HomeMy WebLinkAboutCAG2021-069 - Original - Sprout Social - Social Media Tool - 02/19/2021ApprovalOriginator:Department:
Date Sent:Date Required:
Authorized to Sign:
Director or Designee Mayor
Date of Council Approval:
Grant? Yes No
Type:Review/Signatures/RoutingDate Received by City Attorney:
Comments:
Date Routed to the Mayor’s Office:
Date Routed to the City Clerk’s Office:Agreement InformationVendor Name:Category:
Vendor Number:Sub-Category:
Project Name:
Project Details:
Agreement Amount:
Start Date:
Basis for Selection of Contractor:
Termination Date:
Local Business? Yes No*
Business License Verification: Yes In-Process Exempt (KCC 5.01.045)
If meets requirements per KCC 3.70.100, please complete “Vendor Purchase-Local Exceptions” form on Cityspace.
Notice required prior to disclosure?
Yes No
Contract Number:
Agreement Routing Form
For Approvals, Signatures and Records Management
This form combines & replaces the Request for Mayor’s Signature and Contract Cover Sheet forms.
(Print on pink or cherry colored paper)
Visit Documents.KentWA.gov to obtain copies of all agreementsadccW22373_1_20
Budget Account Number:
Budget? Yes No
Dir Asst:
Sup/Mgr:
Dir/Dep:
rev. 200821
FOR CITY OF KENT OFFICIAL USE ONLY
(Optional)
* Memo to Mayor must be attached
2/18/2022
OK to sign 2/23/2021. Contract is for 1 year term only.
2/23/2021
Mayor signature needed on pages 1, 3, 20, and 25 of
electronic file.
Service Order
Service Order Information
Agreement For
City of Kent
Subscription Start Date
February 19, 2021
Subscription End Date
February 18, 2022
Billing Information
Billing Street
\Quote_Billing_Street_1\
Billing Email
\Quote_Billing_Email_1\
Net Terms
Net 30
Billing City
\Quote_Billing_City_1\
Billing State/Province
\Quote_Billing_State_1\
Billing Method
Check
Billing Frequency
Annual
Billing Country
\Quote_Billing_Country_1\
Billing Zip/Postal Code
\Quote_Billing_Zip_1\
Tax Exemption ID(if applicable)
\Quote_Tax_Exemption_Id_1\
Payment Portal Used?
\Quote_Payment_Portal_1\
Product Quantity
Advanced Plan 1.00
Additional Users 9.00
Advanced Listening - 3 Topics 1.00
Discount: 19.1%
Total Investment (USD): $29,988.00
Page 1 of 2
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
bstober@kentwa.gov
Service Order
Subscriber Sprout Social, Inc.
Name:
\n1\
Name:
\n2\
Title:
\t1\
Title:
\t2\
Signature:
\s1\
Signature:
\s2\
Date:
\d1\
Date:
\d2\
VATNumber:
\Quote_VAT_Number_1\
(if applicable)
Special Contract Terms
This Service Order is executed between Sprout Social, Inc. (“Sprout Social”) and the above named subscriber (“Subscriber”), and is governed by the terms and conditions of
the Sprout Social, Inc. Terms of Service in effect on the date the Service Order was fully signed, a copy of which is attached hereto as Exhibit A and expressly incorporated
by reference into this Service Order (“Agreement”), as amended by the Amendment attached hereto as Exhibit B. The services described above may only be used by the
Subscriber, and subject to the scope limitations set forth herein.
Unless otherwise set forth above or in the Agreement, Sprout Social requires payment made in advance of the subscription period. Pro-rated refunds are not provided for
early cancellation and Subscriber may not terminate prior to the end of the subscription term for convenience.
All payments required by this Service Order are exclusive of federal, state, local and foreign taxes, duties, tariffs, levies, withholdings and similar assessments (including
without limitation, sales taxes, use taxes and value added taxes). Subscriber shall be responsible for the payment of all such charges (excluding taxes based upon Sprout
Social's net income), which amount will be reflected on the invoice issued by Sprout Social. All amounts payable by Subscriber hereunder shall be grossed-up for any
withholding taxes imposed by any foreign government on Subscriber’s payment of such amounts to Sprout Social.
Notwithstanding anything to the contrary in the Agreement, this Service Order will not automatically renew unless mutually agreed upon in writing by the parties.
Notwithstanding anything to the contrary in the Agreement, Sprout Social may only use Subscriber’s name or logo on its website or in any promotional materials, press
releases, investor materials, and other stockholder communications with the prior written consent of Subscriber. Sprout Social will comply with any reasonable written logo
guidelines provided by Subscriber in writing.
