Viber Developer Terms of Service

In the event the payment is processed through Google Pay, the Merchant acknowledges and agrees to be bound by the Google Pay API Terms of ... [Lastupdated:22March2022] ThisDeveloperTermsofService(oraspreviouslytitled“theViberAPITermsofService”)(“DeveloperTermsofService”)governsthe(a)install,downloadanduseofthevariousViberapplicationprogramminginterfaces(Each:“ViberAPI”andcollectively:the“ViberAPIs”)and(b)accesstotheViberAdminPanel(the“VAP”togetherwiththeViberAPIsandtheChatbotshallbedefinedhereinas“DeveloperPlatform“). ForthepurposeoftheseTerms,theterms“Developer”,“you”or“your”shallrefertoeachadministrator(includingsuperadmins)ofaChatbot,developers,andbusinesspartnersimplementingorusingtheViberAPIsontheirplatformorthird-parties’platforms,MerchantsusingtheChatbots,orthecompanyorbusinessthatyouareauthorizedtorepresent.CapitalizedtermsnotdefinedhoweverusedshallhavethemeaningascribedtothemintheViberTermsofService. BYUSINGTHEDEVELOPERPLATFORMORANYPARTTHEREIN,YOUAGREETOBEBOUNDBYTHESETERMSANDADDITIONALPOLICIESANDDOCUMENTATIONSASSTATEDBELOW. Viberreservestherighttoupdate,fromtimetotime,theseDeveloperTermsofServiceandalldocumentsincorporatedhereinbyreference,bypostinganewversionwhichwillbereflectedonthe“LastUpdated”headingabove.UseoftheDeveloperPlatformaftersuchchangeconstitutesyouracceptanceofsuchchanges.MaterialchangeswillbenotifiedtoyouthroughtheVAPbyemailcorrespondenceorviatheViberApp,sopleasemakesureyoukeepyourcontactinformationuptodate. 1.AdditionalTermsandPolicies TheseViberDeveloperTermsofServiceincorporatebyreferencethefollowingpoliciesanddocumentation(collectively“Terms”or“BusinessTerms”): AcceptableUsePolicy(“AUP“) OrderingDocumentationsignedbytheparties,suchasInsertionOrders,addendumsoragreements,etc.(“OrderingDocumentation”)whichlinkandrefertotheseDeveloperTermsofService; TheViberAppTermsofServicegoverningtheuseoftheViberApp;and TheViberAPIDocumentation. 2.ServicesandLicenseGrant TheViberforBusinessservicesincludevariousfeaturesenablingDeveloperstocreateabusinessChatbot,tosendoutboundmessages,integratetheViberAPIwithinyourbusinesswebsiteorotherwiseintegrateandengagewithyourChatbotusers,includingsubscribers,create,post,store,send,andreceivecontent,etc.(“Services”or“BusinessServices”).SubjecttoyourcompliancewiththeprovisionsoftheBusinessTerms,Vibergrantsyouanon-exclusive,non-transferable,non-sublicensable,licensetousetheDeveloperPlatformforyourcommercialandauthorizedpurposesandnotforpersonaluse.AllrightsnotexpresslygrantedtoyouhereinarereservedtoViber. Viberreservesitsrighttochange,suspend,limitordiscontinueanyaspectoftheDeveloperPlatformforanyreasonandatanytime,includingtheavailabilityofanyDeveloperPlatformoranyfeaturesorservicestherein,withoutnoticeorliability.VibermaysetandenforcelimitsonyouruseoftheDeveloperPlatform,includinglimitingtheDeveloper’sabilitytosendmessagestoitsChatbotsubscribers,includinginactivesubscribers(i.e.,notinitiatedaone-on-onemessagewiththeAdministratorforacertainperiodoftime,subjecttoViber’ssolediscretion),limitingthenumberofAPIrequeststhatyoumaymakeorthenumberofusersyoumayserve,orchargeyouwithfeesdependingonyourvolumeofuse(i.e.,thenumberofoutboundmessagessent)asdetailedhere,inoursolediscretion.Youagreethatyouwillnotattempttocircumventsuchlimitations.IfyouwouldliketouseanyViberAPIbeyondtheapplicablelimits,youmustobtainourexpressconsent,andwemaydeclinesuchrequestorconditionacceptanceonyouragreementtoadditionaltermsorchargesforthatuse.ViberreservestherighttolimittheuseoftheChatbot,includingthenumberofmessagessentthroughtheChatbot,thenumberofoutboundmessages,theuseoftheViberAPI,inactivateachat,orotherwise,atanytime. 