Terms of Use

1. Applicability and definitions

1.1

This User Agreement between Catermonkey B.V. on the one hand and user on the other, regarding access to and use of the Catermonkey platform. Catermonkey is a software as a service (SaaS) solution for:

1. the development and management of orders and customer data, and
2. the (partial) automation of the administrative process of processing orders

1.2

Any purchasing or other terms of User or a third party do not apply, and their applicability is expressly rejected by Catermonkey. Any deviations from this User Agreement are only valid if expressly agreed in writing.

2. Licence

2.1

Catermonkey hereby grants User a limited, non-transferable, non-exclusive licence to use Catermonkey, limited to the term of this User Agreement.

2.2

User is not permitted to grant sublicences to third parties (including but not limited to group companies), unless with Catermonkey's prior written approval.

3. Database

3.1

Catermonkey enables Users to build their own database within the Catermonkey platform. User is the exclusive rights holder with respect to the content of this Database. Only User is responsible for the use and content of the Database. Catermonkey uses an external backup service; backups of the Database are made on a 30-day cycle. So there is a 30-day retention period.

3.2

The content of the Database is accessible only to User. User is then exclusively responsible for the content and use of the Database. User indemnifies Catermonkey, on first request, against all claims (and all damage arising from such claims) from third parties (including but not limited to User's candidates) connected with, or arising from, (the use of) the Database (including claims based on the Dutch Data Protection Act and/or the General Data Protection Regulation (GDPR)).

Catermonkey only obtains and processes the generic data specified below from the Catermonkey platform (including metadata relating to the Database). The identity of these visitors cannot be traced back to a natural person by User. Catermonkey processes and uses this data solely to optimise and improve the Catermonkey platform. Catermonkey will never provide data originating from the Database to other parties. Catermonkey only obtains access to the following data:

• Which website the visitor arrives from;
• How often repeat visits are made by the visitor;
• Data about which browser the user has.

Catermonkey's development team may look into the database for development purposes or to resolve technical faults, but will never do so with the aim of using name-and-address data for any purpose other than improving the application.

3.3

Before this User Agreement ends, and during its term at User's request, Catermonkey will provide User with a copy of the Database in a CSV file. Catermonkey is under no circumstances obliged to carry out any data conversion in relation to the Copy. User is not entitled to request Catermonkey to provide a Copy more than once every 12 months, except for good reason (at Catermonkey's reasonable discretion). The Export file consists of:

• All orders
• All accumulated customer data
• All products and ingredients

4. Use and security

4.1

Using Catermonkey requires users to open an account. User is responsible for ensuring that current, complete and correct details are provided to users. User is responsible for keeping passwords and accounts confidential. User is fully responsible for all activities carried out under these accounts.

4.2

User is responsible for the use of Catermonkey's exchange and communication facilities by User's users. User guarantees that the exchange and communication facilities will not be used improperly, in breach of law or regulation, or in breach of the (privacy or intellectual property) rights of third parties.

4.3

For optimal performance of Catermonkey, Catermonkey optimises its application for the most common browsers, and only for the last two releases of these browsers. If a user uses a browser older than the second-to-last version, the user experience may be reduced. In some cases certain functionality may not work. Here Catermonkey provides a best-effort service. Shortcomings will be prevented as much as possible through professional working methods and testing, and, if they do occur, resolved as quickly as possible after detection.

5. Liability

5.1

Catermonkey's liability for damage resulting from an attributable failure to perform this User Agreement, or from an unlawful act or otherwise, is limited per event (a series of successive or related events counts as a single event) to compensation for direct damage, up to a maximum amount equal to EUR 500 (five hundred euros). “Direct damage” is understood to mean only the following damage:

1. Damage directly caused to tangible property and/or personal injury;
2. Reasonable and demonstrable costs incurred by User to limit the direct damage;
3. Reasonable and demonstrable costs incurred by User to call on Catermonkey to (again) properly perform the User Agreement.

Catermonkey's liability for all other (indirect) damage (such as but not limited to consequential damage, loss of profit or income, damage caused by data loss or data corruption) is excluded.

5.2

The exclusions and limitations do not apply to the extent that the damage results from intent and/or deliberate recklessness on the part of Catermonkey's management.

5.3

Any claim for damages not brought within 12 (twelve) months of it arising lapses automatically by operation of law.

6. Personal Data

6.1

User is the controller with respect to the personal data stored in, or otherwise processed by, the Catermonkey platform. Catermonkey will process this personal data solely as agreed in the Data Processing Agreement (Annex I to these Terms of Use).

