APPLY TO AWAL
AWAL DISTRIBUTION AGREEMENT
Capitalized terms (as well as “you” and “your”) are used as defined herein. Key definitions:
“Agreement” means this AWAL Distribution Agreement.
“AWAL” means AWAL Digital Limited (Company Number 4430703) with a registered office at 2 Canal Reach, London N1C 4DB.
“Digital Distribution” means distribution (or other authorization of use) of the Recordings by any current or future means or media as selected by AWAL in good faith, other than the distribution of physical products.
“Outlets” is defined in Section 1.01.
“Product Uploader” means the software, features and tools provided or made available by AWAL via which digital files can be added to the AWAL Portal.
“Properties” means all Recordings and all material to be delivered and exploited under this Agreement (including anything delivered by you (or on your behalf) under Section 1.02.
“Recordings” means all audio and/or audio‐visual recordings of commercial quality (as determined in AWAL’s sole discretion) delivered by You (in your sole discretion) to AWAL during the Term, including via the Product Uploader.
“Talent” means all recording artists, musicians, vocalists, producers, (re-)mixers, writers, musical performing artists, engineers, sample rights owners, songwriters, photographers, crew and any and all others who performed or participated in the making of any Properties.
“Term” commences on the date AWAL sends to you an email agreeing to be bound by these Terms & Conditions (“Effective Date”) and continues until terminated by either party on 30 days’ written notice in accordance with these Terms & Conditions.
“Territory” means the world, except as more narrowly specified by you via the Product Uploader on a Recording by Recording basis.
“you,” “your” and “Client” each mean the individual or legal entity which registered your application via the AWAL website and, to the extent you are a legal entity, "you," “your” and “Client” also mean the recording artist or other individual(s) who own(s) the entity.
1. Distribution Rights.
1.01 AWAL as Distributor. You hereby appoint AWAL as the exclusive distributor of the Recordings during the Term and throughout the Territory, via Digital Distribution. This appointment includes the exclusive rights to sell, copy, distribute, perform, sublicense, monetize and otherwise exploit the Recordings (or any part thereof) via any and all forms of Digital Distribution, including direct to retailers, digital service providers, direct to consumers, and to others of any description that exploit sound or audiovisual recordings by any and all means and media (whether now known or existing in the future) as selected by AWAL in its discretion (“Outlets”), including as “art tracks” (such as via YouTube), and to sublicense such rights to Outlets accordingly. The appointment also includes the right to obtain for and assign to the Recordings ISRC and EAN/UPC‐A codes as needed. However, you reserve the right to request a takedown of any applicable Recording on thirty (30) days’ Notice hereunder, for convenience or for any other reason in your sole discretion, after which AWAL’s exclusivity with respect to such Recording will terminate unless and until you elect to redeliver it to AWAL hereunder.
1.02 Artwork; Name & Likeness. You hereby grant AWAL and the Outlets the right, solely in order to exploit and promote the Properties, to use: (i) artists’ names, trademarks, logos, likenesses, photographs and biographical material, and (ii) album and production artwork, video stills, thumbnail images, and the names, likenesses and biographical material of Talent; but solely to the extent delivered or otherwise approved by you.
2. AWAL’s Distribution Activities.
2.01 General. As between you and AWAL, you retain copyright ownership of all Recordings and expressly reserve all rights in and to the Properties not expressly granted to AWAL. AWAL does not guarantee placement of Recordings with any Outlet, and is not obliged to distribute Recordings delivered by you (including if a Recording is technically unsatisfactory or inappropriate in any way), but AWAL will promptly notify you as to the extent of any decision not to distribute and all applicable Digital Distribution rights in the relevant Recording will revert to you on AWAL’s notification. You acknowledge that the sale and exploitation of Properties is a highly speculative business, that AWAL makes no guarantee as to any degree of sales or exploitations, and that AWAL retains absolute discretion over its sales and exploitation policies.
2.02 Affiliates and Contractors. AWAL may elect to operate in part via its corporate affiliates and third-party contractors, and may sublicense its rights hereunder to the extent needed for such operations. However, AWAL remains directly liable for all of its payment and other obligations to you subject to Section 4 below.
2.03 AWAL Portal Access. In connection with your Recordings, AWAL will provide you access to release and track-level sales and streaming reporting via AWAL’s workstation portal. Subject to the Data Privacy Addendum (incorporated hereto as an Exhibit), applicable data protection and privacy laws and regulation, AWAL may use information and data arising from or generated, obtained, or acquired by AWAL in connection with the exploitation of Properties, including demographic, statistical, usage and anonymised data relating to such activity, including for purposes of calculating AWAL’s market share.
3. Your Obligations.
3.01 Delivery. You are solely responsible, at your cost, for the creation and delivery to AWAL of all Properties. AWAL will not remix, re-master, edit or alter any Recording (except as required for technical or timing reasons), without your prior written approval. You are responsible for audio and video encoding costs prior to delivery. If AWAL incurs any further encoding costs, AWAL may in its discretion deduct such amounts from any payments due to you, or request reimbursement of any such amounts and you will promptly pay AWAL such amounts.
3.02 Third-Party Consents, Permissions, Obligations. In connection with exploitation of the Properties under this Agreement, you are solely responsible for all costs and expenses (other than storage costs in connection with the Recordings), and any obligations or liabilities to third parties related to the exploitations authorised in this Agreement. For example, you are responsible for (a) taxes that you owe; (b) clearing the rights of and paying amounts due to Talent, and any other persons who contributed to the Properties; (c) amounts due to any party for samples, or for footage in the Properties; (d) music publishing licenses, including synchronization, lyric use and mechanical licenses to the extent not covered by the Outlets; (e) any advertising, marketing or promotion you choose to do; and (f) sound recording and artwork clearances. To the extent you fail to cover any of the foregoing, AWAL has the right but not the obligation to cover them for you, and to deduct such amounts from any payments due to you, or request reimbursement of any such amounts and you will promptly pay AWAL such amounts.
3.03 Notification of Changes to Rights, Claims. Without limiting your warranties or your indemnification obligations, if you no longer have the necessary rights to an individual Recording or other Property, or if the Property is the subject of any third-party Claim (as defined below), you must promptly inform AWAL as set forth in Section 6 below.