3.DeveloperRepresentationsandWarranties TheDeveloperrepresentsandwarrantsthat:(i)youareabovetheageof13.Ifyouareundertheageof18youmayonlyusetheBusinessServicesuponreceivingaparental’sorotherlegalguardian’sconsent;(ii)youwillonlyuseandaccesstheDeveloperPlatforminaccordancewiththeBusinessTermsandanyotherdocumentationsasmaybeprovidedtoyoubyViberfromtimetotime;(iii)youwillcomplywithallapplicablelawsandregulations;(iv)youwillnotembedtheViberAPIinopensourceprojects;(v)youhavenotbeenpreviouslysuspendedorremovedfromusingtheDeveloperPlatform,orengagedinanyactivitythatcouldresultinsuspensionorremoval;(vi)youwillnotinterferewithordisrupttheDeveloperPlatformortheserversornetworksprovidingtheDeveloperPlatform;(vii)youwillnotreverseengineerorattempttoextractthesourcecodefromanyViberAPIoranyrelatedsoftware,excepttotheextentthatthisrestrictionisexpresslyprohibitedbyapplicablelaw;and(viii)youwillnotifyusimmediatelyifyoudiscoverorsuspectanysecuritybreachesrelatedtoourBusinessServicesorifyoudiscoverorsuspectanyunauthorizedaccessoruseoftheDeveloperPlatformortheBusinessServices. 4.ChatbotSpecifications InordertocreateaChatbot,youwillneedtoprovideuswithcertaininformationthroughtheVAP,suchasyourname,telephonenumberandpurposeofuse(“VAPInformation“).WewillusetheVAPInformationtoenableyoutocreatetheChatbotortocontactyou,allasdetailedintheViberPrivacyPolicy .YourepresentandwarrantthattheVAPInformationassociatedwithyouoryourbusinessshallbetrueaccurateanduptodate.IntheeventyouprovideVAPInformationonbehalfofacompanyyouherebyrepresentandwarrantthatthebusiness’snamemustnot:(i)befalse,misleading,deceptive,ordefamatory;(ii)parodyathirdpartyorincludecharactersymbols,excessivepunctuation,ortrademarkdesignations;or(iii)infringeanytrademark,violateanyrightofpublicity,orotherwiseviolateanyone’srights.Wereservetherighttoreclaimnamesonbehalfofanybusinessorindividualthatholdsalegalclaiminthosenames. TheDeveloperisresponsibleforallactivitiesoccurringunderitsVAP.TheDeveloperrepresentsandwarrantsitwillmaintainthesecurityofitsVAPcredentialsandpreventunauthorizeduseoforaccesstotheVAPbykeepingitsdevicesandtheVAPInformationsafeandsecure; VibermayallowyoutooperateyourChatbotbyengagingwiththird-partyserviceproviders,whichwillgainaccessorcontroloveryourVAPandViberAPIs.TheDeveloperissolelyresponsibleforensuringthatsuchthirdpartiesacknowledgetheirobligationundertheBusinessTermsandagreetobeboundbythem.YouwillremainfullyliabletoViberandtoyourChatbotusersforanythirdpartyactstakenunderyourChatbotandyourVAP,includingwithoutlimitation,foranybreachofyourChatbotusers’privacyandsecurityofinformation,anybreachoftheBusinessTermsoranybreachofapplicablelawsandregulations,evenonceyouhaveclosedsuchBot.Therefore,youshouldonlyusethirdpartiesthatyoutrustandwhichareobligatedtocomplywiththeTerms. DependingonyourinteractionwithViber,andsubjecttoViber’ssolediscretion,Vibermayenableyoutopromote,optimizeandmakeyourChatbotsearchable.YouacknowledgeandagreethatViberreservestherightrejectyourChatbotornottopublishit,orceaseitspublication,atanytime,atitssolediscretion.ApprovalofaChatbotorpromotionofsuchbyVibershallnotimplyViber’sindicationofitscompliancewithanyoftheprovisionsherein,andshallnotinferliabilityonViber. 