro Services in any way, you are agreeing to these Terms in their entirety. If you do not agree with any portion of the Terms, you may not use the Pro Services. You agree that these Terms are enforceable like any other written agreement signed by you.

1. Changes To The Terms

We may revise these Terms from time to time, including any linked or referenced documents. The most current version of these Terms will govern your use of the Pro Services. If we make material changes to these Terms, we will notify you by email or by posting a notice on the Pro Platform or by other means, to offer you an opportunity to review the changes before they become effective. If you do not agree to the revised Terms, you should stop accessing or using the Pro Services. By continuing to access or use the Pro Services after those changes become effective, you are subject to the new Terms.

2. Services

Houzz may provide you with Pro Services. Some of the Pro Services are provided free of cost, or for a limited time, or on a trial basis, and others must be purchased. When you purchase or receive certain Pro Services, you may enter into other agreements in addition to these Terms. These other service agreements could be an order form, quotation, sales agreement or something else (each referred to as an “Agreement”). The Agreement may include details about the specific service you purchased like the price, recurring billing cycle, or auto-renewal, and may also reference these Terms. Where there is a direct conflict between an Agreement and these Terms, that outside service Agreement will control.

We grant you permission to use the Pro Services only subject to these Terms and any applicable Agreement. You may not access or use the Pro Services if you are a competitor of Houzz or if we have previously suspended you from the Pro Services or suspended your Account (defined below).

  1. Advertising Services.Advertising Services” means any paid advertising and marketing services provided through the Pro Platform, which may include premium features, sponsored ad placements, receiving leads from our “Project Match” tool, “Additional Leads Pool,” or similar features. Before purchasing Advertising Services, you should ensure you meet the “Minimum Standards”. If you purchased Advertising Services and you do not meet the Minimum Standards within 90 days of purchase, Houzz may forfeit your right to receive the Advertising Services and Houzz will have no further obligation to deliver the Advertising Services. Our Advertising Services enable Houzz to target “Ad Content” (Ad Content means advertising materials generated by or on behalf of Houzz using Pro Content (defined below) often placed in standard templates for publication on the Pro Platform) to the users designated by you, for example in designated regions (or sub-metros). While Houzz takes reasonable care in providing the Advertising Services, Houzz does not guarantee that Ad Content will always reach the designated users. Houzz in its reasonable discretion may determine if sponsored or promotional content is Ad Content if it is not reasonably clear from the context. “Pro Content” means all information, content, or materials made available or submitted by Professional to Houzz via any means. Placement and designation of Pro Content and Ad Content will be determined by Houzz and may change from time to time. Houzz may provide you with an estimate of how many impressions, clicks, or contacts, or how much market share you will receive but Houzz cannot guarantee these numbers. You understand that users, automated computers, third parties and Houzz personnel may generate impressions, clicks or leads, and Houzz cannot guarantee that those impressions, clicks or leads reflect genuine interest. Houzz also cannot guarantee that the impressions, clicks or contacts will be uniformly distributed. More information on how Houzz uses Pro Content and Ad Content (including the main parameters for determining the placement or ranking of Pro Content and Ad Content) is available by reaching out to your representative.
    1. Additional Leads Pool. If you order or receive leads from the Additional Leads Pool, Houzz will make the User Data (defined below) of those leads available to you. You may only use the User Data with respect to those Additional Leads in accordance with these Terms or an applicable Agreement. If you reject any leads, Houzz reserves the right to remove your access to the User Data with respect to those leads.
  2. Website Services.Website Services” means any website displaying Pro Content and other content included by or on behalf of you into standard Houzz web templates with hosting managed by Houzz. If you have transferred your non-Houzz website domain to Houzz or requested Houzz to purchase a non-Houzz website domain (“Non-Houzz URL”), Houzz will also renew the registration for the Non-Houzz URL as part of the Website Services. For clarity, Houzz does not clear any trademarks for trademark infringement, and Houzz does not make any representations or warranties regarding whether the website domain infringes the trademark rights of third parties. If you would like Houzz to transfer the Non-Houzz URL back to you, please send a written request to pronotices_UK@houzz.com. Houzz will initiate transfer of the Non-Houzz URL to the third-party domain provider if you have communicated to Houzz all the information reasonably required by Houzz to complete such transfer, and you have no non-disputed payment amounts past due to Houzz. If you cease to order Website Services, have non-disputed payment amounts past due to Houzz, or these Terms are terminated, Houzz may immediately cease hosting your Non-Houzz URL.
  3. Email Services.Email Services” means tools that enable you to send emails and implement email marketing. Email Services may involve Third-Party Services (defined below). If you cease to order Email Services, have non-disputed payment amounts past due to Houzz or these Terms are terminated, Houzz may immediately cease providing Email Services.
  4. Call Tracking.Call Tracking” is a marketing service that allows you to track calls through the Pro Platform. Call Tracking or some of its features may not be available depending on your location. If you use the Call Tracking feature, Houzz will mask your phone number and may record information about the call, including the caller, time, and duration. In regions where Call Tracking is available, Call Tracking will automatically be enabled, unless you opt to disable this feature by notifying Houzz in writing at pronotices_UK@houzz.com at least 48 hours before the feature goes live. Thereafter, you can disable call tracking at any time by going to your Account settings.
  5. Pro Spotlight.Pro Spotlight” is a story about you, written by the Houzz Pro Spotlight team, that is available on your Pro Profile and may also be displayed to an audience of users. Each Pro Spotlight will be identified as "sponsored" or a similar designation. “Pro Profile” refers to your professional profile on the Pro Platform. If you purchase or receive a Pro Spotlight, you may be required to complete a questionnaire, interview, and/or provide certain Pro Content for use in creating the Pro Spotlight. While you will have input, Houzz will have final editorial control over the content of the Pro Spotlight. Placement and designation of the Pro Spotlight will be determined by Houzz and may change from time to time. Houzz does not guarantee a particular number of Pro Spotlight views, impressions, clicks, or leads.
  6. Photography Services.Photography Services” means professional photography of your project taken by a Houzz photographer or a third party photographer (“Outside Photographer”) during a period of time (“Photoshoot”) to make photos of your project (“Photos”) available to you. You understand and agree that you must redeem your Photoshoot within the then-current Term (defined below) in which the Photoshoot was purchased or received. If you do not redeem your Photoshoot within the applicable Term, then except as otherwise agreed in writing by Houzz, you will forfeit your right to receive the Photoshoot and Houzz will have no further obligation to deliver Photos or reimburse you for any Photoshoot. To the extent permitted by applicable laws, any amounts paid for a Photoshoot are non-refundable. Furthermore, a photoshoot will only be made available to you if you have no payment amounts past due to Houzz. You understand and agree that to the extent you provide any Personal Data (defined below) to Houzz of homeowners or other individuals (for example, to schedule a Photoshoot), you represent and warrant that you have all rights and permissions necessary to provide such information to Houzz. Subject to your compliance with these Terms and any applicable Agreement, including without limitation any payment obligations and subject to the assignment to Houzz by such Outside Photographer, Houzz will assign those rights received from Outside Photographers in all Photos. You acknowledge and agree that Houzz may upload your Photos to your Pro Profile. If your Photos are uploaded or submitted to the Pro Platform by you or on your behalf (including by Houzz or by an Outside Photographer), you grant Houzz a worldwide, perpetual, irrevocable, royalty-free, fully paid up, transferable, and fully sublicensable (through multiple tiers of sublicensees) license to reproduce, process, distribute, transmit, modify, publish, adapt, create derivative works of, publicly display and publicly perform and fully exploit such Photos in accordance with these Terms. You are responsible for obtaining all rights and clearances necessary for the Photos prior to the Photoshoot. In connection with the Photography Services, you irrevocably grant to Houzz or the Outside Photographer, as applicable, the right and permission to photograph, film, or otherwise record your name, voice, and likeness, as well as any home, business, real estate or personal property that you make accessible to Houzz. You also represent and warrant that you have all permissions and releases necessary to photograph at the designated location(s) or otherwise appearing in the Photos and any persons, objects, goods, and products appearing in the Photos. If a Photoshoot is cancelled or rescheduled a fee may be charged in accordance with these Terms or an Agreement.
  7. Professional Documents. The Pro Services may allow you to create renderings, mood boards, floor plans, estimates, proposals, invoices, change orders, contracts, and other similar business documents (collectively “Pro Documents”). These Pro Documents can be made available for review and signature (including e-signature) to your suppliers, sub-contractors, customers, clients, potential clients or similar individuals or businesses (collectively “Clients”). You are responsible for any Pro Documents and delivering to your Clients any services or materials purchased on their behalf.
  8. Payment Processing Services. Houzz may provide tools that enable Clients to transact with Professionals (“Payment Processing Services”). As a condition of our enabling Payment Processing Services, you represent and warrant that the information you provide to us in connection with transactions made in relation to Pro Services (“Payment Information”) is accurate and complete at all times. Furthermore, you represent and warrant that your use of Pro Services does not violate any applicable laws to which you are subject. You agree that you are responsible for paying for all purchases made on behalf of your Clients. To the extent that you receive payment from Clients through the Pro Services, payments will be disbursed to you according to certain schedules. Please note that any payments or transactions between you and a Client made via the Pro Platform are facilitated through a third-party payment processor. Houzz does not take custody of such funds, nor can Houzz access such funds.
    1. Payment Information. Payment Information and other sensitive financial information may not be shared or sent using the Pro Services except via the dedicated methods specifically made available by Houzz for those purposes. You agree that you are authorised to share Payment Information and other information about you, your business, and your transactions with us and our third party payment processors. Please see the Third Party Services (below) for more details.
    2. Disputes and Repayment Risks. If you are involved in a credit card dispute involving a payment made through or in connection with Pro Services, such as a chargeback, you agree to provide us and our third-party payment processor with all information relevant to the dispute. If any funds are withdrawn from our accounts as a result of the dispute or chargeback, you agree to reimburse us within 48-hours of the date the dispute was initiated. To the maximum extent permitted by applicable law, Houzz may obtain reimbursement of any amounts owed to us by instructing our payment processor to deduct such amounts from your account, deducting from future payments owed to you, reversing any credits to your account balance, charging your credit card, or through any other lawful means, including by using third-party collections services. You authorise Houzz to use any or all of the foregoing methods to seek reimbursement. It is Houzz's business practice to identify and investigate disputed transactions and transactions with repayment risk. Houzz reserves the right to withhold disbursements until Houzz completes investigations of disputed or risky transactions.
    3. Refunds. If you agree to refund a Client any fees, you are responsible for and will pay us (and we may retain) any transaction costs associated with such refund.
    4. Fees. There may be fees related to Payment Processing Services made available. Payment processing fees shall be deducted automatically from payments made to you via the Pro Services.
  9. Trade Programme. Any participation in our Houzz Trade Programme and Business Programme is subject to the Houzz Trade Programme and Business Trade Programme Terms and Conditions.
  10. Service Availability. While Houzz may provide prior notice where practicable, you acknowledge and agree that any and all of the Pro Services may be modified, updated, interrupted, suspended or discontinued at any time without notice or liability. Houzz may also provide you with certain Pro Services for a limited, promotional, or trial period only.
  11. Professional Advice. Houzz does not provide any legal, financial, accounting, or tax services or advice.
  12. Third Party Services. Certain aspects of the Pro Services may integrate with products or services provided by third parties (“Third-Party Services”). Houzz does not operate, control, approve of, or endorse any of the Third-Party Services, including their security, availability, or accuracy. Your use of Third-Party Services may be subject to the terms and policies of those third parties. It is your responsibility to familiarise yourself and comply with any applicable third-party terms. Houzz is not responsible for any Third-Party Services. Your use and reliance on any Third-Party Service is at your own risk.

