This Data Processing Addendum (“DPA”) shall govern any services provided to Cigar & Bourbon Events, LLC. and its Affiliates (“Cigar & Bourbon Events”) by (“you,” “your,” or “Vendor”) as a Processor or Sub-processor (the “Services”). You and Cigar & Bourbon Events shall each be referred to herein as a “Party” and together as “Parties.” This DPA is incorporated into and shall remain in effect for the term of any agreement between the Parties, including but not limited to any executed or click-through agreement or, if applicable, the duration of Services, or the processing of Cigar & Bourbon Events Data, whichever is later (the “Term”). Without limiting the generality of the foregoing, the subject matter, nature, and purpose of the processing under this DPA is the provision of the Services under the Agreement, and the categories of personal data and categories of data subjects are those necessary to provide the Services under the Agreement, as described more fully in the Agreement. The Parties agree as follows:

1. Definitions

1.1. “Data Protection Laws” means all applicable data protection and privacy laws and regulations, including but not limited to the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and any other national or regional data protection laws applicable to the processing of personal data under this DPA.
1.2. “Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”) that is processed by the Vendor on behalf of Cigar & Bourbon Events in connection with the Services.
1.3. “Sub-processor” means any third-party processor engaged by the Vendor to process personal data on behalf of Cigar & Bourbon Events in connection with the Services.

2. Data Processing Obligations

2.1. Purpose and Instructions. The Vendor shall process Personal Data on behalf of Cigar & Bourbon Events solely for the purpose of providing the Services as outlined in the Agreement. The Vendor shall act only on the documented instructions of Cigar & Bourbon Events regarding the processing of Personal Data unless required to do otherwise by applicable law. Any additional or alternative processing of Personal Data shall require prior written approval from Cigar & Bourbon Events.
2.2. Confidentiality. The Vendor shall ensure that its personnel engaged in the processing of Personal Data are subject to appropriate confidentiality obligations.
2.3. Security Measures. The Vendor shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage of Personal Data.
2.4. Data Subject Rights. The Vendor shall assist Cigar & Bourbon Events in fulfilling its obligations to respond to requests from Data Subjects exercising their rights under Data Protection Laws. The Vendor shall promptly notify Cigar & Bourbon Events if it receives any such requests directly from Data Subjects.
2.5. Sub-processors. The Vendor shall not engage any Sub-processor without the prior specific written authorization of Cigar & Bourbon Events. In the event of authorization, the Vendor shall impose data protection obligations on the Sub-processor that are no less protective than those imposed on the Vendor under this DPA.
2.6. Data Breach Notification. In the event of a personal data breach, the Vendor shall notify Cigar & Bourbon Events without undue delay after becoming aware of the breach. The notification shall include all necessary details and information related to the breach.

3. Cigar & Bourbon Events Obligations

3.1. Compliance with Data Protection Laws. Cigar & Bourbon Events shall be solely responsible for ensuring that its instructions and use of the Services comply with Data Protection Laws.

4. International Transfers

4.1. The Vendor shall not transfer Personal Data to countries outside the European Economic Area (EEA) or to any international organization without the prior written consent of Cigar & Bourbon Events, unless the transfer is made in accordance with the requirements of Data Protection Laws.

5. Term and Termination

5.1. This DPA shall be effective as of the Effective Date and shall continue in force for the duration of the Term.
5.2. Termination of the Agreement shall automatically terminate this DPA.

6. Governing Law and Jurisdiction

6.1. This DPA shall be governed by and construed in accordance with the laws of the United States of America. Any dispute arising out of or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of the United States of America.