3.04 AWAL Content Guidelines. All Recordings and other Properties must abide by the terms of the AWAL Content Guidelines (as updated from time to time), and must comply in all respects with all applicable “style guides” (or content guidelines or community guidelines, etc.) of Outlets, including the iTunes Style Guide and the Spotify Content Infringement Guidelines. If AWAL believes in good faith that you have violated this Section 3.04, AWAL may: (i) withhold payments to you until such violation is resolved and remedied to AWAL’s reasonable satisfaction; (ii) issue take-downs of any offending Recordings and other Properties; and/or (iii) terminate this Agreement upon notice to you, with immediate effect.
3.05 Fraudulent Practices. You will not, and will not authorise or encourage any third party to, directly or indirectly manipulate streams or queries, or generate impressions of or clicks on any ad(s), through any automated, deceptive, fraudulent or other invalid means, including by way of repeated manual clicks, the use of “bots,” the hijacking of accounts or otherwise. You acknowledge that doing so may result in the removal of some or all of your Properties from Outlets, as well as the withholding of royalties by such Outlets. In addition, in no event will you represent yourself as AWAL’s, The Orchard’s or Sony Music’s representative, or use any of their trademarks without express permission, or represent yourself as affiliated or connected with them in any way that is not strictly accurate, whether in connection with this Agreement or otherwise. Both you and AWAL may accurately state that your Recordings are “distributed by AWAL” but AWAL’s express prior written approval is required should you wish to use the AWAL logo and/or name and/or brand anywhere in connection with the Recordings (including without limitation on any so-called “P” and “C” lines).” If AWAL believes in good faith that you have violated this Section 3.05, AWAL may: (i) withhold payments to you until such suspected fraud is resolved and remedied to AWAL’s reasonable satisfaction; (ii) issue take-downs of any offending Recordings and other Properties; and/or (iii) terminate this Agreement upon notice to you, with immediate effect.
4. Distribution Share; Accountings, Audits, Claim Limits, Tax and Reimbursements.
4.01 Distribution Share. AWAL will pay you eighty-five percent (85%) of all gross receipts actually received by (or credited against an advance to) AWAL with respect to Digital Distribution of the Recordings to end users, subject to Section 4.03 below (your “Distribution Share”).
4.02 Accountings; Audits; Limitations on Claims. AWAL will account to you by way of a permission-limited section of your AWAL Portal, which generally includes historical data back to the Effective Date. Accounting and payments will be made available to you on a monthly basis, forty-five (45) days after the end of the month in which the applicable amounts were received by AWAL. Monthly balances under the equivalent of fifty pounds (£50) will be rolled into the following month and paid in the accounting following when your balance reaches the equivalent of fifty pounds (£50). If any Outlet issues any corrections to prior statements, or after six (6) months has failed to pay AWAL amounts that were previously paid or credited to you, or other errors are discovered, AWAL may adjust its accountings and payments to you and (if applicable) charge and/or otherwise make appropriate reconciliations with regards to your account accordingly. Notwithstanding anything to the contrary contained in this Agreement, at its sole election, AWAL may direct you to a third party payment provider service of AWAL’s choice (“Payment Provider”) in order for you to receive any payments due to you under this Agreement, and, resultantly: (a) you acknowledge that the Payment Provider may require you to set up an account (“Payment Provider Account”) and/or provide certain banking, tax-related or other details prior to any due payments being made; (b) payments made by the Payment Provider on AWAL’s behalf shall constitute payments to you by AWAL as due hereunder; (c) you expressly confirm and agree that such Payment Provider shall pay (where relevant) into the bank account and/or rely on the tax forms that you last set up with the Payment Provider in your Payment Provider Account subject to any timing restrictions set out in the Payment Provider’s terms and conditions; (d) you acknowledge, agree and warrant that you shall: (i) read and comply with any and all terms and conditions which may apply for the use of the Payment Provider services and that you shall be solely responsible for any charges or costs that apply for your misuse or non-compliance of such terms and conditions: (ii) be solely liable for the accuracy (including up-to-date accuracy), applicability and maintenance of payment details (including bank account details, payee information, tax information, etc) provided and/or necessary for use of the Payment Provider services; (iii) not allow any other entity or person to use your Payment Provider Account or gain access to the Payment Provider’s interface unless expressly permitted in, and in strict accordance with, such Payment Provider’s user terms of conditions (acknowledging that you shall be solely liable for all actions taken or omissions made by any user (whether or not authorized) of such account with you agreeing that any loss incurred as a result of any party gaining access to the Payment Provider Account which that party was not authorized to obtain (including improper or unauthorized use of your identity and password) shall, as between AWAL and you, be your responsibility). You shall indemnify AWAL, and keeps AWAL indemnified, in respect of the breach and/or acts and/or omissions in contravention of the preceding sentence and all its constituent parts. You have the right to audit AWAL’s books and records to verify the accuracy of payments. Audits are permitted once per year during AWAL’s normal business hours, on at least thirty (30) days’ prior Notice, at the place where AWAL maintains such records. Audits are at your expense, and may only be conducted by an independent chartered or certified public accounting firm retained on a non-contingency fee basis, and only once with respect to any particular payment. Any lawsuit by you regarding any statement or payment must be commenced within one (1) year after the date the applicable statement covers. After such year, you have no right to sue AWAL in connection with any such statement. You irrevocably waive any longer statute of limitations that would otherwise apply by law.
4.03 Required Withholdings; Deductions; VAT; Reimbursements. Notwithstanding anything to the contrary in this Agreement, AWAL or (if applicable) its Payment Provider is entitled to deduct from all payments due to you (a) any sums (such as withholding taxes) which AWAL or its licensees or related entities are obliged to pay or withhold in any country by reason of any law or regulation, (b) any costs or expenses charged to AWAL by YouTube or other applicable Outlets arising specifically and directly from the sale or placement of advertisement(s) and (c) any fines imposed on AWAL by Spotify or other applicable Outlets due to such relevant Outlet adjudicating that any of your Properties breach their guidelines and/or policies. All payments to you or charges to be made by AWAL under this Agreement are expressed as exclusive of VAT, which if applicable are payable by you in addition to the sums otherwise set out in this Agreement. To the extent AWAL is permitted under this Agreement to charge or claim back any amounts to you, and with respect to any costs or expenses approved by you (such as for additional services that you request), AWAL may require payment in advance, or simply recoup such charges against your account. If, however, you receive a bill from AWAL for any such charges (if for example your account has a negative balance after the Term), you must pay it promptly. In the event that AWAL directs you to a Payment Provider as set out in Section 4.02 above, you acknowledge and expressly agree that any payment transfer charges applicable to payments to be rendered to you shall be borne by you in their entirety, and AWAL and its Payment Provider reserve the right to deduct such costs and charges from any sums due to you or request reimbursement of any such amounts which shall be promptly repaid.