5.MerchantSpecifications AsaMerchantusingtheDeveloperPlatform,youmayalsobeabletoofferyourgoodsorservicesforsalethroughyourownedandoperatedChatbot(“Merchant’sProducts“).TheMerchantshallensurethattheMerchant’sProductscomplywiththeAcceptableUsePolicy ,applicablelawsandtheseTerms.ViberdoesnotexercisecontroloverMerchant’sProducts,purchases,returns,deliveryofgoodsorservices.ViberisnotresponsibleforprovidinganygoodsorservicesandassumesnoliabilityforaMerchant’sfailuretoprovidetheMerchant’sProductsoranydissatisfactionwiththeMerchant’sProducts. PaymentsthroughtheMerchant’sChatbotsshallbemadethroughGooglePayorApplePayor,ifapplicableandapprovedbyViber,throughMerchant’spaymentpage,whichMerchantshallbesolelyresponsibleandliablefor.TheMerchantacknowledgesthatallpaymenttransactionsarenotoperatedorprocessedbyViberandViberisnotliableforpayments,refunds,chargebacks,theprovisioning(oraddition)ofcards,orothercommercialactivityrelatingtopaymentsmadeusingtheMerchant’sChatbot. IntheeventthepaymentisprocessedthroughGooglePay,theMerchantacknowledgesandagreestobeboundbytheGooglePayAPITermsofService(availablehere),theGooglePayPoliciesforBusiness(availablehere);andanyothertermsthatGooglemayapplytotheMerchant’sServicefromtime-to-time.MerchantsshallnotmaketheGooglePayAPIsavailableforuseforatransactionortootherwisetransfermoneybetweenanyMerchantandChatbotuserthatdoesnotdirectlyresultfromthatChatbotuser’spurchaseofaMerchantProduct.IfanyMerchantidentifiesitsprimaryproducttypeas“non-profit,”andsuchMerchantisincompliancewithallapplicablerequirements(legalorotherwise),thensuchMerchantmayusetheGooglePaymentAPIsinconnectionwithdonationsfromChatbotusers.WithrespecttothesaleofdigitalproductsandservicesbyaMerchant,theBusinessTermsandtheGoogleAPITermsofServiceapplyforanytransactionscompletedexclusivelythroughawebbrowser. AMerchantusingGooglePayshallnotselldigitalproductsorservicesthroughmobileapplications. IntheeventthepaymentisprocessedthroughApplePay,theMerchantacknowledgesandagreestobeboundbytheAppleAgreementsandGuidelinesforAppleDevelopers(availablehere),theApplePayPlatformWebMerchantTermsandConditions(availablehereandhere);andanyothertermsthatApplemayapplytotheMerchant’sServicefromtime-to-time. 6.Ownership TheDeveloperPlatformmaybeprotectedbycopyrights,trademarks,servicemarks,internationaltreaties,orotherproprietaryrightsandlaws.Viber’srightsapplytotheDeveloperPlatformandalloutputsandexecutablesoftheDeveloperPlatform,excludinganysoftwarecomponentsdevelopedbyyouwhichdonotthemselvesincorporateanyoftheDeveloperPlatformsoranyoutputorexecutablesofsuchsoftwarecomponents.Youagreetoabidebyallapplicableproprietaryrightslawsandotherlaws,includingandwithoutlimitation,thelawsimposedbythecountryfromwhichyouusetheDeveloperPlatforms.Exceptassetforthherein,Viberownsallrights,title,andinterestinandtotheDeveloperPlatforms. 