1. Applicability and definitions

1.1

This User Agreement between Catermonkey B.V. on the one hand and the user on the other hand with regard to access to and use of the Catermonkey platform. Catermonkey is a software as a service (SaaS) solution for the benefit of:

1. the development and management of orders and customer data, and
2. the (partial) automation of the administrative process of order processing

1.2

Any purchasing or other terms and conditions of the User or a third party shall not apply, and Catermonkey expressly rejects their applicability. Any deviations from this User Agreement shall only be valid if they have been expressly agreed in writing.

2. Licence

2.1

Catermonkey hereby grants the User a limited, non-transferable, non-exclusive licence to use Catermonkey, limited to the term of this User Agreement.

2.2

The User is not permitted to grant sublicences to third parties (including but not limited to group companies) unless Catermonkey has given its prior written consent.

3. Database

3.1

Catermonkey enables Users to build their own database within the Catermonkey platform. The User is the exclusive owner of the content of this Database. The User is solely responsible for the use and content of the Database. Catermonkey uses an external backup service, and backups of the Database are made in a 30-day cycle. This means there is a 30-day retention period.

3.2

The contents of the Database are accessible exclusively to the User. The User is then solely responsible for the contents and use of the Database. The User indemnifies Catermonkey on first request against all claims (and all damage resulting from such claims) from third parties (including but not limited to the User’s candidates) relating to or arising from (the use of) the Database (including claims based on the Personal Data Protection Act and/or the General Data Protection Regulation).

Catermonkey obtains and processes only the generic data specified below from the Catermonkey platform (including metadata relating to the Database). The identity of these visitors cannot be traced back to a natural person by the User. Catermonkey processes and uses this data exclusively for the optimisation and improvement of the Catermonkey platform. Catermonkey will under no circumstances provide data from the Database to other parties. Catermonkey only obtains access to the following data:

• Which website the visitor arrives at the website from;
• How often repeat visits are made by visitors;
• Information about which browser the user has.

The Catermonkey development team may access the database for development purposes or to resolve technical issues, but will never do so for the purpose of using name and address details for any purpose other than improving the application.

3.3

Prior to the expiry of this User Agreement and during its term, Catermonkey will provide the User with a copy of the Database in CSV file format upon request. Catermonkey is under no obligation to perform any data conversion with regard to the Copy. The User is not entitled to request Catermonkey to provide a Copy more than once every 12 months, unless there is a valid reason (at Catermonkey’s reasonable discretion). The Export file consists of:

• All orders
• All accumulated customer data
• All products and ingredients

4. Use and security

4.1

To use Catermonkey, users are required to open an account. The user is responsible for providing users with up-to-date, complete and correct information. The user is responsible for maintaining the confidentiality of passwords and accounts. The user is fully responsible for all activities undertaken under these accounts.

4.2

The User is responsible for the use of Catermonkey’s exchange and communication facilities by the User’s users. The User guarantees that the exchange and communication facilities will not be used inappropriately, in violation of laws or regulations, or in violation of the rights (privacy or intellectual property) of third parties.

4.3

For optimal performance, Catermonkey optimises its application for the most common browsers. And exclusively on the last two releases of these browsers. If the user uses a browser older than the penultimate version, the user experience may be less than optimal. In some cases, certain functionalities may not work. Catermonkey provides a best-effort service in this regard. Professional working methods and tests will be used to prevent imperfections as much as possible, and if they do occur, they will be resolved as quickly as possible after detection.

5. Liability

5.1

Catermonkey’s liability for damage resulting from an attributable failure to comply with this User Agreement or from a wrongful act or otherwise is limited per event (a series of successive or related events counts as a single event) to compensation for direct damage, up to a maximum amount equal to EUR 500 (five hundred euros). “Direct damage” is understood to mean only the following damage:

1. Damage directly caused to property and/or personal injury;
2. Reasonable and demonstrable costs incurred by the User to limit the direct damage;
3. Reasonable and demonstrable costs incurred by the User in order to urge Catermonkey to (once again) properly comply with the User Agreement.

Catermonkey’s liability for all other (indirect) damage (such as, but not limited to, consequential damage, lost profits or income, damage caused by data loss or data corruption) is excluded.

5.2

The exclusions and limitations do not apply insofar as the damage is the result of intent and/or deliberate recklessness on the part of Catermonkey’s management.

5.3

Any claim for compensation that is not brought within 12 (twelve) months of its occurrence shall lapse by operation of law.

6. Personal data

6.1

The user is responsible for the personal data stored in or otherwise processed by the Catermonkey platform. Catermonkey will only process this personal data as agreed in the Processing Agreement (Appendix I to these Terms of Use).