3. Professional Responsibilities

  1. Cooperation. You agree to cooperate promptly and reasonably with requests by Houzz related to the provision of our Pro Services. You recognise that some of the Pro Services cannot be provided without your complete cooperation (e.g., for Website Services or Pro Spotlight) and in those instances you agree to provide Houzz with all the Pro Content necessary for us to provide the Pro Services to you. If you do not provide us with the necessary Pro Content then we may not be able to provide you with the Pro Services.
  2. Account. You must create an Account and provide certain information about yourself in order to use and access the Pro Services. An “Account” is the digital platform that provides you and others access to your Pro Services. You are responsible for maintaining the confidentiality of any Account username(s) or password(s). You agree to notify us immediately of any unauthorised use of your Account or Pro Services. In some instances, access to your Account may be limited. Houzz reserves the right to monitor Account access and block access to anyone that exceeds the allowable number of persons authorised to access the Account or close the Account in its entirety. If your Account is accessed by a number of persons that exceeds the number of persons allowed to access your Account, Houzz reserves the right to automatically change your plan to a plan that corresponds to the amount of persons that you have accessing your account. That means that starting at the next billing period, you will be charged and will be responsible for paying for the plan that correctly corresponds to the number of persons that are accessing your Account. The number of people allowed to access your account can be found in at least one of several ways: (i) your plan agreement, usually titled Pro Services Agreement, (ii) your Account, or (iii) on our Prices and Plans webpages.
  3. Pro Content. Professional agrees that any Pro Content should complement and enhance the Pro Services experience for all users generally. Houzz reserves the right to reject, modify or delete Pro Content at any time in its reasonable discretion. In the event of Houzz’s refusal to accept any Pro Content, Professional agrees to promptly substitute other Pro Content reasonably acceptable to Houzz. Notwithstanding any feedback, acceptance, or refusal of Pro Content, you remain responsible for all Pro Content.
  4. User Data. You may have access to or receive data through the Pro Services pertaining to others (like other Pro Services users or Clients, referred to collectively as “User Data”). You may use the User Data only for the intended purpose for which it was provided (i.e. to respond to the applicable person in a timely manner or as otherwise authorised) in accordance with these Terms, and all applicable data protection laws. You shall protect the confidentiality of User Data and use appropriate security safeguards to protect User Data against unauthorised or unlawful processing and against accidental loss, destruction, alteration, disclosure of or access to User Data. Without limiting the foregoing, you shall not sell User Data. You may share such User Data only to the extent authorised by the person to which such data relates provided that you are and remain responsible for ensuring compliance with this provision and all applicable laws. You will ensure that your use of User Data is at all times compliant with all applicable laws (including with respect to the period with which you retain it) and these Terms and that you honour requests by individuals exercising their rights under applicable law (e.g. with respect to not contacting the individual further, data deletion or data access etc.). If you receive any privacy inquiry or complaint from an individual, regulator or other party related to the use of User Data, you will promptly inform Houzz of such inquiry or complaint and will cooperate reasonably and in good faith to respond to such inquiry or complaint. If Houzz makes User Data available to you, for example, in the form of leads from our "Project Match" tool, “Additional Leads Pool” or similar features, Houzz has informed the individuals to which such User Data relates that their information will be provided to you for such purposes. You acknowledge that such individuals may withdraw their consent at any time, and you agree that you are responsible for complying with local laws relating to contact and consent.
  5. Communications with Clients. All communications with Clients must comply with applicable laws. If Clients don’t affirmatively respond to or are not otherwise receptive to your communications, you agree that you will cease communicating to such Clients. You understand and agree that you are the sender of, and responsible for, any of your communications through the Pro Services and Pro Platform, and Houzz is not the sender of your communications. It is your responsibility to comply with all applicable laws, including all opt-out and unsubscribe requests.
  6. User Disputes. You agree that you are solely responsible for your interactions or agreements with any other user of Houzz, the Pro Platform, the Pro Services, or Clients. Houzz has no liability or responsibility in connection with such interactions or agreements. We reserve the right, but have no obligation to become involved in any complaints, disputes, or disagreements between you and any other user of Houzz, the Pro Platform, the Pro Services, or Clients.
  7. Reviews. You understand and acknowledge that Houzz allows Clients and other users to post content about your business, including ratings and reviews. You agree that you will not, or will not assist, incentivise, encourage, or enable others to post any fake or defamatory reviews, post on behalf of a Client or other party, trade reviews with other users or Clients, or compensate someone or be compensated to post, refrain from posting, or remove a review. You understand and acknowledge that Houzz may employ automated software in an effort to showcase the most reliable and useful reviews while displaying other reviews less prominently. You understand and acknowledge that while Houzz tries to identify and suppress potentially less helpful reviews, Houzz may sometimes suppress legitimate reviews or fail to detect illegitimate reviews. You understand and acknowledge that any purchase of any paid features from Houzz will not allow or enable you, directly or indirectly, to alter reviews or impact whether reviews appear.