5. LIMITATION OF LIABILITY. EXCEPT AS SPECIFICALLY PROVIDED OTHERWISE, AND WITHOUT LIMITING SECTION 8, NEITHER PARTY WILL BE LIABLE TO THE OTHER PARTY FOR SPECIAL, INDIRECT, CONSEQUENTIAL, EXEMPLARY, PUNITIVE OR INCIDENTAL DAMAGES WHATSOEVER (INCLUDING LOST PROFITS OR GOODWILL, BUSINESS INTERRUPTION, REPUTATIONAL DAMAGE AND THE LIKE) ARISING OUT OF OR IN CONNECTION WITH THE PERFORMANCE, NON-PERFORMANCE OR BREACH OF THIS AGREEMENT. WITH RESPECT TO TAKE-DOWNS, PROVIDED THAT AWAL CONTINUES TO WORK WITH YOU IN GOOD FAITH TO SEND TAKE-DOWN NOTICES TO OUTLETS WHENEVER APPROPRIATE, AWAL WILL NOT BE LIABLE FOR ANY FAILURE TO EFFECT SUCH TAKE-DOWNS.
6. Notices. All formal notices with respect to this Agreement (each referred to hereunder as a “Notice”) will be given in writing by registered first class post, or by messenger or courier, or by nationally recognized overnight express mail service, by you to AWAL’s address set forth herein and to [email protected], and by AWAL to the address (or, optionally, the email address) associated with your account. All other instructions, approvals and consents may be (as directed by AWAL) sent via email or via the AWAL Portal.
7. Representations and Warranties. You warrant, represent, covenant, and agree the following: You have the full right and authority to enter into, perform all of your obligations under, and grant the rights granted in accordance with this Agreement; you have the right to grant to AWAL all rights you purport to grant hereunder or are required to be granted in accordance with these Terms & Conditions; AWAL’s exercise of its rights hereunder and use of Recordings and other Properties as per these Terms & Conditions will not violate any law or regulation of any country nor violate or infringe upon the rights of any third party and you have a valid and enforceable agreement with, and have obtained all necessary licenses, clearances and rights from, all third parties (including Talent) whose work, performances or services are embodied in any Recordings or other Properties to allow you to grant the rights granted in accordance hereof; you will be solely responsible for all payments, fees or royalties that may be due to any such party arising from AWAL’s exercise of the rights granted to it hereunder; none of the Recordings or other Properties contain material which is criminally obscene or defamatory, that may expose AWAL to civil or criminal proceedings, or that otherwise violate community standards in particular countries, nor has any generative artificial intelligence been used in the creation of any Recording(s) or Properties (or components thereof); all metadata, label copy, credits and similar information supplied by you is complete and accurate in all respects; you will not (and, where relevant, you will procure that artists will not) assert any “moral rights” arising in connection with these Terms and Conditions against AWAL, its licensees or agents authorised by AWAL (whether under a specific or blanket licence); that you are at least 18 (eighteen) years of age as of the date of your application via the AWAL website; and if you are sales tax registered, you will inform AWAL via the AWAL Portal (and AWAL’s Payment Provider via the Payment Provider Account interface) and if you are UK VAT registered you will enter into any tax related documentation in a form reasonably required by AWAL or its Payment Provider. You will comply with all applicable laws (including the General Data Protection Regulation (GDPR EU 2016/679) and the California Consumer Privacy Act (CCPA)), rules (such as BPI and IFPI guidelines), and regulations, including the application of parental advisory or other warnings or designations. AWAL and/or its Payment Provider will not be required to make any payments of any nature to any third party for or in connection with the exercise or exploitation of rights by AWAL under this Agreement.
8. Indemnification. You will defend and indemnify AWAL (including its parents, subsidiaries, and affiliates, and each of their respective stockholders, predecessors, successors, assigns, agents, directors, officers, attorneys, employees and representatives) against any expenses or losses (including reasonable attorneys’ fees and litigation expenses) resulting from any third-party claim arising from a breach, or a claim which if true would constitute a breach (any such claim, whether or not asserted in a formal legal action, a “Claim”), of any of your representations, warranties or obligations. You will (unless expressly directed otherwise by AWAL in writing on a case-by-case basis) be responsible for defending against any such Claim and for engaging counsel at your cost without any liability for the same being placed on AWAL, and you will at your cost use best efforts to cause AWAL to be dismissed from any proceedings. You may not settle or resolve any Claim in a manner that imposes any liability or obligation on AWAL, or affects AWAL’s rights, without AWAL’s prior written approval. For purposes of clarity, AWAL may cease distribution and take down any Properties that become subject to a Claim, and withhold payments to you in an amount reasonably related to the Claim and potential associated expenses and damages.
9. Confidentiality. Without AWAL’s prior written consent, you may not disclose any of the terms and conditions of this Agreement, any information you learn regarding AWAL’s business or proprietary systems, or any data provided to you. This does not include information which (a) is generally available to the public through no wrongful or negligent act or omission on your part; (b) you have received from a third party free to make such disclosure without breach of any legal obligation; or (c) is required to be disclosed pursuant to any statute, regulation, order, subpoena or document discovery request (as to which you will give AWAL prompt Notice in enough time to enable AWAL to seek a court order limiting or otherwise governing such disclosure). Because your obligations under this Section 9 are integral to AWAL’s business dealings, you agree that AWAL is entitled to injunctive relief to enforce them.