7.Confidentiality OurcommunicationswithyoumaycontainViberconfidentialinformation.Viberconfidentialinformationincludesanymaterials,communications,andinformationthatwouldusuallybeconsideredconfidentialunderthecircumstances.Ifyoureceiveanysuchinformation,youwillnotdiscloseittoanythirdpartywithoutViber’spriorwrittenconsent.Viberconfidentialinformationdoesnotincludeinformationthatyouindependentlydeveloped,thatwasrightfullygiventoyoubyathirdpartywithoutconfidentialityobligation,orthatbecomespublicthroughnofaultofyourown.YoumaydiscloseViberconfidentialinformationwhencompelledtodosobylaw,providedyouprovideusreasonablepriornoticeandcooperatewithusinordertominimizeanyharmthatmightbecausedtoViber.IfyouhaveenteredintoaspecificNon-DisclosureAgreementwithViber,suchNon-DisclosureAgreementshallprevail. 8.AvailabilityandSupport OurServicesmaybeinterrupted,includingformaintenance,repairs,upgrades,ornetworkorequipmentfailures.WereservetherighttodiscontinuesomeorallofourServicesinconnectionwiththeViberPlatform,atoursolediscretion,includingcertainfeaturesandthesupportforcertaindevicesandfeatures.EventsbeyondourcontrolmayaffectourServices,suchaseventsinnatureandotherforcemajeureevents.Ifyourequiresupport,pleasecontactViberSupportthroughourContactUsForm.Dependingonyourinteractionwithus,youmaybeassignedanaccountmanagerthatcanassistinneedoftechnicalsupport.Further,asadeveloperusingthebusinessmessagingAPIandtools,theresponsetimeandsupportlevelisincorporatedaspartoftheOrderingDocumentations. 9.DataProtection ForthepurposeofthissectionandtheseBusinessterms,thefollowingdefinitionsshallapply: “AdequateCountry”isacountrythatreceivedanadequacydecisionfromtheEuropeanCommission. “ApplicableDataProtectionLaws”meansanyandallapplicablefederal,national,state,orotherprivacyanddataprotectionlaws(including,whereapplicable,EUDataProtectionLaw)asmaybeamendedorsupersededfromtimetotime. “CollectedData”meansthedataeachpartycollectsonorthroughtheirserversornetworks,includinginformationthatmightbeprovidedbyVibertotheDeveloper,ifrequestedbyDeveloper,suchasprofilephotooftheViberuser(ifexists),uniqueidentifierofauserfortheuniqueDeveloper’sproductandtheuser’sprofilename. “Controller”meansanentitythatdeterminesthepurposesandmeansoftheprocessingofPersonalData. “EUDataProtectionLaw”means(i)EUGeneralDataProtectionRegulation(Regulation2016/679)(“GDPR”);(ii)theEUe-PrivacyDirective(Directive2002/58/EC),asamended(e-PrivacyLaw);(iii)anynationaldataprotectionlawsmadeunder,pursuantto,replacingorsucceeding(i)and(ii);(iv)anylegislationreplacingorupdatinganyoftheforegoing(v)anyjudicialoradministrativeinterpretationofanyoftheabove,includinganybindingguidance,guidelines,codesofpractice,approvedcodesofconductorapprovedcertificationmechanismsissuedbyanyrelevantSupervisoryAuthority. “PersonalData”meansanyinformationthatrelatestoanidentifiedoridentifiableindividual(andsuchtermshallinclude,whererequiredbyApplicableDataProtectionLaw,uniquebrowserordeviceidentifiers). “StandardContractualClauses”meansthestandardcontractualclausesforthetransferofPersonalDatatothirdcountriespursuanttotheGDPRandadoptedbytheEuropeanCommissionDecision2021/914of4June2021,whichisattachedhereinbylinkedreference:https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914&from=EN. “SCCAnnexes”meansAnnexIandAnnexIIattachedherein. “UKGDPR”meanstheDataProtectionAct2018andtheGDPRasitformspartofthelawofEnglandandWales,Scotland,andNorthernIrelandbyvirtueofsection3oftheEuropeanUnion(Withdrawal)Act2018andasamendedbySchedule1totheDataProtection,PrivacyandElectronicCommunications(Amendments,etc.)