4. Billing and Payment

  1. Amounts Due. If you make a purchase of any Pro Services, you agree to pay for those purchases as set forth in these Terms as well as any other applicable Agreement. For example, if you pay for a Houzz Pro plan, you may receive an Agreement at the time of purchase (usually titled Pro Services Agreement) with details about the specific plan you purchased including the amounts due, applicable promotions, term, automatic renewals, and recurring billing. You agree that your purchase may be subject to additional fees or surcharges including but not limited to: recurring fees, usage-based fees, transaction fees deducted automatically, one-time fees, account-set-up fees, and surcharges for using a payment card.
  2. Promotions and Discounts. For clarity, unless otherwise expressly provided, any promotion or discount will only apply during the Initial Term for which the promotion or discount is applicable. Unless otherwise expressly provided the “Initial Term” is a 12-month period beginning on the date of purchase. Any free services provided in conjunction with a paid service will be provided only so long as you do not have payment amounts past due to Houzz.
  3. Non-Refundable. To the maximum extent permitted by applicable laws, all amounts payable to Houzz are non-refundable unless expressly provided otherwise. Houzz may set off amounts payable by Houzz to you against amounts payable by you to Houzz.
  4. Recurring Billing. For any paid Pro Services Houzz can automatically charge your stored payment method for the services. IF YOU PAID FOR A HOUZZ PRO PLAN YOUR PLAN WILL RENEW AUTOMATICALLY WITHOUT ADDITIONAL NOTICE FOR SUCCESSIVE 12-MONTH TERMS (EACH, A "RENEWAL TERM”) UNLESS YOU PROVIDE A NOTICE OF NON-RENEWAL AT LEAST 30 DAYS BEFORE THE EXPIRATION OF THE THEN-CURRENT INITIAL TERM OR RENEWAL TERM BY EMAILING PRONOTICES_UK@HOUZZ.COM.
  5. Price Increase. HOUZZ RESERVES THE RIGHT TO INCREASE THE PRICE FOR THE PRO SERVICES FROM TIME TO TIME. IN THE EVENT OF A PRICE INCREASE, HOUZZ SHALL PROVIDE YOU WITH WRITTEN NOTICE AT LEAST FORTY-FIVE (45) DAYS PRIOR TO THE INCREASE VIA THE EMAIL ADDRESS ASSOCIATED WITH YOUR ACCOUNT. SUCH CHANGE SHALL NOT REQUIRE ANY ADDITIONAL APPROVAL BY YOU AND WILL GO INTO EFFECT AS LISTED ON THE NOTICE. IF YOU DO NOT ACCEPT THE PRICE INCREASE YOU MUST CANCEL AND CEASE YOUR USE OF THE PRO SERVICES BEFORE THE END OF YOUR THEN-CURRENT TERM. CONTINUED USE OF THE PRO SERVICES AFTER THAT TIME WILL BE TAKEN AS ACCEPTANCE OF THE INCREASED PRICE.
  6. Payment Method. Houzz has the right to store your nominated payment method. You must promptly update your payment method and related information (for example, a change in your billing address or credit card expiration date) to maintain its accuracy and completeness. We may update the information and continue billing your payment method (e.g. credit card) even after it has expired or been updated, to avoid interruptions in the Pro Services and other transactions you authorise.
  7. Late Fees. If we are unable to collect any amounts owed by you, we may limit your use of the Pro Services. We may collect those amounts owed using any legal manner without prejudice to any other right or remedy we may be entitled to under these Terms or by law. In the event that Houzz brings any action or suit to collect any amounts owed, Houzz will be entitled to recover its costs, including reasonable attorneys' fees incurred in such collection. Any amounts past due will be subject to a late fee of the lesser of 1.5% per month or the maximum amount permitted by law. In the event that these Terms or any Agreement is breached due to non-payment, and then you subsequently pay the amounts due, these Terms and any Agreement(s) shall be automatically reinstated unless Houzz informs you otherwise.
  8. Taxes. You are responsible for paying all taxes, excluding only taxes based on Houzz's net income. If Houzz has the legal obligation to pay or collect taxes for which you are responsible under this Section, the appropriate amount shall be invoiced to and paid by you, unless you provide Houzz with a valid tax exemption certificate authorised by the appropriate taxing authority. Houzz may begin invoicing and charging such taxes to you at any time, which amount may vary based on changes to the tax rate or applicability. Your invoice will reflect the final total taxes in effect at the time of invoicing and for this reason may differ from the amount listed on an Agreement.

5. Term and Termination

  1. Term. These Terms will apply as long as you continue to access Pro Services. If you entered into another Agreement with Houzz, that other Agreement may include other details about terms for particular paid services. For example, if you paid for a Houzz Pro plan, it likely commences on the Effective Date (defined in the Agreement you received) and will continue twelve (12) months from the Effective Date. Thereafter the term would automatically renew without additional notice for successive 12-month terms (Renewal Terms) unless you provide notice of cancellation at least 30 days before the expiration of the then-current Initial or Renewal Term.
  2. Termination by Professional. If you only have a free Account you may terminate these Terms by ceasing to access or use your Pro Services. If you entered into another Agreement with Houzz, that other Agreement may include additional details about termination for the particular services. For example, if you paid for a Houzz Pro plan and wish to terminate that paid plan, your Agreement likely requires you to email Houzz at pronotices_UK@houzz.com and follow the instructions provided by Houzz in order for Houzz to process the termination.
  3. Termination by Houzz. In the event of your material breach of these Terms, Houzz may immediately terminate these Terms by providing written notice to you. If Houzz terminates these Terms for your material breach, Houzz has no obligation to refund any amounts to you and you shall immediately pay any additional amounts due to Houzz. These Terms may also be terminated by Houzz for any reason by providing you 30 days prior written notice. In such a case, Houzz will promptly refund you any prepaid amounts, on a pro rata basis, for any Pro Services not delivered.
  4. Effect of Termination. In the event of any termination of these Terms, whether by you or us, those sections that by their nature are intended to survive termination or expiration of this Agreement shall so survive in full force and effect including but not limited to sections 2(l), 3(b), 3(d), 3(e), 4, 5(d), and 6-19. Furthermore, at Houzz's discretion, Pro Content may continue to be published provided, however, upon your written request, Houzz will not attribute the Pro Content to you by name or contact information. Houzz may, but is under no obligation to keep any data collected from you. If Houzz provides a copy to any data, Houzz reserves the right to charge a fee for such requests, as permitted by applicable law.