If Professional Services (as defined in the Agreement) are delivered to Subscriber in connection with the services described above or pursuant to a Statement of Work
attached to this Service Order, Subscriber agrees that it will: (i) be available for discovery call if requested; (ii) cooperate in all matters relating to the Professional Services and
appoint an employee or representative of Subscriber to serve as the primary contact who will have the authority to act on behalf of Subscriber with respect to the Professional
Services; (iii) respond promptly to any request to provide direction, information, approvals, authorizations or decisions that are reasonably necessary for performance of the
Professional Services; (iv) provide the information Sprout Social may reasonably request in order to carry out the Professional Services; and (v) if the Professional Services
involve implementation of Listening Product, Subscriber will provide a full list of any needed keyword inclusions (branded hashtags or handles).
If Sprout Social's performance of its obligations under this Service Order or the Agreement are prevented or delayed by any act or omission of Subscriber or its agents,
subcontractors, consultants or employees, Sprout Social will not be deemed in breach of its obligations under this Service Order or the Agreement or otherwise liable for any
costs, charges or losses sustained or incurred by Subscriber, in each case, to the extent arising directly or indirectly from such prevention or delay.
Professional Services involving implementation and/or initial product training will be completed within four (4) weeks from the Subscription Start Date unless otherwise delayed
by Subscriber. All one-time service hours within this Service Order are subject to expiration after ninety (90) days from the Subscription Start Date.
Should the Professional Services involve Sprout Social accessing Subscriber's account, as requested or approved by Subscriber, the parties agree that Subscriber acts as a
controller of any personal data processed by Sprout Social in performance of the Professional Services. Such processing shall be subject to the data processing addendum in
effect on the date the Service Order was fully signed, a copy of which is attached and incorporated as Exhibit C, and Sprout Social acts solely as a processor and processes
personal data in accordance with Subscriber's instructions.
Page 2 of 2
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
City of Kent
by: Dana Ralph, Mayor
02/24/2021
2/23/2021 Terms of Service | Sprout Social
https://sproutsocial.com/terms/1/16
Sprout Social™ Terms of Service
Effective Date: December 30, 2019
1.ACCEPTANCE OF OUR TERMS
1.1. These Terms of Service (“Terms”) constitute a binding contract between you and
Sprout Social, Inc. (“us” or “we” or “Sprout Social”) governing the use of and access
to the products we offer in connection with a paid or trial subscription (“Products”)
to you and any authorized individuals engaged by you to use the Products on your
behalf (each, a “User,” and collectively, “Users”). By using or accessing the
Products, or authorizing or permitting any User to use or access the Products, you
accept and agree to be bound by these Terms.
1.2. If you are entering into these Terms on behalf of a company, organization, or
other legal entity (“Entity”), you agree to these Terms for that Entity and represent
to Sprout Social that you have the authority to bind such Entity and its affiliates to
these Terms. In such case, “you” or “Customer” shall refer to such Entity and its
affiliates. If you are a Customer’s User, then these Terms will apply to you to the
extent they are applicable to Users. If Customer is an agency, then a User may also
be an agency client as described in Section 10 (Agencies). If you do not have the
authority to bind the Entity to these Terms or do not agree to these Terms, do not
accept these Terms or use or access the Products.
1.3. You represent and warrant that the information you provide in registering for
the Products is accurate, complete, and rightfully yours to use.
2.OUR PRODUCTS
2.1. We deliver our Products through our web applications and mobile applications
(each, an “Application,” and collectively, “Applications”) available at
app.sproutsocial.com, app.getbambu.com, and app.simplymeasured.com (each, a
“Site”). The features and services available to you will be based on your
subscription plan (“Plan”). If you signed a service order, the details of your Plan will
be provided on your service order. If you purchased a Product within the
Application, the details of your Plan will be set forth on the “Billing” page within the
Application. The Products specifically exclude any third-party database or Third-
Party Services (as defined in Section 5).
2.2. We reserve the right to modify features and functionality of our Products from
time to time in our sole discretion. We will determine in our sole discretion whether
any new features require additional fees. We may decide to add new features to the
Products and make them generally available at no cost to Customers. We may or
may not provide notice to you of changes to the Products. We will not be liable to
EXHIBIT A
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
2/23/2021 Terms of Service | Sprout Social
https://sproutsocial.com/terms/2/16
you or to any third party for any modifications, price increases, or discontinuations
of our Products.
2.3. Any additional product add-ons, including but not limited to listening, analytics,
bots, or customer service, or the addition of users, profiles, groups, brand
keywords, and other features or functionality you later add to an existing Plan (the
“Add-Ons”) during your subscription term shall be subject to these Terms. Any time-
and-materials services provided to you, such as consulting services or onboarding
support (the “Professional Services”) shall also be subject to these Terms.
3.REGISTERING USERS ON OUR APPLICATION
3.1. Except as set forth in Section 10 (Agencies), you agree that you will only access
our Applications for your internal business purposes and subject to these Terms.