7. Intellectual property

7.1

All intellectual property rights relating to the Catermonkey solution, as well as all software, information, and images that are part of Catermonkey, are the exclusive property of Catermonkey (Catermonkey IP). These may not be copied or used in any way (other than for the regular use of Catermonkey) without Catermonkey's express written consent.

7.2

If Catermonkey is confronted with an infringement claim or action by a third party that leads, or could lead, to the use of the Catermonkey IP being restricted or prohibited, Catermonkey is entitled to terminate this User Agreement in writing with immediate effect.

7.3

User hereby grants Catermonkey the right to use its (brand) name and logo(s) on the Catermonkey website and/or any resellers, solely for promotional purposes to indicate that User is a Catermonkey customer.

8. Applicable law and dispute resolution

8.1

This agreement and its performance are governed exclusively by Dutch law. The parties will try to resolve any dispute concerning this Agreement through negotiations between senior executives of both parties who are authorised to settle the dispute. If the matter cannot be settled through negotiation, only the court of The Hague will have jurisdiction over any dispute between the Licensor and Licensee regarding the validity, interpretation and performance of these Terms of Use.

Data Processing Agreement

This Data Processing Agreement between Catermonkey B.V. on the one hand, and User on the other, forms an integral part of the User Agreement and Terms of Use regarding access to and use of the Catermonkey platform.

Recitals

A. User can store and manage Personal Data in Catermonkey. Catermonkey Processes such Personal Data on behalf of User. Catermonkey qualifies as a Processor.

B. This Data Processing Agreement forms the basis for the Processing of Personal Data by Catermonkey and forms an integral part of the Terms of Use.

C. This Data Processing Agreement is intended to ensure adequate protection of Personal Data and information security, and leaves the other rights and obligations between the Parties under the Terms of Use unaffected.

1. Definitions

1.1. Capitalised terms used but not otherwise defined have the meaning assigned to them in the Terms of Use.

Security Incident has the meaning assigned to it in article 7.1(a).

Data Subject means a natural person who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his/her physical, physiological, mental, economic, cultural or social identity.

EEA means the European Economic Area.

Personal Data means Personal Data relating to (potential) customers, employees, users (including User), and other individuals, in every case originating from User, which are Processed by Catermonkey under the Terms of Use and this Data Processing Agreement.

Privacy Legislation means all laws and regulations, including laws and regulations of the Netherlands, the European Union, the EEA and their member states, applicable to the Processing of Personal Data and the interception of communications in connection with this Agreement, including but not limited to the General Data Protection Regulation (GDPR).

Sub-processor means a subcontractor engaged by Catermonkey who, as part of its role as subcontractor under this Data Processing Agreement, will Process the Personal Data.

Supervisory Authority means the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority).

Controller means the entity that determines the purpose and means of the Processing of Personal Data.

Processor means the entity that Processes Personal Data on behalf of the Controller.

Process or Processing means any operation or set of operations performed on Personal Data by Catermonkey under this Data Processing Agreement, whether or not by automated means, such as: collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Request means a request from a Data Subject for access to, correction, alteration, transfer or deletion of that person's Personal Data.

2. Processing of Personal Data

Compliance with the Privacy Legislation.

2.1 Both Parties will comply with their obligations under the Privacy Legislation.

Roles of the parties

2.2 The Parties acknowledge that, with regard to the Processing of Personal Data, User qualifies as the Controller and Catermonkey as Processor.

Processing of Personal Data

2.3 Catermonkey will Process Personal Data solely on behalf of, and in accordance with the instructions of, User. User hereby instructs Catermonkey to Process Personal Data for the following purposes:

• (a) Processing by the Catermonkey platform, on User's instructions (for example when User stores, adjusts, or deletes personal data);
• (b) Processing to the extent necessary for the performance of this Data Processing Agreement;
• (c) Processing to comply with reasonable instructions provided by User (for example via email), insofar as such instructions are consistent with the terms of the User Agreement and the Privacy Legislation and are technically reasonably feasible.

2.4 Catermonkey is also entitled to Process Personal Data if required to comply with enforceable requests for disclosure of information under applicable law, provided that in such a case Catermonkey:

• (a) notifies User, where reasonably permitted, of the request, the Personal Data concerned, response time, identity of the requester and the legal basis of the request; and
• (b) where reasonably permitted, will await User's instructions before releasing the information.