10. Interpretation and Enforcement. This Agreement contains the entire understanding between you and AWAL as to the matters herein, and supersedes all prior agreements, promises, assurances, warranties, representations and understandings between you and AWAL, whether written or oral, as to such matters. Other than as set out in clause 16 below, this Agreement can only be amended by an instrument signed by all parties. A waiver of any term or condition of this Agreement in any instance is not a prospective waiver of such term or condition, nor of any subsequent breach. All remedies, rights and obligations in this Agreement are cumulative, and do not limit any other remedy, right or obligation. As used in this Agreement, “including” signifies one or more illustrative examples, not an exclusive list. Unless otherwise specified, “or” is used in its inclusive sense. The provisions of this Agreement are severable and distinct from one another; if any provision is or becomes invalid, illegal or unenforceable, the validity, legality or enforceability of the others will not be affected. If either party is in breach of this Agreement, the other party will permit a reasonable time to cure such breach. This Agreement does not give rise to any rights under a Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Agreement. The Agreement is governed by the laws of England and Wales. In the event of any dispute arising out of or in relation to this agreement, including any question regarding its existence, validity or termination, you must seek settlement of that dispute by mediation (administered by the London Court of International Arbitration (‘LCIA’)) before having recourse to litigation. The mediation will be conducted in accordance with the LCIA's Mediation Rules then in force, which Rules are deemed to be incorporated by reference into this provision. Thereafter, the parties grant the courts of England, exclusive jurisdiction to hear any disputes arising out of or relating to this Agreement. Nothing in this provision prevents either party from applying to such courts for interim relief. Each party waives the right to request a trial by jury.
11. Relationship of the Parties. You and AWAL are independent contractors to each other. Nothing in this Agreement authorises any party as agent of the other, nor creates a partnership, fiduciary or employment relationship. Without limiting AWAL’s payment obligations to you, you have no right, title or interest in or to revenues received by AWAL, AWAL is not obligated to segregate any revenues from other funds, and AWAL is not a trustee, pledgeholder or fiduciary of amounts owed to you. AWAL acts as principal in all transactions with its customers.
12. Assignment. AWAL may assign its rights and obligations under this Agreement in whole to a party who agrees to be obligated hereunder. You may not assign this Agreement or any rights or obligations, in whole or in part, without AWAL’s prior written consent. Any purported assignment in violation of this paragraph is null and void ab initio.
13. Force Majeure. If the fulfillment of any of AWAL’s obligations is materially hampered due to an event not reasonably within its control (e.g., flood, water damage, power failure, epidemic, pandemic, catastrophe, terrorism, strike, war, failure of technical facilities, etc.), AWAL will not be in breach as a result and may, on Notice to you, suspend the Term for the duration of such event. AWAL must continue to fulfill its payment obligations, to the extent not affected by such event.
14. Post-Term Provisions. Sections 5, 6, 7, 8, 9, 10 and 14 of this Agreement survive the end of the Term. After the Term, if AWAL receives any income from Outlets on Properties, AWAL’s sole liability to you will be the obligation to pay you in full as though the Agreement were still in place, and to send renewed take-down notices whenever reasonably requested and appropriate.
15. Further Assurances. You will do such acts and execute such documents as AWAL may reasonably require to ensure AWAL the full benefit of this Agreement. In particular, you will promptly provide copies of all documents necessary to evidence your right and title in and to any particular Properties.
16. Updates to Agreement. AWAL reserves the right to amend or update these Terms & Conditions or any part thereof upon notice to you, such notice to be given by email or via the AWAL portal. However, AWAL will not amend or update the definitions of Recordings, Term, Territory or Distribution Share without your prior approval, such approval to be given by email or via the AWAL portal.
17. Anti-harassment and bullying. AWAL is committed to providing a safe environment for its staff and operates a zero-tolerance policy in respect of any kind of violence, abuse, aggression, threats, bullying, harassment (including sexual harassment), sexism, racism, homophobia or general prejudice, in any form, whether made in person, over the telephone or in written or any other manner of communication, including on social media. AWAL treats all incidents seriously and investigates promptly any allegations of this nature, and it will take appropriate action if any allegations are upheld which may include terminating AWAL’s relationship with you. AWAL’s relevant policies and procedures (which may be updated from time to time) and the provisions of any relevant industry codes of conduct and/or practice, including a protocol for how any such incidents can be reported to and/or will be dealt with by AWAL, can be found at https://www.sonymusic.co.uk/anti-harassment-and-bullying/ (Password: SME-3rdParty). AWAL’s policies and procedures set out the expectations for the behaviour of and towards its staff. You acknowledge and agree that you must conform with AWAL’s values, policies and codes of conduct and/or practice in respect of the foregoing and you shall not act in any way which: (a) infringes any Act of Parliament or any other applicable laws, statues, ordinances, rules, regulations and requirements of all governmental agencies and/or regulatory bodies; and/or (b) could or does prevent or hinder AWAL from conforming with the same.
Exhibit – DATA PRIVACY ADDENDUM
This data privacy addendum (“DPA”), as may be varied or amended from time to time, forms part of any distribution and/or services agreements between “you” and “us” (as both are defined below) (the “AWAL Agreement(s)”), each a “Party” and collectively the “Parties.” For good and valuable consideration, receipt of which is hereby acknowledged, the Parties to the AWAL Agreement(s) agree as set out below in respect of our services and your use of our and/or Sony Music Entertainment’s suite of self-serve administrative, accounting, marketing, insights and analytics applications (each an “App” and collectively the “Apps”) being made available to you as a result of you entering into AWAL Agreement(s).