After any free trial of our Products, you will be required to register for our
Application and pay a subscription fee for the use of our Products. You must pay
such subscription fees on the first day of your subscription term unless otherwise
specified on your service order.
3.2. If you, as a Customer, add Users to your account, you must bind each of the
Users to these Terms. You are responsible for all information, data, content,
messages or other materials that you or your Users post or otherwise transmit via
the Applications (collectively, “Content”). You acknowledge and agree that a login
may only be used by one (1) person, and that you will not share a single login
among multiple people. You are responsible for maintaining the confidentiality of
your login and account, and are fully responsible for any and all activities that occur
under or in connection with your login or account. Except for as provided in Section
10 (Agencies), you agree that you will not trade, transfer, or sell access to your login
or account to another party unless otherwise agreed to in writing by Sprout Social.
3.3. As a User, you represent and warrant that you are: (i) 18 years or older, (ii) not
prohibited or restricted from having a Sprout Social account, and (iii) not a
competitor of or using the Products for purposes that are competitive with Sprout
Social.
3.4. You agree to use reasonable efforts to prevent unauthorized use of the
Products and notify us immediately if you discover any unauthorized use through
your account. You will take all necessary steps to terminate the unauthorized use
and agree to cooperate with us in preventing or terminating such unauthorized use
of the Products.
4.AVAILABILITY OF SERVICE
4.1. While we will use commercially reasonable efforts to keep our Applications
available and accessible, the Applications may be unavailable from time to time for
repairs, upgrades, routine and emergency maintenance, or other interruptions that
may be out of our reasonable control, including any outages of Third-Party Services
(as defined in Section 5) or any related application programming interface (“APIs”)
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
2/23/2021 Terms of Service | Sprout Social
https://sproutsocial.com/terms/3/16
and integrations. Interruptions of our Applications shall not serve as a basis to
terminate your subscription or demand any full or partial refunds or credits of
prepaid and unused subscription fees.
5.OUR USE OF THIRD PARTY INTEGRATIONS AND SERVICES
5.1. Our Applications may contain links to or allow you to connect and use certain
external third-party products, services, or software in conjunction with your use of
our Applications and Products (“Third Party Services,” and each, a “Third Party
Service”), including certain social media networks and other integration partners. To
take advantage of these features, you may be required to sign up or log into such
Third Party Service on their respective websites or applications. By enabling the
Applications to access such Third Party Service, you are permitting Sprout Social to
pass on your login information to the Third Party Service and granting the Third
Party Service permission to access or otherwise process your data. You
acknowledge that your use of such Third Party Service is governed solely by the
terms and conditions and privacy policy of such Third Party Service (including, but
not limited to, the Twitter Terms of Service located at www.twitter.com/tos and the
YouTube Terms of Service located at https://www.youtube.com/t/terms), and that
Sprout Social does not endorse, is not liable for, and makes no representations as
to the Third Party Service, its content, or the manner in which such Third Party
Service uses, stores, or processes your data. We are not liable for any damage or
loss arising from or in connection with your enablement of such Third Party Service
and your reliance on the policies, privacy practices, and data security processes of
such Third Party Service. We are not responsible or liable for any changes to or
deletion of your data by the Third Party Service. Certain features of our Products
may depend on the availability of these Third Party Services and the features and
functionality they make available to us. We do not control Third Party Service
features and functionality, and they may change without any notice to us. If any
Third Party Service stops providing access to some or all of the features or
functionality currently or historically available to us, or stops providing access to
such features and functionality on reasonable terms, as determined by Sprout
Social in our sole discretion, we may stop providing access to certain features and
functionality of our Products. We will not be liable to you for any refunds or any
damage or loss arising from or in connection with any such change made by the
Third Party Service or any resulting change to our Products. You irrevocably waive
any claim against Sprout Social with respect to such Third Party Services.
6.PAYMENT TERMS
You will either pay for your Plan in our Application, or upon receipt of an invoice issued
by us.
6.1. Payment in Application
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
2/23/2021 Terms of Service | Sprout Social
https://sproutsocial.com/terms/4/16
Monthly Plans. For monthly Plans, we will charge you on the first day of your
subscription term and automatically on the same date of each subsequent month
(“Monthly Pay Date”). We will continue to charge you for your Plan, including any
Add-Ons, on a monthly basis unless you decide to cancel at any time by accessing
the “Billing” page within the Application. If you cancel in the month preceding your
Monthly Pay Date, you will not be issued any refunds or credits of prepaid and
unused fees for the remainder of the subscription term and you will continue to
have access to the Products until the following Monthly Pay Date.