6. Intellectual Property and Proprietary Rights

  1. Pro Content. Professional owns and retains all right, title and interest to Pro Content, subject to the following license granted to Houzz. Professional hereby grants Houzz and its affiliates, licensees and sublicensees a non-exclusive, worldwide, perpetual, irrevocable, royalty-free, fully paid-up, transferable, and fully sublicensable (through multiple tiers of sublicensees) license and right to use, reproduce, process, distribute, transmit, modify, publish, adapt, create derivative works of, publicly display and publicly perform Pro Content (or any portion thereof) in any format, media or distribution method (whether now known or hereafter created) in any manner Houzz deems appropriate or necessary (including for the purpose of providing the Pro Services and to promote Houzz). Such permission will be perpetual and may not be revoked for any reason, to the maximum extent permitted by law. Further, to the extent permitted under applicable law, you waive and release and covenant not to assert any moral rights that you may have in Pro Content. This Section, including the rights granted by you, does not impact the ownership of your Pro Content. For clarity, Houzz will not make your Proposals, Invoices, To-Do Lists, Schedules, Change Orders, or Time and Expense Tracking, publicly available except at your direction.
  2. Houzz Content and Houzz Materials. Houzz retains all right, title and interest in and to the Pro Services, Pro Platform, Houzz technology, and any content and information created or made available by Houzz (together “Houzz Content”). Except for the express licenses set forth in these Terms, there are no other licenses granted to you, express, implied or by way of estoppel. All rights not granted in these Terms are reserved by Houzz.
  3. Professional Restrictions. You may not use Houzz Content, Pro Minute, Pro Spotlight, Ad Content or other Houzz created content outside of the Pro Services or Pro Platform. You will not decompile, reverse engineer, disassemble or otherwise attempt to derive the source code for the Pro Services or Houzz platform and will not use the Houzz platform in a manner that is not expressly allowed under these Terms.
  4. Press Releases; Use of Houzz Marks. Without Houzz's prior written consent, You will not issue any press releases or public statements concerning Houzz or the Pro Services, including the Terms, or use, display or modify Houzz's trademarks.

7. Representations and Warranties

  1. You represent and warrant to Houzz that:
    1. You have read, understood, and agree to be bound by the Houzz Terms of Use, and Privacy Policy;
    2. You have the necessary power and authority to enter into these Terms. If you access the Pro Services on behalf of another entity or business, you represent and warrant that you have the authority to bind such entity or business to these Terms and that both you and such entity or business are jointly and severally liable;
    3. Houzz's use of Pro Content and Ad Content does not violate or infringe any intellectual property right, right of privacy, right of publicity, or any other proprietary or personal right of a third party, or constitute false advertising, fraud or misrepresentation;
    4. You have all necessary rights and authority to grant Houzz the rights granted under these these Terms with respect to Pro Content;
    5. Pro Content does not contain content that is obscene, defamatory, libelous, or slanderous, or otherwise harmful to, any person, corporation or other entity;
    6. Your use of the Pro Services, Pro Platform, User Data, and any offer or provision of services and products in connection with the Pro Platform, does not violate any applicable laws, ordinances, rules or regulations;
    7. You will comply at all times with the intellectual property restrictions set forth in these Terms; and
    8. You will not misrepresent your identity or affiliation to anyone in connection with Houzz.
  2. You also represent and warrant that you will not, and will not assist, encourage, or enable others to use the Pro Services to:
    1. Violate our Terms;
    2. Create multiple accounts for the same business in the same or different markets, or create accounts for businesses or services that are not supported by the Pro Platform;
    3. Post any fake or defamatory review, trade reviews with others, or compensate someone or be compensated to post, refrain from posting, or remove a review;
    4. Violate any third party’s rights, including any breach of confidence, copyright, trademark, patent, trade secret, moral right, privacy right, right of publicity, or any other intellectual property or proprietary right;
    5. Threaten, stalk, harm, or harass others, or promote bigotry or discrimination;
    6. Solicit personal information from minors;
    7. Violate any applicable law;
    8. Modify, adapt, appropriate, reproduce, distribute, translate, create derivative works or adaptations of, publicly display, sell, trade, or in any way exploit the Pro Services, Ad Content, or Pro Content, except as expressly authorised by Houzz;
    9. Use any robot, spider, service search/retrieval application, or other automated device, process or means to access, retrieve, copy, scrape, or index any portion of the Pro Services or any Ad Content, except as expressly permitted by Houzz;
    10. Reverse engineer any portion of the Pro Services, unless applicable law prohibits this restriction, in which case you agree to provide us with 30 days’ prior written notice by sending an email to legal@houzz.com;
    11. Record, process, or mine information about Clients or Pro Platform users;
    12. Access, retrieve or index any portion of the Pro Services for purposes of constructing or populating your own database of business reviews, or potential Clients;
    13. Reformat or frame any portion of the Pro Services;
    14. Take any action that imposes, or may impose, in our discretion, an unreasonable or disproportionately large load on Houzz’s technology infrastructure or otherwise make excessive traffic demands;
    15. Attempt to gain unauthorised access to the Pro Services, Account, computer systems or networks connected to the Pro Services through hacking, password mining or any other means;
    16. Use the Pro Services or any Ad or Pro Content to transmit any computer viruses, worms, defects, Trojan horses, malicious code, spyware, malware or other items of a destructive or harmful nature;
    17. Use any device, software or routine that interferes with the proper working of the Pro Services, or otherwise attempt to interfere with the proper working of the Pro Services;
    18. Use the Pro Services to violate the security of any computer network, crack passwords or security encryption codes; disrupt or interfere with the security of, or otherwise cause harm to, the Pro Services or Ad Content; or
    19. Remove, circumvent, disable, damage or otherwise interfere with any security-related features, features that prevent or restrict the use or copying of content, or features that enforce limitations on the use of the Pro Services or Pro Platform.

8. Indemnification and Defense

  1. Indemnification. You hereby agree to fully indemnify, defend, and hold harmless Houzz, its parents, subsidiaries, officers, directors, employees, agents, affiliates, distributors, service providers, partners, licensors, contractors, representatives and content providers (collectively, "Houzz Indemnified Parties") from and against any and all third-party claims, actions, demands, losses, damages, costs (including, without limitation, reasonable attorneys' fees), liabilities, expenses, and proceedings ("Claims") arising out of or relating to (i) your access to or use of the Pro Services, including your Pro Content, (ii) your violation of a material term of these Terms, (iii) your breach of your express representations and warranties provided under these Terms, (iv) any third party products or services purchased or obtained by you in connection with the Pro Services, (v) your products or services, or the marketing or provision thereof to any Client, (vi) any breach or mishandling of data by you, or (vii) the infringement by you, or any third party using your Account, or by the Photos, User Data, or Pro Content of any intellectual property or other right of any person or entity. Your counsel defending such Claim will be subject to Houzz's prior written approval, not to be unreasonably withheld. You agree not to settle any such matter without the prior written consent of Houzz. Houzz will use reasonable efforts to notify you of any such claim, action or proceeding upon becoming aware of it.