Scope and purpose; categories of Personal Data and Data Subjects

2.5 Catermonkey processes Personal Data with the aim of enabling User to use Catermonkey in accordance with the Terms of Use and the Privacy Legislation. The Personal Data Processed under this Data Processing Agreement solely for recruitment and selection purposes are specified in Annex 1 to this Data Processing Agreement.

Restriction of disclosure

2.6 Other than as explicitly permitted under this Data Processing Agreement, Catermonkey will not share Personal Data with third parties without User's permission. Catermonkey will treat all Personal Data as confidential.

3. Rights of Data Subjects

3.1 When User receives a request from a Data Subject to change, shield, delete or provide Personal Data, User can independently meet such requests by using Catermonkey's functionality. If this is not possible, Catermonkey will, where reasonably possible, provide cooperation to still enable User to comply with the Data Subject's Request.

Requests from Data Subjects

3.2 Catermonkey will notify User as soon as possible when it receives a Data Subject Request regarding Personal Data. In such a case, Catermonkey will provide all reasonably necessary cooperation to User to enable User to comply with the Data Subject's Request via the candidate portal.

Complaints or other requests

3.3 Catermonkey will notify User as soon as possible upon receiving a question or complaint from Data Subjects regarding:

• (a) User's obligations under the Privacy Legislation;
• (b) Personal Data; or
• (c) a possible breach of this Data Processing Agreement,

and will, at User's request, provide cooperation where reasonably possible.

4 Catermonkey's personnel

4.1 Catermonkey guarantees that its staff members involved in the Processing of Personal Data are aware of the confidential nature of the Personal Data, sufficiently qualified with regard to their responsibilities under this Agreement and under the Privacy Legislation, and will treat Personal Data as confidential.

4.2 Catermonkey will ensure that only its personnel charged with the Processing of Personal Data have access to Personal Data.

5. Sub-processors

Appointment of Sub-processors

5.1 User hereby grants Catermonkey permission to engage one or more Sub-processors for the Processing of Personal Data, provided that:

• (a) Catermonkey informs User that it uses the following sub-processors;
  • Amazon Web Services
  • DigitalOcean
  • Mailgun.com
  • Intercom.com
• (b) Catermonkey enters into a sub-processing agreement with each Sub-processor that offers substantially equivalent protection to this Data Processing Agreement and in any event complies with the Privacy Legislation.

Responsibility for Sub-processors

5.2 Catermonkey is responsible and liable for:

• (a) the performance of Catermonkey's obligations under this Data Processing Agreement, including where it outsources such performance to a third party;
• (b) coordinating the Sub-processors, at no extra cost to User; and
• (c) any act, omission or failure of its Sub-processors and personnel in performing obligations under this Agreement as if it were Catermonkey's own act, omission or failure.

6. Security

6.1 Catermonkey:

• (a) implements and maintains an information security programme that complies with the Privacy Legislation, including appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the security measures listed in Annex 1;
• (b) keeps proper records of all Processing of Personal Data (including an up-to-date log of the Personal Data to which Catermonkey's personnel have had access at any time during the term of this Agreement), which Processing was carried out, which Sub-processors were involved and the geographic location of the Processing; and
• (c) adjusts the technical and organisational security measures in line with any technological developments.

6.2 User has reviewed the security measures set out in Annex 1 and acknowledges that these are appropriate, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the Processing of Personal Data by Catermonkey, as well as the risks associated with the Processing of Personal Data

7. Management and reporting of Security Incidents

7.1 Catermonkey:

• (a) immediately notifies User by email and/or telephone, but in any event no later than within 24 hours, upon the occurrence of any incident that has led, or could reasonably lead, to loss, theft, deletion, disclosure or damage of Personal Data and/or unauthorised use of or access to Personal Data (a Security Incident );
• (b) provides all cooperation and information that User reasonably requests regarding a Security Incident, including, as soon as possible after, and in any event within two (2) Working Days of Catermonkey discovering the Security Incident:
  • (i) a description of the Security Incident, including the categories of, and the estimated number of, affected Data Subjects;
  • (ii) a description of the Personal Data involved, including the categories and the estimated number of affected Personal Data;
  • (iii) if known, information about the likely consequences of the Security Incident;
  • (iv) a description of how the Security Incident is being investigated and the mitigating measures already taken and still to be implemented; and
  • (v) whether a Supervisory Authority, the Data Subjects themselves and/or the media have been informed of, or are otherwise aware of, the Security Incident, and their response(s).

7.2 Catermonkey will report the Security Incident to User in writing. In urgent cases, Catermonkey will also notify User by phone, SMS or WhatsApp, provided this notification is followed as soon as possible afterwards by written confirmation from Catermonkey to User.