Annual Plans. For annual Plans, we will charge you on the first day of your
subscription term and automatically on the same date of each subsequent year
(“Annual Pay Date”). We will continue to charge you for your Plan, including any
Add-Ons, on an annual basis unless you decide to cancel prior to the Annual Pay
Date by accessing the “Billing” page within the Application. If you cancel during the
subscription term, you will not be issued any refunds or credits of any prepaid and
unused fees for the remainder of the subscription term and you will continue to
have access to the Products until the following Annual Pay Date. Sprout Social
reserves the right to increase subscription fees for your annual Plan on your Annual
Pay Date; provided, however, that such increase shall not exceed 7% over the fees
related to the immediately preceding subscription term.
6.2. Payment By Invoice. If we invoice you for your Plan, your subscription term will
be detailed on the service order and your payment will be due upon receipt of the
applicable invoice. Unless otherwise specified on your service order, if we do not
receive payment within thirty (30) days of us issuing you the invoice, your account
may be suspended and you will lose access to the Products. Unless otherwise
specified on your service order, your Plan will automatically renew at the end of the
subscription term. If you would like to cancel your Plan, you can provide such notice
via email to successteam@sproutsocial.com. Sprout Social reserves the right to
increase subscription fees upon renewal; provided, however, that such increase
shall not exceed 7% over the fees related to the immediately preceding subscription
term.
6.3. Changes To Your Plan. If you choose to upgrade your Plan or add any Add-
Ons to your Plan during your subscription term, you will be charged for the then-
current price for the upgrade or Add-Ons prorated based on the number of days
remaining in your subscription term. Unless otherwise specified on your service
order, any upgrade or Add-Ons that you add will be coterminous with the existing
Plan and automatically renew at the end of the subscription term along with your
Plan. If you choose to downgrade your Plan or remove any Add-Ons from your Plan,
you will not be issued any refunds or credits for the unused and prepaid fees in
connection with the downgrade or removal. Downgrading your Plan may cause the
loss of content, features, or capacity of your account and we do not accept any
liability for any such loss.
6.4. Credit Card and Paypal Authorization. By submitting your credit card or
Paypal information to Sprout Social, you authorize Sprout Social to store this
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
2/23/2021 Terms of Service | Sprout Social
https://sproutsocial.com/terms/5/16
information with its third party service providers and to charge the credit card or
Paypal account you have provided to us until your account is terminated. In
addition, you authorize us to use a third-party payment processor in processing
payments. If your credit card expires, or is declined or your Paypal information
requires an update, we will provide you notice via email. If, for any reason, your
payment cannot be completed through credit card or Paypal, we may suspend your
account until we receive payment.
6.5. Disputes and Late Payments. You must notify us in writing of any amounts you
wish to dispute prior to the date such amounts would otherwise be due. Any
undisputed amount not paid when due shall be subject to a finance charge of 1.5%
of the unpaid balance per month or the highest rate permitted by applicable law,
whichever is less, determined and compounded daily from the date due until the
date paid. You will also be required to reimburse us for any costs or expenses
(including any reasonable attorneys’ fees) we incur to collect past due amounts. Any
amounts due under these Terms shall not be withheld or offset by you against
amounts due to you for any reason.
6.6. Taxes. All payments you make are exclusive of federal, state, local, and foreign
taxes, duties, tariffs, levies, withholdings, and similar assessments (including,
without limitation, sales taxes, use taxes, and value-added taxes). You agree to be
responsible for the payment of all such charges, excluding taxes based upon our
net income. All amounts payable by you hereunder shall be grossed up for any
withholding taxes imposed by any foreign government on your payment of amounts
to Sprout Social.
7.CANCELLATION AND TERMINATION
7.1. Termination by You. You may terminate your account at any time without cause,
but you will not be entitled to any refunds of any prepaid and unused fees, and any
unpaid fees under your Plan for the applicable subscription term will become
immediately due and payable. You may terminate your account and receive a
prorated refund of any prepaid and unused fees, if we fail to cure a material breach
of these Terms within thirty (30) days of our receipt of written notice from you
describing the breach. You may also cancel your account as provided in Section 6
(Payment).
7.2. Termination by Us. We may restrict functionality of the Products or temporarily
suspend your account if we reasonably believe that you have violated these Terms.
Unless we believe the need to restrict or suspend access is time-sensitive and
requires immediate action without notice, or we are prohibited from providing
notice under law or legal order, we will use commercially reasonable efforts to
notify you by email prior to such suspension. We will not be liable to you or any third
parties for any of the foregoing actions. We may terminate your account and use of
the Products for any of the following reasons: (i) you fail to comply with these Terms,
(ii) you do not pay your fees in accordance with the payment terms under your Plan,
(iii) at the expiration of the subscription period of your Plan if we provide prior
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
2/23/2021 Terms of Service | Sprout Social
https://sproutsocial.com/terms/6/16
written notice to you, (iv) you become the subject of a petition in bankruptcy or any
other proceeding relating to insolvency, receivership, liquidation or assignment for
the benefit of creditors, or (v) if we reasonably determine you are acting or have
acted in a way that could present substantial reputational harm to Sprout Social or
our current or prospective partners or customers. In no event will any termination by
us for the foregoing reasons entitle you to any refunds of any prepaid and unused
fees or relieve you of your obligation to pay any fees payable to us prior to the date
of termination, and any unpaid fees under your Plan will become immediately due
and payable. Any suspected fraudulent, abusive, hateful, discriminatory or illegal
activity may be grounds for immediate termination of your use of the Product and
may be referred to law enforcement authorities.