9. Limitation of Liability and Disclaimer

PLEASE READ THIS SECTION CAREFULLY BECAUSE IT LIMITS THE LIABILITY OF HOUZZ TO YOU. EACH OF THE SUBSECTIONS BELOW ONLY APPLIES UP TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW. NOTHING HEREIN IS INTENDED TO LIMIT ANY RIGHTS YOU MAY HAVE WHICH MAY NOT BE LAWFULLY LIMITED. BY ACCESSING OR USING THE PRO SERVICES, YOU REPRESENT THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO THESE TERMS, INCLUDING THIS SECTION. YOU ARE GIVING UP SUBSTANTIAL LEGAL RIGHTS BY AGREEING TO THESE TERMS.

  1. DISCLAIMER OF WARRANTIES. WHILE HOUZZ TAKES REASONABLE CARE TO PROVIDE THE SERVICES TO YOU, THE PRO SERVICES AND AD CONTENT ARE MADE AVAILABLE TO YOU ON AN “AS IS”, “WITH ALL FAULTS” AND “AS AVAILABLE” BASIS, WITH THE EXPRESS UNDERSTANDING THAT HOUZZ MAY NOT MONITOR, CONTROL, OR VET YOUR PRO CONTENT OR THIRD PARTY CONTENT. AS SUCH, YOUR USE OF THE PRO SERVICES IS AT YOUR OWN DISCRETION AND RISK. HOUZZ MAKES NO CLAIMS OR PROMISES ABOUT THE QUALITY, COMPLETENESS, ACCURACY, OR RELIABILITY OF THE PRO SERVICES, ITS SAFETY OR SECURITY, INCLUDING WITHOUT LIMITATION THE SECURITY OF YOUR DATA, OR THE AD CONTENT. ACCORDINGLY, HOUZZ IS NOT LIABLE TO YOU FOR ANY PERSONAL INJURY, LOSS OR DAMAGE THAT MIGHT ARISE, FOR EXAMPLE, FROM THE SERVICE’S INOPERABILITY, SERVICE UNAVAILABILITY, SECURITY VULNERABILITIES OR FROM YOUR RELIANCE ON THE QUALITY, ACCURACY, OR RELIABILITY, METRICS OR OTHER CONTENT FOUND ON, USED ON, OR MADE AVAILABLE THROUGH THE PRO SERVICES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, HOUZZ SPECIFICALLY DISCLAIMS ANY AND ALL REPRESENTATIONS OR WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, REGARDING THE SERVICES, INCLUDING, WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, OR FITNESS FOR A PARTICULAR PURPOSE. WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, HOUZZ SPECIFICALLY DISCLAIMS ANY WARRANTY OR LIABILITY REGARDING THE FOLLOWING: (i) THE NUMBER OF PERSONS OR PERCENTAGE OF A USER POPULATION WHO WILL ACCESS, VIEW OR INTERACT WITH YOUR ACCOUNT, PRO CONTENT, HOUZZ CONTENT, PRO SERVICES, HOUZZ PLATFORM, OR PRO PLATFORM (ii) SPECIFIC RESULTS OR PERFORMANCE (INCLUDING LEADS, IMPRESSIONS, CLICKS OR REVENUE) YOU MIGHT OBTAIN FROM THE SERVICES, (iii) THE HOUZZ CONTENT OR THE PRO PLATFORM OR THIRD PARTY SERVICES, OR (iv) THAT THE PRO PLATFORM OR PRO SERVICES PROVIDED UNDER THESE TERMS OR THIRD PARTY SERVICES WILL BE UNINTERRUPTED OR ERROR FREE.
  2. THIRD-PARTIES. HOUZZ MAKES NO CLAIMS OR PROMISES WITH RESPECT TO ANY THIRD PARTY AVAILABLE ON THE PRO PLATFORM. ACCORDINGLY, HOUZZ IS NOT LIABLE TO YOU FOR ANY PERSONAL INJURY, LOSS OR DAMAGE THAT MIGHT ARISE FROM ANY SUCH THIRD PARTY’S ACTIONS OR OMISSIONS, INCLUDING, FOR EXAMPLE, IF ANOTHER USER OR CLIENT MISUSES YOUR CONTENT, IDENTITY OR PERSONAL INFORMATION, OR IF YOU HAVE A NEGATIVE EXPERIENCE WITH ONE OF THE THIRD PARTIES. YOUR PURCHASE AND USE OF PRODUCTS OR SERVICES OFFERED BY THIRD PARTIES THROUGH THE PRO SERVICES IS AT YOUR OWN DISCRETION AND RISK.
  3. REMEDY. YOUR SOLE AND EXCLUSIVE RIGHT AND REMEDY IN CASE OF DISSATISFACTION WITH THE PRO SERVICES OR ANY OTHER GRIEVANCE SHALL BE, WHERE REASONABLY FEASIBLY, OUR RE-PERFORMANCE OF SUCH SERVICES OR YOUR TERMINATION AND DISCONTINUATION OF ACCESS TO, OR USE OF THE PRO SERVICES. IN CASES OF MATERIAL BREACH OF THESE TERMS SUCH TERMINATION SHALL BE WITHOUT PENALTY.
  4. LIMITATION OF LIABILITY. EITHER PARTY’S LIABILITY SHALL BE LIMITED TO THE MAXIMUM EXTENT PERMITTED BY LAW, AND EITHER PARTY WILL NOT BE LIABLE TO THE OTHER PARTY FOR ANY (i) INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, EXEMPLARY, RELIANCE, OR CONSEQUENTIAL DAMAGES, (ii) LOSS OF PROFITS OR REVENUE, (iii) BUSINESS INTERRUPTION, (iv) REPUTATIONAL HARM, OR (v) LOSS OF INFORMATION OR DATA. THE WAIVERS AND LIMITATIONS SPECIFIED IN THIS SECTION 9 WILL SURVIVE AND APPLY REGARDLESS OF THE FORM OF ACTION, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR OTHERWISE.
  5. MAXIMUM LIABILITY. EXCEPT FOR YOUR INDEMNITY OBLIGATIONS, A PARTY’S MAXIMUM AGGREGATE LIABILITY TO THE OTHER PARTY FOR LOSSES OR DAMAGES THAT THE OTHER PARTY SUFFERS IN CONNECTION WITH THE PRO SERVICES OR THESE TERMS IS LIMITED TO THE GREATER OF (i) THE AMOUNT PAID, IF ANY, BY YOU TO HOUZZ IN CONNECTION WITH THE SERVICE IN THE 12 MONTHS PRIOR TO THE ACTION GIVING RISE TO LIABILITY. NOTHING IN THIS SECTION 9 WILL BE DEEMED TO LIMIT YOUR OBLIGATIONS IN SECTION 8.

10. Communications

  1. Consent. Subject to compliance with applicable laws, you agree to receive promotional text messages, calls and pre-recorded messages, any of which may be generated by automatic telephone dialing systems. You are not required to agree to receive these communications as a condition of purchasing the Pro Services. However, as part of the Pro Services, you agree that Houzz and its affiliates may communicate with you via text message, call, email, or push notification and pre-recorded messages. Standard text message charges applied by your telephone carrier may apply to SMS we send. If you wish to stop receiving promotional emails or promotional text messages, we provide the following methods for you to opt-out or unsubscribe: (i) follow the instructions we provide in the email or initial text message for that category of promotional emails or text messages, or (ii) opt-out or unsubscribe using your device settings.