(EUExit)Regulations2019(SI2019/419). “UKSCC”meanswheretheUKGDPRapplies,thestandarddataprotectionclausesadoptedpursuanttoorpermittedunderArticle46oftheUKGDPRfortransferringPersonalDataoutsidetheEEAorUK. ThepartiesacknowledgethatsomeoralloftheCollectedDatamayqualifyasorincludePersonalDataandthatApplicableDataProtectionLawsmayapplytotheprocessingoftheCollectedData.EachpartyshallcomplywithsuchApplicableDataProtectionLawswithrespecttoitsprocessingoftheCollectedDataasanindependentControllerofthePersonalData.EachpartyshallbeindividuallyresponsibleforitscompliancewithApplicableDataProtectionLaws,includingforprovidinganytransparencyandobtaininganylawfulbasisfortheprocessingofCollectedDatathatmayberequiredunderApplicableDataProtectionLaws. EachpartyagreesthatitshallprocesstheCollectedDatathatitcollectsonlyforthepurposespermittedbythisAgreementandApplicableDataProtectionLaw. EachpartyshallimplementappropriatetechnicalandorganizationalmeasurestoprotecttheCollectedDatafrom(i)accidentalorunlawfuldestructionand(ii)loss,alteration,unauthorizeddisclosureof,oraccesstotheCollectedData. WhereEUDataProtectionLawapplies,neitherpartyshallprocessitsCollectedData(norpermititsCollectedDatatobeprocessed)inaterritoryoutsideoftheEuropeanEconomicArea(“EEA“)ortheUKunlessthetransferistoanAdequateCountryorithastakensuchmeasuresasarenecessarytoensurethetransfercomplieswithEUDataProtectionLaw,includingbyincorporatingtheStandardContractualClausesandtheUKSCC,asapplicable.AsbetweenViberandtheDeveloper,ModuleIoftheStandardContractualClausesshallapply,includingtheSCCAnnexes. 10.Security Developersshallimplementandfollowgenerallyrecognizedindustrystandardsandbestpracticesfordataandinformationsecuritytoprotectitsdata,includingimplementingtechnicalandsecuritymeasuresasdetailedundertheSCCAnnexes.DevelopersmustpromptlydeleteanyinformationitobtainedviatheDeveloperPlatformifViberdetermines,initssolediscretion,thattheDeveloperbreacheditsobligationtoprotectandpreventunauthorizeduseoraccesstoitsdevices,DeveloperPlatform,orsystems,breachedtheBusinessTerms,oriftheBusinessTermsareterminatedforanyreason. ByusingtheDeveloperPlatform,youherebyacknowledgeandagreethatVibermaymonitoryouruseoftheDeveloperPlatformtoensurequality,improveViber’sproductsandservices,andverifyyourcompliancewiththeBusinessTerms,includingaccessingandusingyourChatbottoidentifysecurityissuesthatcouldaffectViberoritsUsers.Youwillnotinterferewiththismonitoring,andVibermayuseanytechnicalmeanstoovercomesuchinterference. 11.Termination WemaysuspendorterminatetheDeveloper’saccesstooruseofourDeveloperPlatformandtheBusinessTerms,atanytimeandforanyreason,permissiblebyapplicablelaw,includingifwedetermine,inoursolediscretion,thattheDeveloperviolatesitsobligationsorrepresentationsundertheBusinessTerms,receivesexcessivenegativefeedback,orcreatesharm,risk,orpossiblelegalexposureforus,ourusers,orothers.Totheextentpermissibleandpracticable,subjecttoViber’ssolediscretion,wewillendeavortogiveyoupriornoticecontainingtherelevantreasonsforterminationorsuspension.TheDevelopermayceaseusingtheViberAPIatanytime,withoutderogatingfromanyoutstandingpaymentobligationsbelowandotherobligationsapplicableundertheOrderingDocuments. Uponterminationorsuspension:(i)alllicensesgrantedtoyouhereinshallterminateimmediately;(ii)DevelopersmustpromptlydiscontinuealluseoftheDeveloperPlatform,uninstallanddestroyallcopiesofsoftwareprovidedbyViber,anddeleteanyinformationDeveloperobtainedfromusingtheDeveloperPlatform;(iii)uponViber’swrittenrequest,youshalldeleteorreturntous,anyViberconfidentialinformation;(iv)payanyoutstandingfeestoViber;and(vi)theprovisionshereinthatbytheirnatureareintendedtocontinueindefinitelywillcontinuetoapply. TerminationforanyreasonoftheseTermsshallnotderogatefromyourrightsandobligationsaccruedpriortotheeffectivedateofterminationandshallnotlimitViberfrompursuingotheravailableremedies. YoumaycontactViberusingourVibersupportortheContactUsForm