8. Audit

8.1 At User's request, subject to appropriate confidentiality obligations, Catermonkey will cooperate, a maximum of once per calendar year, with an audit of Catermonkey's data processing activities by an impartial expert (for example an auditor) engaged at User's expense to verify that Catermonkey complies with its obligations under this Data Processing Agreement.

9. Return and Deletion of Personal Data

9.1 When the User Agreement for the use of Catermonkey ends, or at User's written request, Catermonkey will stop using and Processing Personal Data it has received from or on behalf of User under this Data Processing Agreement as soon as possible. Personal Data in Catermonkey's possession or control will be returned to User as specified in the Terms of Use, or destroyed.

10. Transfer outside the EEA

10.1 Catermonkey will not Process Personal Data outside the EEA without User's prior written consent.

11. Cooperation and support in dealing with Supervisory Authorities

11.1 Catermonkey will notify User as soon as possible if it receives a request from a Supervisory Authority relating to the Processing of Personal Data, unless this is prohibited by applicable law or by the Supervisory Authority.

11.2 User will take up such requests with the Supervisory Authority itself, unless the Supervisory Authority asks Catermonkey to handle a request. The Parties will inform and assist each other, where possible and permitted, in dealing with such requests.

12. Liability

12.1 The exclusions and limitations of liability set out in article 5 of the Terms of Use also apply in full to this Agreement.

13. Term and termination

13.1 This Agreement takes effect on the date on which User accepts the Terms of Use.

13.2 This Data Processing Agreement ends automatically by operation of law when Catermonkey stops processing Personal Data provided to it as User's Processor, unless the Parties have agreed otherwise in writing.

13.3 On termination of this agreement in accordance with article 13 or otherwise, all rights and obligations of the Parties under this Agreement end (except for the rights and obligations set out in article 4 (_Rights of Data Subjects_), article 4.1 (_Confidentiality_), article 9 (_Return and Deletion of Personal Data_), article 12 (_Liability_)), provided that nothing in this article 13 affects the rights or obligations under this Data Processing Agreement that arose before its termination.

14. Applicable law and disputes

14.1 Dutch law applies exclusively to any dispute relating to the (performance of) this Data Processing Agreement, as well as to any unlawful act connected with this Data Processing Agreement.

14.2 The District Court of The Hague has exclusive jurisdiction over any dispute, or any unlawful act, arising from this Data Processing Agreement.

Annex 1 to the Data Processing Agreement

Data Processing Details

This Annex forms part of the Agreement and must be completed by the Parties.

User is Controller.

Catermonkey B.V. is Processor

Data Subjects

The Processed Personal Data relate to the following categories of Data Subjects:

(potential) candidates, employees, and users (including User).

Categories of Personal Data

• Contact details, including your address (and proof of address) and other contact details (for example email and phone details);
• Customer data of User's customers
• Communication with User's customers.
• Internal notes regarding customers.

Processing Activities

The Processed Personal Data are subject to the following processing activities:

Catermonkey stores the data and gives User the ability to store, consult, change and delete it. Catermonkey also provides functionality to carry out certain actions automatically.

Annex 2

Overview of security measures:

1. Virtual access control

Technical and organisational measures to prevent data processing systems from being used by unauthorised persons include:

• Encrypted passwords
• Automatic lock/logout after 10 hours of no activity.

3. Management of data access

Technical and organisational measures to ensure that persons authorised to use a data processing system only have access to such Personal Data in accordance with their access rights, and that Personal Data cannot be read, copied, changed or deleted without permission, including:

• Internal policy and procedures regarding passwords and periodic refreshing of passwords with access to Personal Data;
• Differentiated access rights (profiles, roles);

4. Disclosure management

Technical and organisational measures to ensure that Personal Data cannot be read, copied, changed or deleted without permission during electronic transmission, transport or storage on storage media (manual or electronic), and to be able to verify to which companies or other legal entities Personal Data are provided, including:

• SSL encryption on all connections between our server(s) and browsers/API clients
• Standard best practices for the Linux servers to secure the data.

5. Access control Technical and organisational measures to check whether data has been entered, changed or deleted (erased) on or from data processing systems, and by whom, including:

• Logging and reporting systems;

6. Availability control Technical and organisational measures to ensure that Personal Data are protected against accidental destruction or loss (physical/logical), including:

• 30-day retention on daily backups

8. Separation control Technical and organisational measures to ensure that Personal Data collected for different purposes can be processed separately, including:

• Separation/isolation of databases per Catermonkey customer.
• Separation of functions (production/testing);