7.3. Post Termination. If your account is terminated, you must cease using the
Products and Sprout Social reserves the right to delete your account settings and
Content within thirty (30) days of such cancellation or termination with no liability or
notice to you. Once your account settings and Content are deleted, you will not be
able to recover such account settings and Content, except any Content that
remains on Third Party Services pursuant to the terms and conditions of such Third-
Party Services.
8.YOUR USE OF THE PRODUCTS
8.1. You agree not to, nor authorize or permit any User or third party to: (a) license,
sublicense, sell, rent, lease, or otherwise permit third parties to use the Products; (b)
circumvent or disable any security or other technological features or measures of
the Products; (c) reverse engineer any element of the Products, or use the Products
to compete with the Products, (d) modify, adapt or present the Products to falsely
imply any sponsorship or association with Sprout Social; (e) use the Products in any
manner that interferes with or disrupts the integrity or performance of the Products
or the components of the Products; (f ) use the Products to post, upload, link to,
send or store any Content that is defamatory, libelous, fraudulent, derogatory,
abusive, obscene, unlawful, hateful, harassing, violent, threatening, racist, or
discriminatory, (g) use the Products to post, upload, link to, send, distribute, or store
any Content that contains any viruses, malware, Trojan horses, ransomware, or any
other similar harmful software; (h) use the Products to post, upload, link to, send,
distribute, or store any Content that is material protected by copyright, trademark,
or any other proprietary right without first having obtained all rights, permissions,
and consents necessary to make such Content available on or through the Products
and to grant Sprout Social the limited right to use Content as set forth in these
Terms, (i) attempt to use any method to gain unauthorized access to any paid or
restricted features of the Sites or to the Products and its related systems or
networks, (j) use automated scripts to collect information from or otherwise interact
with Third Party Services or the Products; (k) deep-link to the Sites (other than
Sprout Social’s home page) for any purpose, unless expressly authorized in writing
by Sprout Social; (l) impersonate any other user of the Products; or (m) use the
Products in violation of applicable law or any acceptable use policy, terms of use
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
2/23/2021 Terms of Service | Sprout Social
https://sproutsocial.com/terms/7/16
(including, but not limited to, the Twitter Terms of Service located at
www.twitter.com/tos and the YouTube Terms of Service located at
https://www.youtube.com/t/terms) or any similar policy or terms of Third-Party
Services.
8.2. You agree not to use, and not to knowingly display, distribute, or otherwise
make content or information derived from the Products available to any entity for
the purpose of: (i) conducting or providing surveillance or gathering intelligence,
including but not limited to, investigating or tracking individual social media users or
their content, or to obtain information on social media users or their content, in a
manner that would require a subpoena, court order, or other valid legal process; (ii)
tracking, alerting, or other monitoring of sensitive events (including but not limited
to protests, rallies, or community organizing meetings); (iii) conducting or providing
surveillance, analyses or research that isolates a group of individuals or any single
individual on social media for any unlawful or discriminatory purpose or in a manner
that would be inconsistent with the individual users’ reasonable expectations of
privacy; (iv) violating the Universal Declaration of Human Rights (located at
http://www.un.org/en/documents/udhr/), including, without limitation, Articles 12,
18, or 19; or (v) targeting, segmenting, or profiling individuals based on sensitive
personal information, including health (e.g. pregnancy), negative financial status or
condition, political affiliation or beliefs, racial or ethnic origin, religious or
philosophical affiliation or beliefs, sex life or sexual orientation, trade union
membership, data relating to any alleged or actual commission of a crime, or any
other sensitive categories of personal information prohibited by law.
8.3. If you are a government entity or an entity performing services on behalf of a
government entity, each of your use cases for our Products must be approved by
Sprout Social prior to use of our Products. Failure to obtain approval for any use
case will result in suspension and potential termination pursuant to Sections 7.2 and
8.4.
8.4. We have the right to terminate your account or suspend your access to the
Products, if we reasonably suspect that you have violated any of the restrictions in
this Section 8.