toclarifythereasonsforourterminationorsuspensionofyourinteractionoruseoftheDeveloperPlatform.Ifweareabletoresolvetheissueinyourfavor,resultinginreactivatingyouruseoftheDeveloperPlatform,thenwewillreinstateourServicestoyouwithinareasonabletime. 12.DisclaimerofWarranty SOMEOFTHEVIBERAPISAREEXPERIMENTALANDHAVENOTBEENTESTEDINANYMANNER.VIBERDOESNOTREPRESENTORWARRANTTHATTHEDEVELOPERPLATFORMSAREFREEOFINACCURACIES,ERRORS,BUGS,ORINTERRUPTIONS,ORARERELIABLE,ACCURATE,COMPLETE,OROTHERWISEVALID.TOTHEEXTENTPERMITTEDBYAPPLICABLELAW,THEDEVELOPERPLATFORMSAREPROVIDED“ASIS”AND“ASAVAILABLE”WITHNOWARRANTY,EXPRESSORIMPLIED,OFANYKIND,ANDVIBEREXPRESSLYDISCLAIMSANYANDALLWARRANTIESANDCONDITIONS,INCLUDING,BUTNOTLIMITEDTO,ANYIMPLIEDWARRANTYOFMERCHANTABILITY,FITNESSFORAPARTICULARPURPOSE,AVAILABILITY,SECURITY,TITLEORNON-INFRINGEMENT.YOURUSEOFTHEDEVELOPERPLATFORMSISATYOUROWNDISCRETIONANDRISK,ANDYOUWILLBESOLELYRESPONSIBLEFORANYDAMAGETHATRESULTSFROMTHEUSEOFTHEVIBERAPIS,INCLUDING,BUTNOTLIMITEDTO,ANYDAMAGETOYOURCOMPUTERSYSTEMORLOSSOFDATA. 13.LimitationofLiability TOTHEEXTENTPERMITTEDBYAPPLICABLELAW,VIBERSHALLNOT,UNDERANYCIRCUMSTANCES,BELIABLETOYOUFORANYINDIRECT,PUNITIVE,ACTUAL,INCIDENTAL,CONSEQUENTIAL,SPECIAL,OREXEMPLARYDAMAGESARISINGOUTOFORINCONNECTIONWITHANYMANNEROFUSE,ORINABILITYTOUSE,THEDEVELOPERPLATFORMS,WHETHERBASEDONBREACHOFCONTRACT,BREACHOFWARRANTY,TORT(INCLUDINGNEGLIGENCE),STRICTLIABILITYOROTHERWISE,ORANYOTHERPECUNIARYLOSS,REGARDLESSOFTHEBASISUPONWHICHLIABILITYISCLAIMEDANDWHETHERORNOTVIBERHASBEENADVISEDOFTHEPOSSIBILITYOFSUCHLOSSORDAMAGES.WITHOUTLIMITATION,YOU(ANDNOTVIBER)ASSUMETHEENTIRECOSTOFALLNECESSARYSERVING,REPAIR,ORCORRECTIONINTHEEVENTOFANYSUCHLOSSORDAMAGEARISINGTHEREIN.InnoeventshallViber’saggregatedliabilitytoyouforalldamagesexceedtheamountoffiftyU.S.dollars($50.00).Theforegoinglimitationswillapplyeveniftheabove-statedremedyfailsofitsessentialpurpose. 14.Indemnification Tothemaximumextentpermittedbyapplicablelaw,theDeveloperagreestoholdharmlessandindemnifyViberanditssubsidiaries,affiliates,officers,agents,licensors,co-brandersorotherpartners,andemployeesfromandagainstanythirdpartyclaimsarisingfromorinanywayrelatedtoyouruseoftheViberAPIs,includinganyliabilityorexpensearisingfromallclaims,losses,damages(actualorconsequential),suits,judgments,litigationcosts,andattorneys’fees,everykindandnature.Vibershallusegoodfaitheffortstoprovideyouwithwrittennoticeofsuchclaim,suit,oraction. PLEASENOTETHATALLOTHERPROVISIONSNOTSPECIFICALLYADDRESSEDHEREINSHALLBEGOVERNEDBYTHEVIBERAPPTERMSOFSERVICE,INCLUDINGBUTNOTLIMITEDTOGOVERNINGLAWANDJURISDICTIONCLAUSEANDMISCELLANEOUSCLAUSE.  