7. Intellectual property

7.1

All intellectual property rights relating to the Catermonkey solution, as well as all software, information, and images that are part of Catermonkey, are the exclusive property of Catermonkey (Catermonkey IP). These may not be copied or used in any way (other than for the regular use of Catermonkey) without the explicit written permission of Catermonkey.

7.2

In the event that Catermonkey is confronted with an infringement claim or action by a third party that results or could result in the use of Catermonkey IP being restricted or prohibited, Catermonkey is entitled to terminate this User Agreement with immediate effect in writing.

7.3

The User hereby grants Catermonkey the right to use its (brand) name and logo(s) on the Catermonkey website and/or any resellers, but only for promotional purposes to indicate that the User is a customer of Catermonkey.

8. Applicable law and dispute resolution

8.1

This agreement and its implementation are governed exclusively by Dutch law. The parties shall attempt to resolve any dispute concerning this Agreement through negotiations between senior executives of both parties who are authorised to settle the dispute. If the matter cannot be settled through negotiation, the court of The Hague shall have exclusive jurisdiction over any dispute between the Licensor and Licensee concerning the validity, interpretation and implementation of these Terms of Use.

Processing agreement

This Data Processing Agreement between Catermonkey B.V. on the one hand, and the User on the other hand, forms an integral part of the User Agreement and Terms of Use relating to access to and use of the Catermonkey platform.

Considerations

A. The User may store and manage Personal Data in Catermonkey. Catermonkey Processes such Personal Data on behalf of the User. Catermonkey qualifies as a Processor.

B. This Data Processing Agreement forms the basis for the Processing of Personal Data by Catermonkey and forms an integral part of the Terms of Use.

C. This Data Processing Agreement is intended to ensure adequate protection of Personal Data and information security and does not affect the other rights and obligations between the Parties under the Terms of Use.

1. Definitions

1.1. Capitalised terms used but not otherwise defined shall have the meanings assigned to them in the Terms of Use.

Security incident has the meaning assigned to it in Article 7.1(a).

Data subject means a natural person who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity.

EEA stands for European Economic Area.

Personal Data means Personal Data relating to (potential) customers, employees, users (including the User), and other persons, in each case originating from the User, which is Processed by Catermonkey under the Terms of Use and this Processing Agreement.

Privacy legislation means all laws and regulations, including laws and regulations of the Netherlands, the European Union, the EEA and their member states, that apply to the Processing of Personal Data and the interception of communications within the framework of this Agreement, including but not limited to the General Data Protection Regulation.

Sub-processor means a subcontractor engaged by Catermonkey who, as part of the role of subcontractor under this Processing Agreement, will Process the Personal Data.

Supervisory authority means the Data Protection Authority.

Controller means the entity that determines the purpose and means of the Processing of Personal Data.

Processor means the entity that processes Personal Data on behalf of the Controller.

Processing or Processing means any operation or set of operations performed on Personal Data by Catermonkey under this Processing Agreement, whether or not by automatic means, such as: collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.

Request means a request from a Data Subject for access to, correction, modification, transfer or deletion of that person’s Personal Data.

2. Processing of Personal Data

Compliance with privacy legislation.

2.1 Both Parties shall comply with their obligations under the Privacy Legislation.

Roles of the parties

2.2 The parties acknowledge that, with regard to the Processing of Personal Data, the User qualifies as the Controller and Catermonkey as the Processor.

Processing of Personal Data

2.3 Catermonkey shall only Process Personal Data on behalf of, and in accordance with the instructions of, the User. The User hereby instructs Catermonkey to Process Personal Data for the following purposes:

• (a) Processing by the Catermonkey platform, on behalf of the User (for example, if the User stores, modifies, or deletes personal data);
• (b) Processing to the extent necessary for the performance of this Processing Agreement;
• (c) Processing to comply with reasonable instructions provided by the User (e.g. via email), insofar as such instructions are consistent with the terms of the User Agreement and the Privacy Legislation and are technically feasible.

2.4 Catermonkey is also entitled to Process Personal Data if required to comply with enforceable requests for disclosure of information under applicable law, provided that Catermonkey in such a case:

• (a) Notify the user, where reasonably permitted, of the request, the Personal Data concerned, the response time, the identity of the requester and the legal basis for the request; and
• (b) where reasonably permissible, await the User’s instructions before disclosing the information.

Scope and purpose; categories of Personal Data and Data Subjects

2.5 Catermonkey processes Personal Data for the purpose of enabling the User to use Catermonkey in accordance with the Terms of Use and in accordance with the Privacy Legislation. The Personal Data that is Processed under this Processing Agreement exclusively for recruitment and selection purposes is specified in Appendix 1 to this Processing Agreement.