1. General
1.1 Parties. Where we refer to “you” / “your” in this DPA we mean the client and any principal of the client named as the contracting party (i.e. the counterparty to AWAL) (which may be defined as “You” and/or “Client” in the AWAL Agreement(s)) to the AWAL Agreement(s), and any authorized representative (including without limitation the Authorized Representative named in the AWAL Agreement(s) and/or designated as such via the Apps) accessing the Apps on such client’s behalf. To the extent you are entering into the AWAL Agreement(s) on behalf of a group of individuals or an organization, “you” (as used in this DPA) shall include any individual from within or contracted to your group or organization with authorized access to the Apps. Such individuals must read this DPA prior to Personal Data (as defined below) being submitted to us or otherwise using the Apps. To the extent an AWAL client has entered into multiple AWAL Agreement(s), it is hereby acknowledged and agreed that the provisions of this DPA shall apply to all of the same (irrespective of when such individual AWAL Agreement(s) were entered into) and that the provisions of this DPA shall continue to apply for the duration of the longest term specified in any such AWAL Agreement(s) (referred to herein as the “Latest Relevant Term”). It is further acknowledged and agreed that where the recordings of an artist are being distributed and/or otherwise exploited by AWAL pursuant to AWAL Agreement(s) entered into by a furnishing entity or services company (referred to herein as a “Contracting Intermediary”): (a) “you” in such context shall include for the purposes of this DPA the relevant artist (and any and all individuals comprising the same); and (b) if more than one Contracting Intermediary is used in respect of AWAL Agreement(s) for the same artist, the provisions of this DPA shall continue to apply for the duration of the Latest Relevant Term of the AWAL Agreement(s) as if the contracting party for all such agreements was the same, singular Contracting Intermediary. Where we refer to “AWAL”, “us,” "we,” or “our” in this DPA we mean, on a joint and several basis AWAL Digital Limited, AWAL Recordings Limited, AWAL Recordings Licensing Limited, AWAL Recordings America Inc., AWAL Recordings Licensing America Inc. and In2une, Inc. and their affiliates, and any Sony Music Entertainment entity using the Personal Data referenced hereunder in accordance with the terms of this DPA and the applicable Sony Music Entertainment privacy policy as determined by the jurisdiction in which the data originates(separately and collectively, the “Privacy Policy”).
1.2 Scope. This DPA applies to your use of the Apps. It sets out each Party’s obligations in respect of any Processing (as defined below) of Personal Data within such Apps or transferred to/from such Apps, including the Personal Data of members of your audience, such as listeners, event attendees, and e-commerce customers. To the extent you are contracting on behalf of a group or organization, you warrant and represent that you have obtained such confirmation from all relevant individuals within or contracted to your group or organization and have received the necessary confirmation to enable us to Process Personal Data in accordance with this DPA.
1.3 Form of Acknowledgement/Acceptance. The Parties agree that the terms of this DPA shall be incorporated into and form part of any and all AWAL Agreement(s) with effect from the date you first acknowledge and agree to the terms of this DPA by way of:
- signing a version of the first AWAL Agreement(s) to which this DPA is attached; or
- signing a separate side letter agreement to any AWAL Agreement(s) specifically incorporating the terms of this DPA for the first time; or
- ticking the box acknowledging your understanding of, and agreement to, AWAL’s online terms and conditions (incorporating this DPA) connected to its digital distribution “plug and play” platform service available at www.awal.com (such terms and conditions being deemed an example of an “AWAL Agreement” for the purposes hereof); or
- reading this DPA when first presented with it on accessing the Apps, and ticking the box acknowledging your understanding of, and agreement to, the terms of this DPA.
For the avoidance of doubt, ticking the DPA acknowledgement box upon first accessing the Apps shall sufficiently represent your binding agreement (or the binding agreement of the Party on whose behalf you are accessing the Apps as an authorized representative) to the terms herein.
1.4 Conflicts. The provisions of this DPA will prevail in the event of any conflicts between the AWAL Agreement(s) and this DPA in respect of the Processing of Personal Data.
1.5 Defined Terms. Terms defined in the AWAL Agreement(s) shall have the same meaning when used in this DPA, unless defined otherwise in this DPA.
1.6 Data Protection Laws. The obligations hereunder shall be in addition to, and do not relieve, replace or remove either Party’s obligations under relevant Data Protection Laws (as defined below).
1.7 Material Breach. Your failure to comply with Data Protection Laws or any of the obligations set out in this DPA in respect of any Personal Data shared hereunder shall constitute a material breach of this DPA. Your material breach of this DPA may result in the termination of your access to the Apps but not any of your obligations under this DPA or the AWAL Agreement(s).
1.8 No Third-Party Beneficiaries Unless Required by Law. Only you, us, our successors or any agreed assignees shall benefit from any terms under this DPA, unless otherwise required by Data Protection Laws or as otherwise expressly agreed to by the Parties in writing.
2. Definitions
2.1 “Data Controller” means a party which determines the purposes and means of Processing Personal Data.
2.2 “Data Processor” means a party which Processes Personal Data on behalf of a Data Controller.
2.3 “Data Protection Law(s)” means applicable laws and regulations regarding the collection, use, storage, transfer, disclosure, or other Processing of Personal Data under this DPA, including but not limited to, European Data Protection Law (as defined below), US Privacy Law (as defined below), the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), the Argentine Personal Data Protection Law, Brazil’s General Data Protection Law, Chile’s Law for the Protection of Private Life no. 19.628 and its updates, Colombia Law No. 1581, Mexico’s Federal Law on the Protection of Personal Data, Peru law No. 29733, Uruguay’s Protection of Personal Data and Habeas Data no. 18.331, Costa Rica Laws No. 7975 and 8968 and any other jurisdictional laws regarding Processing or cross-border transfers of Personal Data (for example, those of Japan, Australia, and New Zealand).
2.4 "Data Subject” means a natural person to whom Personal Data relates.
2.5 “European Data Protection Law” means the EU General Data Protection Regulation 2016/679 (“GDPR”), UK Data Protection Act 2018, the GDPR as applicable as part of United Kingdom domestic law by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (as amended) (“UK GDPR”), the Swiss Federal Act on Data Protection (“FADP”), and any associated or additional legislation in force in the European Economic Area, Switzerland and the United Kingdom as amended, replaced or superseded from time to time.
2.6 “EU Personal Data” means the Processing of Personal Data to which European Data Protection Law applies.
2.7 “Personal Data” means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as name, identification number, location data, an online identifier or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity. Personal Data also includes, without limitation, information that can, together with the other information supplied or collected by either Party, identify a specific individual, even if such information cannot by itself identify a specific individual.
2.8 “Personal Data Breach” means any actual or reasonably suspected breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, access to, or Processing of Personal Data under this DPA.
2.9 “Processing” (including its cognate forms) means any operation or set of operations performed on Personal Data, including, without limitation, collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
2.10 “Protected Area” means:
a) in the case of EU Personal Data, the member states of the European Union and the Economic Area and any country, territory, sector or international organization in respect of which an adequacy decision under Art. 45 GDPR is in force;
b) in the case of UK Personal Data, the United Kingdom and any country, territory, sector or international organization in respect of which an adequacy decision under United Kingdom adequacy regulations is in force; and
c) in the case of Swiss Personal Data, any country, territory, sector or international organization which is recognized as adequate under the laws of Switzerland.