AnnextotheStandardContractualClausesreferredinSection9  AnnexI (ControllertoController) A.LISTOFPARTIES ViberandDeveloperasdefinedabove. B.DescriptionofProcessingandTransfer Categoriesofdatasubjectswhosepersonaldataisprocessedortransferred: Viberusers(eitherusingtheChatbotortheirinformationismadeavailabletotheDeveloperthroughDevelopertoolsortheViberAPI). Categoriesofpersonaldataprocessedortransferred: DependingontheDeveloper’srequest,VibermaysharetheCollectedDatawiththeDeveloper,whichincludesoneorallofthefollowing:Profilephotooftheuser(ifitexists),uniqueidentifieroftheuserfortheuniqueDeveloper’sproduct,andtheuser’sprofilename. Sensitivedataprocessedortransferred: NA Thefrequencyoftheprocessingortransfer(e.g.,whetherthedataistransferredonaone-offorcontinuousbasis): Continuousbasis Natureoftheprocessingortransfer: TheDeveloperreceivesthepersonaldataviatheViberAPIandprocessesitforthebelowpurpose. Purpose(s)ofthedatatransferandfurtherprocessing: EnablingpersonalizationoftheDeveloper’sproduct. TheperiodforwhichthePersonalDatawillberetained,or,ifthatisnotpossible,thecriteriausedtodeterminethatperiod: AslongasrequiredbyapplicablelawsortoprovidetheBusinessServices. Fortransfersto(sub-)processors,alsospecifysubjectmatter,natureanddurationoftheprocessing: NA C.COMPETENTSUPERVISORYAUTHORITY TheNationalCommissionforDataProtectionoftheGrand-DuchyofLuxembourg(“CNPD”). AnnexII TechnicalandOrganizationalSecurityMeasures ThisAnnexIIsummarizesthetechnical,organizational,andphysicalsecuritymeasuresimplementedbytheparties: TheDevelopershallcomplywiththefollowing: Developerundertakestoimplement,maintain,andcontinuouslycontrolandupdateappropriatetechnicalandorganizationalsecuritymeasurestoprotectthepersonaldataagainstaccidentalorunlawfuldestructionoraccidentalloss,alteration,unauthorizeddisclosureoraccess,andwhichprovidealevelofsecurityappropriatetotheriskrepresentedbytheprocessingandthenatureofthedatatobeprotected.Thisincludes: Preventingunauthorizedpersonsfromgainingaccesstodataprocessingsystemswithwhichpersonaldataareprocessedorused(physicalaccesscontrol);inparticular,bytakingthefollowingmeasures: Controlledaccessforcriticalorsensitiveareas Videomonitoringincriticalareas Incidentlogs Implementationofsingle-entryaccesscontrolsystems, Automatedsystemsofaccesscontrol, Permanentdoorandwindowslockingmechanisms, Keymanagement Permanentlystaffedreception Codelocksondoors Monitoringfacilities(e.g.,alarmdevice,videosurveillance) Loggingofvisitors CompulsorywearingofIDcards Securityawarenesstraining Preventingdataprocessingsystemsfrombeingusedwithoutauthorization(logicalaccesscontrol);inparticular,bytakingthefollowingmeasures: Networkdevicessuchasintrusiondetectionsystems,routers,andfirewalls Securelog-inwithuniqueuser-ID,password,andasecondfactorforauthentication(OTP,MFA,2FA). Policymandateslockingofunattendedworkstations.Screensaverpasswordisimplementedsuchthatiftheuserforgetstolocktheworkstation,automaticlockingisensured. Loggingandanalysisofsystemusage Role-basedaccessforcriticalsystemscontainingpersonaldata Processforroutinesystemupdatesforknownvulnerabilities Encryptionoflaptopharddrives Monitoringforsecurityvulnerabilitiesoncriticalsystems Deploymentandupdatingofantivirussoftware individualallocationofuserrights,authenticationbypasswordandusername,useofsmartcardsforlogin,minimumrequirementsforpasswords,passwordmanagement,passwordrequestafterinactivity,passwordprotectionforBIOS,blockingofexternalports(suchasUSBports),encryptionofdata,virusprotectionanduseoffirewalls,intrusiondetectionsystems. Ensuringthatpersonsentitledtouseadataprocessingsystemcangainaccessonlytothedatatowhichtheyhavearightofaccess,andthat,inthecourseofprocessingoruseandafterstorage,personaldatacannotberead,copied,modifiedordeletedwithoutauthorization(accesscontroltodata);inparticular,bytakingthefollowingmeasures: Networkdevicessuchasintrusiondetectionsystems,routers,andfirewalls Securelog-inwithuniqueuser-ID,password,andasecondfactorforauthentication(OTP,MFA,2FA). Loggingandanalysisofsystemusage Role-basedaccessforcriticalsystemscontainingpersonaldata Encryptionoflaptopharddrives Deploymentandupdatingofantivirussoftware CompliancewithPaymentCardIndustryDataSecurityStandard Definitionandmanagementofrole-basedauthorizationconcept,accesstopersonaldataonlyonaneed-to-knowbasis,generalaccessrightsonlyforalimitednumberofadmins,accessloggingandcontrols,encryptionofdata,intrusiondetectionsystems,securedstorageofdatacarriers,securedatalines,distributionboxes,andsockets. Ensuringthatpersonaldatacannotberead,copied,modified,ordeletedwithoutauthorizationduringelectronictransmission,transportorstorageandthatitispossibletoverifyandestablishtowhichbodiesthetransferofpersonaldatabymeansofdatatransmissionfacilitiesisenvisaged(datatransfercontrol);inparticular,bytakingthefollowingmeasures: Encryptionofcommunication,tunneling(VPN=VirtualPrivateNetwork),firewall,securetransportcontainersincaseofphysicaltransport,encryptionoflaptops Ensuringthatitispossibleretrospectivelytoexamineandestablishwhetherandbywhompersonaldatahavebeeninsertedintodataprocessingsystems,modifiedorremoved(entrycontrol);inparticular,bytakingthefollowingmeasures: Loggingandanalysisofsystemusage Role-basedaccessforcriticalsystemscontainingpersonaldata Loggingandreportingsystems,individualallocation,ofuserrightstoenter,modifyorremovebasedonrole-basedauthorizationconcept. Ensuringthatpersonaldataprocessedonthebasisofacommissionedprocessingofpersonaldataareprocessedsolelyinaccordancewiththedirectionsofthedataexporter(jobcontrol);inparticular,bytakingthefollowingmeasures: Mandatorysecurityandprivacyawarenesstrainingforallemployees Employeehiringprocedureswhichrequirethecompletionofadetailedapplicationformforkeyemployeeswithaccesstosignificantpersonaldata. Periodicauditsareconducted. Implementationofprocessesthatensurethatpersonaldataisonlyprocessedasinstructedbythedataexporter,coveringanysub-processors,includingdiligentlyselectingthaappropriatepersonnelandserviceprovidersandmonitoringofcontractperformance,enteringintoappropriatedataprocessingagreementswithsub-processors,whichincludeappropriatetechnicalandorganizationalsecuritymeasures. Ensuringthatpersonaldataareprotectedagainstaccidentaldestructionorloss(availabilitycontrol);inparticular,bytakingthefollowingmeasures: Backupproceduresandrecoverysystems,redundantserversinaseparatelocation,mirroringofharddisks,uninterruptiblepowersupply,andauxiliarypowerunit,remotestorage,climatemonitoringandcontrolforservers,fire-resistantdoors,fire,andsmokedetection,fireextinguishingsystem,anti-virus/firewallsystems,malwareprotection,disasterrecovery,andemergencyplan. Ensuringthatdatacollectedfordifferentpurposesordifferentprinciplescanbeprocessedseparately(separationcontrol);inparticular,bytakingthefollowingmeasures: Internalclientconceptandtechnicallogicalclientdatasegregation,developmentofarole-basedauthorizationconcept,separationoftestdataandlivedata.