Restriction on disclosure

2.6 Except as expressly permitted under this Processing Agreement, Catermonkey shall not share any Personal Data with third parties without the User’s consent. Catermonkey shall treat all Personal Data as confidential.

3. Rights of Data Subjects

3.1 When the User receives a request from a Data Subject to change, block, delete or provide Personal Data, the User can comply with such requests independently by using the functionality of Catermonkey. If this is not possible, Catermonkey will cooperate as far as reasonably possible to enable the User to comply with the Data Subject’s Request.

Requests from Data Subjects

3.2 Catermonkey shall notify the User as soon as possible upon receiving a Request from the Data Subject regarding Personal Data. In such a case, Catermonkey shall provide all reasonable cooperation to the User to enable the User to comply with the Request from the Data Subject via the candidate portal.

Complaints or other requests

3.3 Catermonkey shall notify the User as soon as possible upon receipt of a question or complaint from Data Subjects regarding:

• (a) Users’ obligations under the Privacy Act;
• (b) Personal data; or
• (c) a possible breach of this Processing Agreement,

and shall cooperate with the User upon request where reasonably possible.

4 Catermonkey staff

4.1 Catermonkey warrants that its personnel involved in the Processing of Personal Data are aware of the confidential nature of the Personal Data, are sufficiently qualified with regard to their responsibilities under this Agreement and under the Privacy Legislation, and will treat Personal Data confidentially.

4.2 Catermonkey shall ensure that only its personnel responsible for the Processing of Personal Data have access to Personal Data.

5. Sub-processors

Appointment of Sub-processors

5.1 The User hereby grants Catermonkey permission to engage one or more Sub-processors for the Processing of Personal Data, provided that:

• (a) Catermonkey User informs the following sub-processors to be used;
  • Amazon Web Services
  • DigitalOcean
  • Mailgun.com
  • Intercom.com
• (b) Catermonkey enters into a sub-processor agreement with each Sub-processor that provides substantially equivalent protection as this Processing Agreement and, in any event, complies with the Privacy Legislation.

Responsibility of Sub-processors

5.2 Catermonkey is responsible and liable for:

• (a) the fulfilment of Catermonkey’s obligations under this Processing Agreement, including where it outsources such fulfilment to a third party;
• (a) the fulfilment of Catermonkey’s obligations under this Processing Agreement, including where it outsources such fulfilment to a third party;
• (c) any act, omission or failure of its Sub-processors and personnel in the performance of obligations under this Agreement as if it were Catermonkey’s own act, omission or failure.

6. Security

6.1 Catermonkey:

• (a) implements and maintains an information security programme that complies with the Privacy Legislation, including appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the security measures listed in Appendix 1;
• (a) implements and maintains an information security programme that complies with the Privacy Legislation, including appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the security measures listed in Appendix 1;
• (c) adapts the technical and organisational security measures in line with any technological developments.

6.2 The User has assessed the security measures set out in Appendix 1 and acknowledges that they are appropriate, taking into account the state of the art, the implementation costs and the nature, scope, context and purposes of the Processing of Personal Data by Catermonkey, as well as the risks associated with the Processing of Personal Data.

7. Management and reporting of security incidents

7.1 Catermonkey:

• (a) immediately notify the User by email and/or telephone, but in any case no later than within 24 hours, in the event of any incident that has led, or could reasonably lead to, loss, theft, removal, disclosure or damage to Personal Data and/or unauthorised use of or access to Personal Data (a Security Incident);
• (b) provide all cooperation and information reasonably requested by the User in relation to a Security Incident, including, as soon as possible following, and in any event within two (2) Business Days after Catermonkey discovers the Security Incident:
  • (i) a description of the Security Incident, including the categories and estimated number of Data Subjects affected;
  • (ii) a description of the Personal Data concerned, including the categories and estimated number of Personal Data affected;
  • (iii) if known, information about the likely consequences of the Security Incident;
  • (iv) a description of how the Security Incident is being investigated and the mitigating measures that have already been taken and need to be implemented; and
  • (v) whether a Supervisor, the Data Subjects themselves and/or the media have been informed or are otherwise aware of the Security Incident, and their response(s).

7.2 Catermonkey shall report the Security Incident to the User in writing. In urgent cases, Catermonkey shall also notify the User by telephone, text message or WhatsApp, provided that this notification is followed as soon as possible by written confirmation from Catermonkey to the User.

8. Audit

8.1 At the request of the User, subject to appropriate confidentiality obligations, Catermonkey shall cooperate, up to a maximum of once per calendar year, in an audit of Catermonkey’s data processing activities by an impartial expert (e.g. an auditor) engaged at the User’s expense to verify that Catermonkey is complying with its obligations under this Processing Agreement.