11. Relationship

  1. Independent Contractors. You are not an agent, representative or partner of Houzz, and you have no authority to enter into any agreement to bind Houzz. Houzz and you are independent contractors as it relates to these Terms.

12. Controlling Law and Jurisdiction

  1. Choice of Law. These Terms will be interpreted in accordance with the laws of the State of California and the United States of America, without regard to their conflict-of-law provisions. You and Houzz agree to submit to the personal jurisdiction of a federal or state court located in San Francisco, California for any actions for which the arbitration provision, as set forth in Section 17, does not apply.
  2. EEA Residents. If you are a resident of a country located in the EEA, United Kingdom law will govern these Terms, as well as any disputes that may arise between you and Houzz. You agree that any subpoena, third-party discovery request, or other third-party process directed to Houzz must issue from, or be domesticated by, the state or federal courts located within San Francisco County, California and you agree to submit to the jurisdiction of each of these courts for any related proceedings.

13. Translation

  1. Translation. We may translate these Terms into other languages for your convenience. Nevertheless, the English version governs your relationship with Houzz and any inconsistencies among the different versions will be resolved in favour of the English version available here.

14. Assignment and Waiver

  1. Assignment. These Terms are not assignable in whole or in part by you without the prior written consent of Houzz. Houzz may delegate any or all of its obligations under these Terms. Houzz may assign or transfer these terms to any of its affiliates or in connection with a sale of all or substantially all of its assets, restructuring, change of control, merger, acquisition of Houzz, its affiliates or any of their respective businesses. These Terms will be binding on, inure to the benefit of, and be enforceable against the parties and their respective successors and assigns.

15. Waiver

  1. Waiver. Waiver of rights resulting from breach of any provision hereof will not be deemed to constitute a waiver of rights resulting from any previous or succeeding breach of the same or any other provision. Houzz will not be deemed to waive any of its rights under these Terms unless expressly waived in a signed writing by Houzz.

16. Other Agreements

  1. Other Agreements. These Terms together with any other applicable service Agreement(s) constitute the entire agreement and supersedes all other verbal agreements or written documents, including emails, between you and Houzz relating the subject matter of the services. In the event of a direct conflict between these Terms and the Terms of Use, The Terms of Use will control with respect to the subject matter of the conflict. In the event of a conflict between these Terms and an Agreement, these Terms will control with respect to the subject matter of the conflict. Except for any representations and warranties specifically set forth in these Terms, Professional will not rely on any representation or statement made by Houzz or any Houzz representatives or any third parties. Without limiting the foregoing, unless agreed in a writing signed by an authorised representative of Houzz (i.e. Director or Vice President at Houzz), any terms set forth in any email will be void and have no effect.

17. Dispute Resolution

  1. Informal Resolution. If you have a dispute with Houzz, you agree to attempt to resolve the issue informally first by contacting your Houzz representative at pronotices_UK@houzz.com. If the Houzz representative cannot resolve your issue they may in their reasonable discretion escalate the issue to the Houzz Legal Team and/or the Houzz Leadership Team. If we are not able to resolve the dispute informally, then the below sub-sections will govern any legal dispute that relates to the Pro Services.
  2. Binding Arbitration. You and Houzz agree that any dispute, claim or controversy arising out of or relating to the Agreement or these Terms or to your use of the Pro Platform (collectively "Disputes") will be settled by binding arbitration, except that each party retains the right to seek injunctive or other equitable relief in a court of competent jurisdiction to prevent the actual or threatened infringement, misappropriation, or violation of a party's copyrights, trademarks, trade secrets, patents, or other intellectual property rights. This means that you and Houzz both agree to waive the right to a trial by jury.
  3. Class Action Waiver. You and Houzz agree that any proceedings to resolve Disputes will be conducted on an individual basis and not in a class, consolidated, or representative action. This means that, in connection with any Dispute, you and Houzz both agree to waive the right to participate as a plaintiff as a class member in any class action proceeding. Further, unless you and Houzz agree otherwise in writing, the arbitrator in any Dispute may not consolidate more than one person's claims and may not preside over any form of class action proceeding.
  4. Arbitration Administration and Rules. The arbitration will be administered by the American Arbitration Association ("AAA") in accordance with the Commercial Arbitration Rules then in effect (the "AAA Rules"), except as modified by this "Dispute Resolution" section. (The AAA Rules are available at http://www.adr.org.)
  5. Arbitration Process. A party who desires to initiate the arbitration must provide the other party with a written Demand for Arbitration as specified in the AAA Rules. The arbitrator will be either a retired judge or an attorney licensed to practice law and will be selected by the parties from the AAA's roster of arbitrators with relevant experience. If the parties are unable to agree upon an arbitrator within 7 days of delivery of the Demand for Arbitration, then the AAA will appoint the arbitrator in accordance with AAA Rules.
  6. Arbitration Location and Procedure. The seat of the arbitration shall be in San Francisco, California unless you and Houzz agree otherwise or the AAA Rules provide otherwise. If your claim does not exceed USD$10,000, then the arbitration will be conducted solely on the basis of documents you and Houzz submit to the arbitrator, unless you request a hearing and the arbitrator then determines that a hearing is necessary. If your claim exceeds USD$10,000, your right to a hearing will be determined by AAA Rules. Subject to AAA Rules, the arbitrator will have the discretion to direct a reasonable exchange of information by the parties, consistent with the expedited nature of the arbitration. Hearings may be conducted by telephone or video conference, if requested and agreed to by the parties.
  7. Arbitrator's Decision and Governing Law. The arbitrator shall apply California law consistent with the Federal Arbitration Act and applicable statutes of limitations, and shall honour claims of privilege recognised by law. The arbitrator will render an award within the timeframe specified in the AAA Rules. Judgment on the arbitration may be entered in any court having jurisdiction thereof. Any award of damages by an arbitrator must be consistent with the "Limitation of Liability; Disclaimer" section above. The arbitrator may award declaratory or injunctive relief in favour of the claimant only to the extent necessary to provide relief warranted by the claimant's individual claim.
  8. Fees. Each party's responsibility to pay the arbitration filing, administrative and arbitrator fees will depend on the circumstances of the arbitration and are set forth in the AAA Rules.

18. Force Majeure

  1. Force Majeure. Except for payment obligations, neither party will be considered in default due to any delay or failure in performance based on any event or circumstances beyond its reasonable control, including, but not limited to failure of the Internet or related networks, fire, strike, embargo, requirement of governmental, civil or military authority, act of God, or failure of suppliers. When the delaying cause ceases, each party will resume performance, subject to an equitable schedule adjustment if necessary.

19. Severability

  1. Severability. In the event that any portion of these Terms is deemed illegal or unenforceable under applicable law, such provision shall be severed and the remainder of these Terms shall be given full force and effect.

Click here for the prior revision


STANDARD CONTRACTUAL CLAUSES – MODULE ONE: Transfer Controller to Controller (C2C)


SECTION I

Clause 1
Purpose and scope
  1. The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)1 for the transfer of personal data to a third country.
  2. The Parties:
    1. the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A. (hereinafter each “data exporter”), and
    2. the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A. (hereinafter each “data importer”)

    have agreed to these standard contractual clauses (hereinafter: “Clauses”).