2.11 “Standard Contractual Clauses” (hereafter, “SCCs”) mean:
a) in respect of EU Personal Data, the standard contractual clauses for the transfer of Personal Data to third countries pursuant to the GDPR, adopted by the European Commission under Commission Implementing Decision (EU) 2021/914 including Module 1 of such clauses (Transfers Controller to Controller), found at https://commission.europa.eu/publications/standard-contractual-clauses-international-transfers_en (“EU Standard Contractual Clauses”);
b) in respect of UK Personal Data, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0 issued by the UK Information Commissioner and laid before Parliament in accordance with s.119A of the Data Protection Act 2018 on 2nd February 2022, as revised under section 18 thereof, found at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf (“UK SCC Addendum”); and
c) in respect of Swiss Personal Data, the EU Standard Contractual Clauses, provided that any references in the clauses to the GDPR shall refer to the FADP, the term ‘member state’ must not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence in accordance with clause 18(c) of the clauses and the clauses shall also protect the data of legal persons until the entry into force of the revised FADP, found at https://www.edoeb.admin.ch/en/cross-border-transfer-of-personal-data.
2.12 “Swiss Personal Data” means Personal Data to which the Swiss FADP applies.
2.13 “UK Personal Data” means Personal Data to which data protection laws of the United Kingdom apply.
2.14 “US Privacy Law” means applicable laws and regulations regarding the collection, use, storage, transfer, disclosure, or other Processing of Personal Data in force in the United States, including but not limited to the California Consumer Privacy Act as amended by the California Privacy Rights Act (Cal. Civ. Code §§ 1798.100 et seq.) (“CCPA/CPRA”), Massachusetts’ Standards for the Protection of Personal Information of Residents of the Commonwealth (201 CM 17: M.G.L. c. 93H), the Virginia Consumer Data Protection Act (Va. Code Ann. §§ 59.1-571 et seq.), the Colorado Privacy Act (Colo. Rev. Stat. §§ 6-1-1301 et seq.), the Utah Consumer Privacy Act (Utah Code Ann. §§ 13-61-101 et seq.), and laws and regulations in the United States of a similar subject matter, as amended or superseded from time to time, as of the their respective effective dates.
2.15 The Parties acknowledge that Data Protection Laws may set forth analogous terms to those defined herein. Where necessary to ensure compliance with Data Protection Laws, and solely in respect of such Data Protection Laws, the definitions above should be conformed to such analogous terms set forth in the relevant Data Protection Law.
3. Roles of the Parties
3.1 When using our Apps, you may transfer Personal Data to us that was collected by you or on your behalf, and we may collect and Process Personal Data for our own use. We may also transfer certain Personal Data to you at your request following the expiry of the Latest Relevant Term of the AWAL Agreement(s). The following provisions set out each of our obligations in respect of such collection, Processing, transfer and receipt of Personal Data as permissible under Data Protection Laws.
3.2 You are a Data Controller of the Personal Data transferred and/or received by you or by your representative(s) (including without limitation the Authorized Representative named in the AWAL Agreement(s) and/or designated as such via the Apps) on your behalf pursuant to your use of the Apps.
3.3 We are a separate and independent Data Controller of the Personal Data subject to this DPA, including, without limitation, for insights, analytics, and digital advertising in relation to other artists and clients in the Sony Music Entertainment ecosystem, subject always to our Privacy Policy. Following expiry of the Latest Relevant Term of the AWAL Agreement(s), we shall be entitled to continue using Personal Data as permissible under Data Protection Law, and we shall be solely responsible for determining the nature and legitimacy of such Personal Data Processing.
4. Compliance with Data Protection Laws
4.1 The Parties shall each comply with their respective obligations under Data Protection Laws.
5. Data Processing Details
5.1 Personal Data Processed hereunder may include any of the following types of Personal Data either (i) collected by you, or by a third party on your behalf (including without limitation the Authorized Representative named in the AWAL Agreement(s) and/or designated as such via the Apps), or (ii) collected and enriched by us or by a third party on our behalf via any means, including the Apps, during the entirety of the term(s) of the AWAL Agreement(s) as fans engage with your content, promotional campaigns, products, and events:
- first and last name;
- social media handle;
- email address;
- phone number;
- address;
- date of birth or approximate age;
- country and/or city of residence;
- technical data such as IP address; login data; browser info; time zone; location; browser plug-ins; operating systems; platforms and other technology on the device used to access this website;
- marketing & communications preferences:
- behavioral data from streaming or social media platforms where a Data Subject participates in a campaign by connecting using their streaming or social media account credentials, such as most recent streams, recently followed artists, or which songs they stream on heavy rotation;
- transactional data from e-commerce stores and ticketing platforms, such as but not limited to merchandise and/or tickets purchased, basket total, and timings of transactions; and
- other Personal Data the Data Subject may voluntarily provide in communications with you or us, or via a relevant public community forum.
5.2 Each Party acknowledges and agrees that no special categories of Personal Data will be shared under this DPA.
5.3 Subject always to Data Protection Law and our own policies as may be amended from time to time, Personal Data may be collected via our Apps when Data Subjects:
- stream your content;
- subscribe to direct marketing;
- engage with direct marketing;
- engage in promotional campaigns, such as contests or pre-saves;
- purchase content or merchandise from linked e-commerce stores;
- purchase tickets to official live or live-stream events;
- provide their personal data directly to us through an App or other user interface; and/or
- participate in a public forum or fan community managed by either of us or on either of our behalf.
5.4 Personal Data may be cross-referenced or combined within the Apps for the following purposes:
- to leverage insights and analytics data to:
- provide an enriched global audience view within the Apps;
- measure our audience, improve our product range and enhance the AWAL/Sony Music user experience;
- to inform, develop, and display digital advertising;
- to send direct marketing by email and/or SMS (where a Data Subject has consented to receive direct marketing communications from you and/or us as applicable under Data Protection Law); and
- personalizing direct marketing and advertising content.