8.5. By accessing or using the Products, you represent and warrant that your
activities are lawful in every jurisdiction where you access or use the Products. Our
Products are not intended to hold any Sensitive Information. You represent and
warrant that you will not use our Products to transmit, upload, collect, manage, or
otherwise process any Sensitive Information. WE WILL NOT BE LIABLE FOR ANY
DAMAGES THAT MAY RESULT FROM YOUR USE OF OUR PRODUCTS IN
TRANSMITTING, COLLECTING, MANAGING, OR PROCESSING ANY SENSITIVE
INFORMATION. “Sensitive Information” means any passwords, credit card or debit
card information, personal financial account information, personal health
information, social security numbers, passport numbers, driver’s license numbers,
employment records, physical or mental health condition or information, any
information that would classify as “Special Categories of Information” under EU data
protection laws, or any other information that would be subject to Health Insurance
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
2/23/2021 Terms of Service | Sprout Social
https://sproutsocial.com/terms/8/16
Portability and Accountability Act (HIPAA), the Payment Card Industry Data Security
Standards (PCI DSS), or other laws, regulations, or industry standards designed to
protect similar information.
8.6. Although we do not monitor content published through our Products and are
not responsible for any content published through our Products, we reserve the
right to delete, edit, or move messages or materials that we deem necessary to be
removed, including, but not limited to, public postings, advertisements, and
messages.
8.7. Inbox Export Feature. The Inbox Export feature available on our Sprout Social
Product may contain confidential information, including personal information. By
initiating an Inbox Export, you acknowledge and agree that we are not responsible
for, and shall have no liability related to, the security of the information contained in
the Inbox Export or compliance with any applicable law of any federal, state, local,
or foreign government or political subdivision thereof, including applicable privacy
law, as a result of fulfilling your request to send the Inbox Export.
8.8. Twitter Custom Profile. By associating a custom profile image and/or name
with a specific Twitter profile, you acknowledge and agree that (i) if an individual is
depicted, you have consent from such individual to display their name and/or
likeness in the custom profile, (ii) you will indicate in the field provided for the
individual’s name (e.g., through use of the term “bot”), or in the initial message sent
to each Twitter user that the individual is not participating in the conversation; and
(iii) you will comply with all Twitter Terms of Service and other applicable acceptable
use policy, terms of use, or any similar policy or terms.
9.CONFIDENTIAL INFORMATION
9.1. For the purpose of these Terms, “Confidential Information” means non-public
information disclosed by either party to the other party, either directly or indirectly,
in writing, orally, or to which the other party may have access, which (i) a reasonable
person would consider confidential, or (ii) is marked “confidential” or “proprietary”
or some similar designation by the disclosing party. Confidential Information will not,
however, include any information that (i) was publicly known and made generally
available in the public domain prior to the time of disclosure by the disclosing party;
(ii) becomes publicly known and made generally available after disclosure by the
disclosing party to the receiving party other than as a result of a violation of these
Terms by the receiving party; (iii) is already in the possession of the receiving party
at the time of disclosure by the disclosing party; (iv) is obtained by the receiving
party from a third party without a breach of the third party’s obligations of
confidentiality; or (v) is independently developed by the receiving party without use
of or reference to the disclosing party’s Confidential Information. The receiving
party shall not disclose, use, transmit, inform or make available to any entity, person
or body any of the Confidential Information, except as a necessary part of
performing its obligations under these Terms, and shall take actions reasonably
necessary and appropriate to prevent the unauthorized disclosure of the
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
2/23/2021 Terms of Service | Sprout Social
https://sproutsocial.com/terms/9/16
Confidential Information, at all times exercising at least a reasonable level of care.
Each party agrees to restrict access to the Confidential Information of the other
party to those employees, advisors, agents and other representatives who require
access in order to perform its obligations under these Terms.
10.AGENCIES
10.1. If you are an Agency, you may use our Products on behalf of Users that are
your clients and charge your clients for such use of our Products. As an Agency,
you will be liable for all use of the Products by your clients. By adding any client to
your account, you represent and warrant that you have obtained all necessary
authorizations and consents from such clients to bind them to these Terms. If you
use the Products on behalf of your clients, or grant access to the products to your
clients, you will be responsible for ensuring that such clients are not able to access
confidential or proprietary information of another client. “Agency” shall mean a
business or organization providing advertising, marketing, or social media services
on behalf of another business, person, or group.
10.2. If you are an Agency participating in our Agency Partner Program, you are
subject to the additional terms that are found here.
11.DATA PRIVACY
11.1. We access your data to enable us to respond to your service requests and as
necessary to provide you with the Application and Products. We share your data
with third parties if required by law, permitted by you, or pursuant to our Sprout
Social Privacy Policy (“Privacy Policy”), which is available here and incorporated
into these Terms. You agree to all actions that are taken with respect to your data
that are consistent with our Privacy Policy. Before sharing your data, we will take
steps designed to ensure that any third party service provider maintains
commercially reasonable data practices for maintaining the confidentiality and
security of your data and for preventing unauthorized access to such data. We do
not share your data with third parties for their own marketing purposes.