  3. These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
  4. The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses
  1. These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46 (2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
  2. These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
Clause 3
Third-party beneficiaries
  1. Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
    1. Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
    2. Clause 8 - Clause 8.5 (e) and Clause 8.9(b);
    3. Clause 9 - [not used in Module One (C2C) Standard Contractual Clauses];
    4. Clause 12 - Clause 12(a) and (d);
    5. Clause 13;
    6. Clause 15.1(c), (d) and (e);
    7. Clause 16(e);
    8. Clause 18 - Clause 18(a) and (b).
  2. Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
Clause 4
Interpretation
  1. Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
  2. These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
  3. These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6
Description of the transfer(s)

The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

Clause 7
Docking clause
  1. An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.
  2. Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.
  3. The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party.

SECTION II - OBLIGATIONS OF THE PARTIES

Clause 8
Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.

8.1 Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B. It may only process the personal data for another purpose:

  1. where it has obtained the data subject’s prior consent;
  2. where necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or
  3. where necessary in order to protect the vital interests of the data subject or of another natural person.
8.2 Transparency
  1. In order to enable data subjects to effectively exercise their rights pursuant to Clause 10, the data importer shall inform them, either directly or through the data exporter:
    1. of its identity and contact details;
    2. of the categories of personal data processed;
    3. of the right to obtain a copy of these Clauses;
    4. where it intends to onward transfer the personal data to any third party/ies, of the recipient or categories of recipients (as appropriate with a view to providing meaningful information), the purpose of such onward transfer and the ground therefore pursuant to Clause 8.7.
  2. Paragraph (a) shall not apply where the data subject already has the information, including when such information has already been provided by the data exporter, or providing the information proves impossible or would involve a disproportionate effort for the data importer. In the latter case, the data importer shall, to the extent possible, make the information publicly available.
  3. On request, the Parties shall make a copy of these Clauses, including the Appendix as completed by them, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the Parties may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.
  4. Paragraphs (a) to (c) are without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.
8.3 Accuracy and data minimisation
  1. Each Party shall ensure that the personal data is accurate and, where necessary, kept up to date. The data importer shall take every reasonable step to ensure that personal data that is inaccurate, having regard to the purpose(s) of processing, is erased or rectified without delay.
  2. If one of the Parties becomes aware that the personal data it has transferred or received is inaccurate, or has become outdated, it shall inform the other Party without undue delay.
  3. The data importer shall ensure that the personal data is adequate, relevant and limited to what is necessary in relation to the purpose(s) of processing.
8.4 Storage limitation

The data importer shall retain the personal data for no longer than necessary for the purpose(s) for which it is processed. It shall put in place appropriate technical or organisational measures to ensure compliance with this obligation, including erasure or anonymisation2 of the data and all back-ups at the end of the retention period.

8.5 Security of processing
  1. The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the personal data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access (hereinafter “personal data breach”). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subject. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner.
  2. The Parties have agreed on the technical and organisational measures set out in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
  3. The data importer shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
  4. In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the personal data breach, including measures to mitigate its possible adverse effects.
  5. In case of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the data importer shall without undue delay notify both the data exporter and the competent supervisory authority pursuant to Clause 13. Such notification shall contain i) a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), ii) its likely consequences, iii) the measures taken or proposed to address the breach, and iv) the details of a contact point from whom more information can be obtained. To the extent it is not possible for the data importer to provide all the information at the same time, it may do so in phases without undue further delay.
  6. In case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the data importer shall also notify without undue delay the data subjects concerned of the personal data breach and its nature, if necessary in cooperation with the data exporter, together with the information referred to in paragraph (e), points ii) to iv), unless the data importer has implemented measures to significantly reduce the risk to the rights or freedoms of natural persons, or notification would involve disproportionate efforts. In the latter case, the data importer shall instead issue a public communication or take a similar measure to inform the public of the personal data breach.
  7. The data importer shall document all relevant facts relating to the personal data breach, including its effects and any remedial action taken, and keep a record thereof.
8.6 Sensitive data

Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions or offences (hereinafter “sensitive data”), the data importer shall apply specific restrictions and/or additional safeguards adapted to the specific nature of the data and the risks involved. This may include restricting the personnel permitted to access the personal data, additional security measures (such as pseudonymisation) and/or additional restrictions with respect to further disclosure.

8.7 Onward transfers

The data importer shall not disclose the personal data to a third party located outside the European Union3 (in the same country as the data importer or in another third country, hereinafter “onward transfer”) unless the third party is or agrees to be bound by these Clauses, under the appropriate Module. Otherwise, an onward transfer by the data importer may only take place if:

  1. it is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;
  2. the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU) 2016/679 with respect to the processing in question;
  3. the third party enters into a binding instrument with the data importer ensuring the same level of data protection as under these Clauses, and the data importer provides a copy of these safeguards to the data exporter;
  4. it is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings;
  5. it is necessary in order to protect the vital interests of the data subject or of another natural person; or
  6. where none of the other conditions apply, the data importer has obtained the explicit consent of the data subject for an onward transfer in a specific situation, after having informed him/her of its purpose(s), the identity of the recipient and the possible risks of such transfer to him/her due to the lack of appropriate data protection safeguards. In this case, the data importer shall inform the data exporter and, at the request of the latter, shall transmit to it a copy of the information provided to the data subject.

Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.

8.8 Processing under the authority of the data importer

The data importer shall ensure that any person acting under its authority, including a processor, processes the data only on its instructions.

8.9 Documentation and compliance
  1. Each Party shall be able to demonstrate compliance with its obligations under these Clauses. In particular, the data importer shall keep appropriate documentation of the processing activities carried out under its responsibility.
  2. The data importer shall make such documentation available to the competent supervisory authority on request.
Clause 9
Use of sub-processors
[Not used in Module One (C2C) Standard Contractual Clauses]
Clause 10
Data subject rights
  1. The data importer, where relevant with the assistance of the data exporter, shall deal with any enquiries and requests it receives from a data subject relating to the processing of his/her personal data and the exercise of his/her rights under these Clauses without undue delay and at the latest within one month of the receipt of the enquiry or request4. The data importer shall take appropriate measures to facilitate such enquiries, requests and the exercise of data subject rights. Any information provided to the data subject shall be in an intelligible and easily accessible form, using clear and plain language.
  2. In particular, upon request by the data subject the data importer shall, free of charge:
    1. provide confirmation to the data subject as to whether personal data concerning him/her is being processed and, where this is the case, a copy of the data relating to him/her and the information in Annex I; if personal data has been or will be onward transferred, provide information on recipients or categories of recipients (as appropriate with a view to providing meaningful information) to which the personal data has been or will be onward transferred, the purpose of such onward transfers and their ground pursuant to Clause 8.7; and provide information on the right to lodge a complaint with a supervisory authority in accordance with Clause 12(c)(i);
    2. rectify inaccurate or incomplete data concerning the data subject;
    3. erase personal data concerning the data subject if such data is being or has been processed in violation of any of these Clauses ensuring third-party beneficiary rights, or if the data subject withdraws the consent on which the processing is based.
  3. Where the data importer processes the personal data for direct marketing purposes, it shall cease processing for such purposes if the data subject objects to it.
  4. The data importer shall not make a decision based solely on the automated processing of the personal data transferred (hereinafter “automated decision”), which would produce legal effects concerning the data subject or similarly significantly affect him / her, unless with the explicit consent of the data subject or if authorised to do so under the laws of the country of destination, provided that such laws lays down suitable measures to safeguard the data subject’s rights and legitimate interests. In this case, the data importer shall, where necessary in cooperation with the data exporter:
    1. inform the data subject about the envisaged automated decision, the envisaged consequences and the logic involved; and
    2. implement suitable safeguards, at least by enabling the data subject to contest the decision, express his/her point of view and obtain review by a human being.
  5. Where requests from a data subject are excessive, in particular because of their repetitive character, the data importer may either charge a reasonable fee taking into account the administrative costs of granting the request or refuse to act on the request.
  6. The data importer may refuse a data subject’s request if such refusal is allowed under the laws of the country of destination and is necessary and proportionate in a democratic society to protect one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679.
  7. If the data importer intends to refuse a data subject’s request, it shall inform the data subject of the reasons for the refusal and the possibility of lodging a complaint with the competent supervisory authority and/or seeking judicial redress.
Clause 11
Redress
  1. The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
  2. In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
  3. Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:
    1. lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;
    2. refer the dispute to the competent courts within the meaning of Clause 18.
  4. The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
  5. The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
  6. The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.
Clause 12
Liability
  1. Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
  2. Each Party shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages that the Party causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter under Regulation (EU) 2016/679.
  3. Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
  4. The Parties agree that if one Party is held liable under paragraph (c), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its / their responsibility for the damage.
  5. The data importer may not invoke the conduct of a processor or sub-processor to avoid its own liability.
Clause 13
Supervision
  1. The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
  2. The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.