6. Your Obligations Related to Personal Data You Separately Collected and Transfer to Us
6.1 You may have the option to transfer Personal Data to us for use within the Apps, where such Personal Data was collected by you or by an authorized third party on your behalf (including without limitation any Authorized Representative as named in your AWAL Agreement(s) and/or designated as such via the Apps). You are solely responsible for:
- ensuring all such Personal Data was collected and Processed by you or on your behalf in compliance with Data Protection Laws;
- ensuring the accuracy of such Personal Data;
- ascertaining that you have the appropriate legal basis under Data Protection Law to transfer such Personal Data to us for Processing within the Apps;
- implementing appropriate technical and organizational measures to protect any such Personal Data in your possession against unauthorized or unlawful Processing and against accidental loss, destruction, damage, ateration of disclosure; and
- demonstrating you provided sufficient notices and choice to Data Subjects at the point of data collection, and obtained any consents as may be required from time to time under Data Protection Laws in relation to the Processing of such Personal Data.
6.2 We are under no obligation to import any Personal Data you make available into our Apps or systems, and we maintain sole discretion in deciding whether or not to do so. You may request to transfer such Personal Data by contacting your AWAL account representative or emailing us at [email protected].
6.3 By transferring to us such Personal Data, you hereby warrant and represent that:
- the consumer-facing privacy notice under which such Personal Data was collected:
- clearly states the legal basis and transfer mechanism (if applicable) under which such transfer is permitted under Data Protection Laws;
- provides sufficient information to Data Subjects in order for them to understand what Personal Data may be shared, the circumstances under which it may be shared, the purposes for any such data sharing, and either the identity of the party or parties with whom such data will be shared or the categories of organizations that will receive such Personal Data; and
- provides all other information required by Data Protection Law.
- you have the appropriate consent where required under Data Protection Law to collect and Process such Personal Data and to transfer such Personal Data to us for further Processing within the Apps.
- all Personal Data transferred to us hereunder shall be accurate, and in the event you identify any inaccuracies, you shall inform us within twenty four (24) hours
7. Your Obligations as a Data Controller When Using the Apps
7.1 In respect of all Personal Data Processed hereunder by you, as Data Controller you hereby warrant and represent that you shall:
- comply with your respective obligations as a Data Controller under Data Protection Laws;
- ensure that each of your clients/subaccounts that access the Apps through the AWAL Agreement(s) are aware of your obligations under this DPA, will not act in any way that causes you to breach the obligations this DPA imposes on you, and will comply with the Data Protection Laws;
- cooperate with us in good faith and reasonably assist us in addressing our obligations under Data Protection Laws;
- promptly respond to any inquiries from Data Subjects and/or regulatory authorities concerning your Processing of Personal Data, unless the Parties agree (email shall suffice) that we will respond, in which case the you shall assist us by providing information available to you that is necessary for purposes of the response;
- promptly notify us of any Personal Data Breach, assist us with any investigation into and remediation of such Personal Data Breach, and provide us with reasonable assistance with any notifications needed to relevant authorities and/or affected Data Subjects in relation to such Personal Data Breach.
8. Your Obligations Related to Personal Data Collected by Us When You Use the Apps
8.1 When creating a site, landing page or promotional campaign using our campaign builder or consumer engagement Apps, Personal Data may be collected directly by us for Processing within our secure systems and Apps, subject to our Privacy Policy and Data Protection Law.
8.2 You hereby acknowledge and agree that any Personal Data collected by us due to your use of a white label platform (as an example, Feature FM) or any other third-party platform will be subject to the terms of this DPA.
8.3 At your written request (email shall suffice), we will share with you a copy of your audience’s contact Personal Data (name, email, telephone number, city and country (as each may be available)) contained within the Personal Data in our possession as it relates to your audience subject to the following:
- such written request must be submitted to us within twelve (12) months of expiry of the Latest Relevant Term of the AWAL Agreement(s);
- if applicable under Data Protection Law, you shall at the relevant time register as a Data Controller with the applicable regulatory authority (if not already registered) and maintain such registration(s), and we shall only be required to provide a copy of the relevant Personal Data once you have provided us upon receipt of a copy of the relevant registration certificate;
- you warrant, represent and agree that you shall (and if you are an authorized representative, you shall procure that the relevant party shall):
- at all times comply with Data Protection Laws and applicable data protection policies and principles;
- Process such Personal Data fairly and lawfully;
- implement appropriate technical and organizational security and confidentiality measures to protect such Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access of information relating thereto, in accordance with this DPA and Data Protection Law; and
- promptly notify us of any complaints, requests, notices or other communication received from Data Subjects, any regulatory authority, or any other law enforcement authority in respect of such Personal Data and information relating thereto, to the extent any such complaint, request, notice or other communication refers to or is relevant to our Processing of Personal Data;
- we will not share Personal Data with you except for your audience’s basic contact Personal Data; for the avoidance of doubt, we shall not share enriched behavioral or transactional data with you when providing Personal Data;
- we shall not be required to share any Personal Data from Data Subjects who have not consented to such sharing, if applicable in our sole discretion;
- neither you (nor the relevant party on whose behalf you are receiving Personal Data as an authorized representative, if applicable) shall be entitled to sell , disclose, or otherwise enable Processing of Personal Data to or by any third party except a Data Processor you have appointed, provided that : (i) due diligence is conducted by you or on your behalf in relation to and before the appointment of any such Data Processor, and (ii) there is a written agreement with each such Data Processor specifically dealing with data protection compliance, and (iii) you frequently monitor the activities of each such Data Processor; and
- nothing in this clause shall require us to do any act (or omit to do any act) which would constitute a breach of any Data Protection Law, or of any company policy in force and relating to the protection of Personal Data.
9. International Transfers
9.1 European Data Protection Law. To the extent you transfer to us Personal Data comprising EU, Swiss or UK Personal Data for use within the Apps, the Parties hereby agree to comply with the obligations of the SCCs, which are hereby incorporated by reference. For purposes of the SCCs, you are the “data exporter” and Sony Music Entertainment is the “data importer.”
9.2 In addition:
- For the purposes of SCCs that involve the transfer of EU-originating Personal Data, the following elections shall apply:
- Clause 7 (Optional docking clause): Not applicable;
- Clause 11(a) (Redress): Optional provision shall not be applicable;
- Clause 17 (Governing law): Option 2 shall apply – the SCCs shall be governed by the EU Member State in which the data exporter is established, except where such law does not allow for third party beneficiary rights, in which case it shall be the laws of Ireland; and
- Clause 18 (Choice of forum and jurisdiction): The courts of Ireland shall have jurisdiction.