11.2. You hereby represent and warrant that your Content has not been collected,
stored, and transferred to us in violation of any law, regulation, or contractual
obligation applicable to you. You shall have sole responsibility for the accuracy,
quality, and legality of the Content and the means by which you acquired the
Content. With respect to your Users and any individuals that interact or engage with
Customer’s social media pages or profiles (including fans, followers, and other
social media audience members), you shall be responsible for establishing the
lawfulness of processing under Article 6 of the General Data Protection Regulation
2016/679 and complying with all applicable laws related to privacy and data
protection in respect of your use of the Products, your processing of personal data,
and any processing instructions you issue to us.
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
2/23/2021 Terms of Service | Sprout Social
https://sproutsocial.com/terms/10/16
11.3. If your use of our Products includes processing “personal data” that is subject
to the General Data Protection Regulation (EU) 2016/679 or “personal information”
that is subject to the California Consumer Privacy Act, you must enter into a Data
Processing Addendum (“DPA”) with Sprout Social that is available here. Our Privacy
Policy as well as any DPA that you enter into with Sprout Social forms part of these
Terms and applies to the processing of personal data. You may review our Privacy
Policy to understand how we collect and use your data. Sprout Social holds a
Privacy Shield certification under both the EU-U.S. and Swiss-U.S. Privacy Shield
frameworks established by the U.S. Department of Commerce regarding the
transfer of personal data from the European Economic Area and/or Switzerland, as
applicable, to the U.S.
12.YOUR RIGHTS AND OUR RIGHTS TO IP
12.1. What You Own. You own all of the Content you provide to us. You grant us a
nonexclusive, revocable, worldwide, perpetual, fully paid-up and royalty-free right to
us to use, copy, prepare derivative works of, distribute, publish, remove, retain, add,
process, or analyze this information for the sole purpose of providing the
Applications and Products to you and your Users. You represent and warrant that
you are entitled to and authorized to submit the Content and that such Content you
submit is accurate and not in violation of any contractual restrictions or third party
rights.
12.2. What We Own. We own and retain all rights, title, and interest in and to the
Products along with all patents, inventions, copyrights, trademarks, domain names,
trade secrets, know-how, and any other intellectual property and/or proprietary
rights (“Intellectual Property Rights”) related to the Products. Your use of the
Products under these Terms does not give you additional rights in the Products or
ownership of any Intellectual Property Rights associated with the Products. Subject
to your compliance with and limitations set forth in these Terms and upon your
subscription to the Products, we grant you a non-exclusive, non-transferable, non-
sublicensable, revocable license to access and use our Products and Applications.
12.3. Ownership of Your Feedback and Suggestions. Although you are not
required to provide feedback or suggestions, you assign to us all of your worldwide
right, title and interest in and to any and all feedback, suggestions, requests,
recommendations, or other comments that you provide to us regarding our
Products, including all Intellectual Property Rights therein. You shall, upon the
request of Sprout Social, its successors or assigns, execute any and all documents
that may be deemed necessary to effectuate this assignment. You also agree to
waive any right of approval for our use of the rights granted herein and agree to
waive any moral rights that you may have in any feedback, suggestions, or other
comments, even if it is altered or changed in a manner not agreeable to you. You
understand that you will not receive any fees, sums, consideration, or remuneration
for any of the rights granted in this section. Our receipt of your feedback,
suggestions, and other comments is not an admission of their novelty, priority, or
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
2/23/2021 Terms of Service | Sprout Social
https://sproutsocial.com/terms/11/16
originality, and it does not impair our right to any existing or future Intellectual
Property Rights.
12.4. Our Ownership of Statistical Data. You acknowledge and agree that we have
a right to own and complete statistical analyses on your data and information
resulting from your or your Users’ use of the Products (other than any personally
identifiable data). When we extract, compile, synthesize, or analyze this data, we will
only use it in anonymized, deidentified, or aggregated form without specifying the
source of the data. We collect such data for any lawful purpose and without a duty
of accounting to you.
13.SPROUT SOCIAL MOBILE APP
13.1. Use of the Mobile Applications require that your mobile device be compatible
with the Mobile Applications. The Mobile Applications may automatically upgrade
from time to time depending on your user settings. You consent to such automatic
upgrades and the standard carrier data charges that may apply to your use of the
Mobile Applications. Please review the Mobile Application Additional Terms that
apply to your use of the Mobile Applications here.