SECTION III - LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES

Clause 14
Local laws and practices affecting compliance with the Clauses
  1. The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
  2. The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:
    1. the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;
    2. the laws and practices of the third country of destination- including those requiring the disclosure of data to public authorities or authorising access by such authorities - relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards5;
    3. any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.
  3. The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.
  4. The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.
  5. The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).
  6. Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities
15.1 Notification
  1. The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:
    1. receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or
    2. becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.
  2. If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.
  3. Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authorities, whether requests have been challenged and the outcome of such challenges, etc.).
  4. The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent suspensory authority on request.
  5. Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.
15.2 Review of legality and data minimisation
  1. The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
  2. The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.
  3. The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.

SECTION IV - FINAL PROVISIONS

Clause 16
Non-compliance with the Clauses and termination
  1. The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
  2. In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
  3. The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
    1. the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;
    2. the data importer is in substantial or persistent breach of these Clauses; or
    3. the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.

    In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.

  4. Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
  5. Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law

These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Germany.

Clause 18
Choice of forum and jurisdiction
  1. Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
  2. The Parties agree that those shall be the courts of Germany.
  3. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.
  4. The Parties agree to submit themselves to the jurisdiction of such courts.


1 Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295 of 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision […].

2 This requires rendering the data anonymous in such a way that the individual is no longer identifiable by anyone, in line with recital 26 of Regulation (EU) 2016/679, and that this process is irreversible

3 The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union's internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses.

4 That period may be extended by a maximum of two more months, to the extent necessary taking into account the complexity and number of requests. The data importer shall duly and promptly inform the data subject of any such extension.

5 As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.


APPENDIX

ANNEX I

A. LIST OF PARTIES

Data exporter(s):

1. Name: As detailed in Customer’s Pro Profile.
Address: As detailed in Customer’s Pro Profile.
Contact person’s name, position and contact details: As detailed in Customer’s Pro Profile.
Activities relevant to the data transferred under these Clauses: Providing the personal data necessary to execute the Houzz Pro Services Agreement.
Signature and date: At the same time as the Data Exporter is entering into the Houzz Pro Services Agreement, also the SCCs, which forms an integral part of the Houzz Pro Services Agreement, are concluded.
Role (controller/processor): Controller

Data importer(s): [Identity and contact details of the data importer(s), including any contact person with responsibility for data protection]

1. Name: Houzz Inc.
Address: 285 Hamilton Avenue, Palo Alto, CA, USA 94301
Contact person’s name, position and contact details: EUprivacy@houzz.com
Activities relevant to the data transferred under these Clauses: Processing the personal data necessary to execute the Houzz Pro Services Agreement.
Signature and date: At the same time as the Data Exporter is entering into the Houzz Pro Services Agreement, also the SCCs, which forms an integral part of the Houzz Pro Services Agreement, are concluded.
Role (controller/processor): Controller
В. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred The employees, representatives, suppliers, service providers, subcontractors, customers and prospective customers of Data Exporter.
Categories of personal data transferred Identification data including, without limitation, first and last name, email address, telephone number, address (business or personal); online usage data; communications data; electronic identification data including location data; financial data (if provided); affiliations, education and training (if provided); and profession and job data.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures. N/A
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis). Continuous basis
Nature of the processing Collection, recording, organisation, storage, use, disclosure by transmission, dissemination or otherwise making available
Purpose(s) of the data transfer and further processing For Data Importer to perform the Services, improve and customize the Services and Houzz Platform, and for any other purposes described in Section 2(b) and Section 10(b) of the Agreement.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period For the duration of the Houzz account
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing N/A
C. COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with Clause 13 The competent supervisory authority/ies depends on the location of the data exporter as detailed in Customer’s Pro Profile.

ANNEX II - TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services A periodic business continuity review is conducted between business, product, legal, and engineering stakeholders. Security and data privacy for all third-party data processing is reviewed as part of the vendor risk assessment process. Various technical controls are implemented to ensure the security of processing systems and services, including (but not limited to): endpoint detection and response (EDR) agents on production hosts, anti-virus agents on corporate endpoints, mobile device management (MDM) on corporate endpoints, production access via software-defined-perimeter (SDP), separate development and production environments, and centralized system event logging and aggregation.
Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident Engineering has implemented regular exports of platform and user data from runtime databases. These exports are securely backed up into archival data storage to allow for access and restoration when needed.
Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing Systems, applications, and procedures are subject to periodic internal and external audits. Examples include vulnerability scanning of the platform web application.
Measures for user identification and authorisation Authentication for systems is handled via centralized single-sign-on with defined policies for credential strength and multi-factor-authentication. Authorization to sensitive platform functionality is limited via defined roles to personnel with authority and access under documented procedures.
Measures for the protection of data during transmission Platform access (e.g. websites and native applications) is only allowed via encrypted client connections (HTTPS protocol). Only secure encryption schemes are supported (for example, TLS v1.1 and below and SSL are not supported due to known vulnerabilities).
Measures for the protection of data during storage Sensitive data is protected in systems using cryptographically strong encryption. Access to production systems is done via software-defined-perimeter (SDP) and centralized single-sign-on account management. IaaS account access enforces best practices for authentication, including multi-factor-authentication and key rotation.
Measures for ensuring physical security of locations at which personal data are processed Individual key fob access is required for physical entry.
Measures for ensuring events logging Continuous monitoring, review, and remediation of event processing and data quality is performed by data analysts and Head of Data Governance.
Measures for internal IT and IT security governance and management Policies and procedures are implemented and reviewed regularly by engineering leadership, Head of IT, and Head of Security
Measures for ensuring data minimisation Regular product reviews and consultation sessions are held between legal, product and engineering teams.
Measures for ensuring limited data retention The defined data retention policy is reviewed regularly by legal, Head of IT, Head of Security, and engineering leadership.
Measures for allowing data portability and ensuring erasure Data privacy program policies and procedures are regularly reviewed by Privacy Program Manager and Engineering leadership.

For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter

N/A N/A