- In the event that the EU SCCs data transfer mechanism is held to be invalid under European Data Protection Law by the European Commission or any supervisory authority, we may, at our sole discretion, require you to cease transfers of Personal Data for use within the Apps until an alternative data transfer mechanism can be facilitated, and you agree to promptly cooperate with us in good faith to facilitate the same.
9.3 United Kingdom Data Protection Law. The UK SCC Addendum applies to the SCCs and is hereby incorporated by reference. Pursuant to clause 17 of the UK SCC Addendum, the Parties agree to amend Part 1 of the addendum as follows:
- Table 1 of the UK SCC Addendum shall reflect the Exporter as Data Controller and the Importer as the Data Controller, the Key Contacts of each shall be as set forth in Annex I of the EUStandard Contractual Clauses, in Schedule 1 below;
- Table 2 of the UK SCC Addendum shall be appended to reflect the selection of modules and disapplication of optional clauses as noted above with respect to EU-originating Personal Data; and
- Table 3 of the UK SCC Addendum shall reflect the details of Schedule 1 of this DPA.
9.4 Non-EU/EEA Data Protection Law. To the extent that Data Protection Laws in non-EU/EEA jurisdictions establish a geographical restriction on the cross-border transfer of Personal Data, and where the receipt, access, and/or other Processing of Personal Data by us is subject to such restrictions, the Parties agree that:
- the EU SCCs, Module 1 (Transfer Controller to Controller) in the form described in this DPA shall apply to such receipt, access, and Processing of such Personal Data by us;
- any provision in such EU SCCs that specifically references jurisdictions in the EU/EEA shall be interpreted as applying to non-EU/EEA jurisdictions of the data exporter with respect to the Personal Data at issue; and
- For the avoidance of doubt, obligations in the SCCs which are exclusive to European Data Protection Law, including the third-party beneficiary rights, transfer impact assessments, supplemental measures, and other terms, shall not apply to transfers of Personal Data subject to non-EU/EEA Data Protection Laws.
10. Indemnity
10.1 You shall indemnify us and hold us harmless from and against any cost, charge, liability, damages, expense (including reasonable third party legal fees and related expenses) or loss resulting from any breach or claimed breach of any of the provisions of this DPA, including but not limited to any of your representations and warranties, or from any third party claim which if true would constitute a breach of this DPA or of any law, rule or regulation concerning your use of the Apps (including without limitation any such law, rule or regulation applicable to any marketing or promotional content created or disseminated by you). Any such claim to which the foregoing obligations apply, whether or not asserted in connection with a formal legal action, is a “DPA Claim”. Where we seek such indemnification, we shall: (a) notify you of the DPA Claim, and, if applicable, (b) provide reasonable cooperation and assistance to you in defence of such claim. With respect to any DPA Claim, we shall have the right to withhold payments due to you under the AWAL Agreement(s) in any amount reasonably related to such claim. We have no indemnification obligations to you under this DPA.
10.2 This clause generally does not in any way purport to exclude or limit a Data Controller’s or a Data Processor’s liability arising under Data Protection Laws from a relevant data protection authority.
10.3 Nothing in this DPA shall limit or exclude either Party’s liability in respect of:
- death or personal injury caused by its negligence, or the negligence of its personnel, agents or sub-processors;
- fraud or fraudulent misrepresentation; or
- any other liability which cannot be limited or excluded by applicable law.
11. Miscellaneous
11.1 This DPA shall be governed and interpreted under the same laws and jurisdiction as the AWAL Agreement(s) unless Data Protection Law dictates otherwise.
11.2 This DPA shall remain in effect until the termination or expiration of the Latest Relevant Term of the AWAL Agreement(s), except that any such termination or expiry shall not exempt the Parties from fulfilling the obligations and/or conditions hereunder which, by their nature, shall survive termination or expiration of this DPA for so long as either Party has custody, control, or possession of such Personal Data.
11.3 Any contract rights of third parties under this DPA are excluded unless otherwise required by Data Protection Law.
11.4 If any provision of this DPA is deemed by a court of competent jurisdiction to be invalid, void, or unenforceable, the Parties agree that the remaining provisions of this DPA shall not be affected thereby, and that the remainder of this DPA shall remain valid and enforceable.
11.5 No waiver by either Party of any term hereof shall constitute a waiver of any such term in any other case whether prior or subsequent thereto. No single or partial exercise of any power or right by either Party shall preclude any other or further exercise thereof or the exercise of any such power or right under this DPA.
11.6 We may update this DPA from time to time to (among other things) reflect or address changes in Data Protection Laws or our Privacy Policy. When we make updates to this DPA, we will notify you via the Apps and/or email and enable you to acknowledge that you have read and understood such updates.
____________________________________________________________
Schedule 1 - Annexes to the Standard Contractual Clauses
The details of Annex 1 to the EU SCCs in respect of any Personal Data transferred to us hereunder are as set out below:
A: List of Parties. The names and contact details of the Parties shall be as set out in the AWAL Agreement(s).
B: Description of Transfer.
- Data subjects: Fans;
- Categories of data: contact information (name, email, phone number, address, social media handle(s)); date of birth or approximate age; country or city of residence; IP address; marketing & communications preferences; behavioral data from streaming or social media platforms; transactional data from e-commerce stores and ticketing platforms.
- Sensitive data: None;
- Frequency of transfer: Once following the date that the DPA is first acknowledged and agreed in accordance with clause 1.3 of the same, and as required thereafter during the term(s) of the AWAL Agreement(s) in the event further audience data is collected directly by the client or by a third party on the client’s behalf;
- Nature and purpose of Processing: marketing activities and audience insights and analytics via a suite of self-serve applications;
- Period for which data will be retained: During the term(s) of the AWAL Agreement(s) and for as long as reasonably required for the purposes set out in the DPA, as prescribed by Data Protection Law and in accordance with Sony Music’s privacy policy.
C: Competent Supervisory Authority. The relevant competent supervisory authority(-ies) of the data exporter, as applicable.
In respect of Annex 2 of the Appendix to the EU SCCs, we as the data importer shall maintain suitable technical and organizational security measures to safeguard Personal Data from loss, misuse, unauthorized access, disclosure, alteration or destruction, ensuring a level of security appropriate to the categories of Personal Data, and the potential harms should a Personal Data Breach occur.