9. Return and deletion of Personal Data

9.1 Upon termination of the User Agreement for the use of Catermonkey, or upon written request from the User, Catermonkey will cease the use and Processing of Personal Data it has received from or on behalf of the User under this Processing Agreement as soon as possible. Personal Data in Catermonkey’s possession or under its control will be returned to the User as specified in the Terms of Use or destroyed.

10. Transfer outside the EEA

10.1 Catermonkey shall not Process Personal Data outside the EEA without the prior written consent of the User.

11. Cooperation and support in dealing with regulators

11.1 Catermonkey shall notify the User as soon as possible if it receives a request from a Supervisory Authority relating to the Processing of Personal Data, unless this is prohibited by applicable law or by the Supervisory Authority.

11.2 The User shall handle such requests with the Supervisory Authority itself, unless the Supervisory Authority requests Catermonkey to handle a request. Where possible and permitted, the parties shall inform and assist each other in handling such requests.

12. Liability

12.1 The exclusions and limitations of liability included in Article 5 of the Terms of Use also apply in full to this Agreement.

13. Duration and termination

13.1 This Agreement shall enter into force on the date on which the User accepts the Terms of Use.

13.2 This Processing Agreement shall terminate by operation of law when Catermonkey ceases to process Personal Data provided to it as the User’s Processor, unless otherwise agreed in writing between the Parties.

13.3 Bij beëindiging van deze overeenkomst in overeenstemming met artikel 13 of op andere wijze, eindigen alle rechten en verplichtingen van de Partijen onder deze Overeenkomst (behalve de rechten en verplichtingen uiteengezet in artikel 4 (_Rechten van Betrokkenen_), artikel 4.1 (_Vertrouwelijkheid_), artikel 9 (_Retour en verwijdering van Persoonsgegevens_), artikel 12 (_Aansprakelijkheid_), op voorwaarde dat niets in dit artikel 13 afdoet aan de rechten of verplichtingen onder deze Verwerkersovereenkomst die zijn ontstaan vóór de beëindiging daarvan.

14. Applicable law and disputes

14.1 Any dispute relating to (the performance of) this Processing Agreement, as well as any unlawful act related to this Processing Agreement, shall be governed exclusively by Dutch law.

14.2 The District Court of The Hague shall have exclusive jurisdiction to hear any dispute or unlawful act arising from this Processing Agreement.

Appendix 1 to the Data Processing Agreement

Data processing details

This Annex forms part of the Agreement and must be completed by the Parties.

The user is the data controller.

Catermonkey B.V. is a Processor

Parties involved

De Verwerkte Persoonsgegevens hebben betrekking op de volgende categorieën Betrokkenen:

(potential) candidates, employees, and users (including User).

Categories of Personal Data

• Contact details, including your address (and proof of address) and other contact details (e.g. email and telephone details);
• Customer data of User’s customers
• Communication with User’s customers.
• Internal notes regarding customers.

Processing activities

The Processed Personal Data shall be subject to the following processing activities:

Catermonkey stores the data and offers the User the option to save, consult, modify and delete it. Catermonkey also offers functionality to perform certain actions automatically.

Appendix 2

Overview of security measures:

1. Virtual access control

Technical and organisational measures to prevent unauthorised use of data processing systems include:

• Encrypted passwords
• Automatic lockout/logout after 10 hours of inactivity.

3. Data access management

Technical and organisational measures to ensure that persons authorised to use a data processing system only have access to such Personal Data in accordance with their access rights, and that Personal Data cannot be read, copied, modified or deleted without authorisation, including:

• Internal policies and procedures regarding passwords and periodic password changes for access to Personal Data;
• Differentiated access rights (profiles, roles);

4. Disclosure management

Technical and organisational measures to ensure that Personal Data cannot be read, copied, modified or deleted without authorisation during electronic transmission, transport or storage on storage media (manual or electronic), and to be able to verify to which companies or other legal entities Personal Data is provided, including:

• SSL encryption in all connections between our server(s) and browsers/API clients
• Standard best practices for Linux servers to secure data.

5. Access control Technical and organisational measures to check whether data has been entered, modified or deleted (erased) on or from data processing systems and by whom, including:

• Logging and reporting systems;

6. Availability control Technical and organisational measures to ensure that Personal Data is protected against accidental destruction or loss (physical/logical), including:

• 30 days retention on daily backups

8. Separation control Technical and organisational measures to ensure that Personal Data collected for different purposes can be processed separately, including:

• Separation/isolation of databases per Catermonkey customer.
• Separation of functions (production/testing);