14.WARRANTY
14.1. THE APPLICATIONS AND PRODUCTS ARE PROVIDED ON AN “AS IS” BASIS,
WITHOUT ANY WARRANTIES, GUARANTEES, CONDITIONS, OR
REPRESENTATIONS OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY
LAW, WE EXPRESSLY DISCLAIM ANY AND ALL WARRANTIES, WHETHER EXPRESS,
IMPLIED, OR STATUTORY, INCLUDING, BUT NOT LIMITED TO, EXPRESS OR
IMPLIED WARRANTIES OF MERCHANTABILITY, DESIGN, TITLE, QUALITY, FITNESS
FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE CANNOT AND DO
NOT WARRANT THAT THE APPLICATIONS AND PRODUCTS WILL BE
UNINTERRUPTED, AVAILABLE, ACCESSIBLE, SECURE, TIMELY, ACCURATE,
COMPLETE, FREE FROM VIRUSES, OR ERROR-FREE. SPROUT SOCIAL DISCLAIMS
ALL LIABILITY FOR ANY MALFUNCTIONING, IMPOSSIBILITY OF ACCESS, OR
POOR USE CONDITIONS OF THE SERVICES DUE TO INAPPROPRIATE
EQUIPMENT, DISTURBANCES RELATED TO INTERNET SERVICE PROVIDERS, TO
THE SATURATION OF THE INTERNET NETWORK OR ANY OTHER ERROR,
OMISSION, INTERRUPTION, DELETION, DEFECT, DELAY IN OPERATION OR
TRANSMISSION, COMMUNICATIONS LINE FAILURE, THEFT OR DESTRUCTION OR
UNAUTHORIZED ACCESS TO, OR ALTERATION OF, DATA NOT WITHIN SPROUT
SOCIAL’S REASONABLE CONTROL.
15.OUR INDEMNIFICATION OF YOU
15.1. We agree to defend, indemnify, and hold you harmless from any and all claims,
losses, demands, liabilities, damages, settlements, expenses, and costs (including
reasonable attorney’s fees and costs) brought by a third party against you alleging
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
2/23/2021 Terms of Service | Sprout Social
https://sproutsocial.com/terms/12/16
your use of any Product infringes or misappropriates any patent, copyright, trade
secret, trademark, or intellectual property right of any third party. We will not have
any obligation under this section for any infringement or misappropriation if it arises
out of or is based upon: (a) any use of the Products that is in combination with other
products or services if such infringement or misappropriation would not have arisen
but for such combination, (b) use of the Products by you for purposes not intended,
permitted, or outside of the scope of the license granted to you, or (c) any
modification of the Products not made or authorized in writing by Sprout Social (the
“Excluded Claims”). If you are enjoined or otherwise prohibited from using a
Product or a portion thereof based on an allegation that the Product violates any
third party intellectual property right, or if we reasonably determine that such
prohibition is likely, then we will, at our sole expense and option: (a) obtain for you
the right to use the allegedly infringing portions of the Products; (b) modify the
allegedly infringing portions of the Products so as to render them non-infringing
without substantially diminishing or impairing their functionality, or (c) replace the
allegedly infringing portions of the Products with non-infringing items of
substantially similar functionality. If we determine that the foregoing remedies are
not commercially reasonable, then we may terminate the impacted subscription, or
portion thereof, and will promptly provide a prorated refund or credit to you for any
prepaid and unused fees.
16.YOUR INDEMNIFICATION OF US
16.1. Your failure to comply with any of your obligations set forth in these Terms shall
be considered a breach of these Terms. You agree to defend, indemnify, and hold
harmless Sprout Social and its officers, directors, employees, agents, successors,
and assigns from any and all third party claims, losses, demands, liabilities,
damages, settlements, expenses, and costs (including attorney’s fees and costs),
arising from, in connection with, or based on allegations of, your or your Users’
breach of these Terms, use of Third-Party Services, or for any action arising from the
Excluded Claims.
16.2. Requirements for Indemnification. Either party’s indemnification obligations
shall be contingent on: (a) the indemnified party (“Indemnitee”) providing the
indemnifying party (“Indemnitor”) prompt written notice of the claim, (b) Indemnitee
granting Indemnitor full and complete control over the defense and settlement of
the claim, and (c) Indemnitee providing assistance in connection with the defense
and settlement of the claim as Indemnitor shall reasonably request.
17.LIMITATION OF LIABILITY
17.1. Exclusion of Consequential and Related Damages. NEITHER PARTY NOR ITS
AFFILIATES WILL, UNDER ANY CIRCUMSTANCES, BE LIABLE TO THE OTHER
PARTY, UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF
CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE,
FOR CONSEQUENTIAL, INCIDENTAL, INDIRECT, SPECIAL, EXEMPLARY,
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
2/23/2021 Terms of Service | Sprout Social
https://sproutsocial.com/terms/13/16
ENHANCED, OR PUNITIVE DAMAGES ARISING OUT OF OR RELATED TO THESE
TERMS, INCLUDING BUT NOT LIMITED TO LOST PROFITS, REVENUE, BUSINESS,
OR DATA; BUSINESS INTERRUPTION; OR LOSS OF GOODWILL OR REPUTATION,
REGARDLESS OF WHETHER THE PARTY IS APPRISED OF THE LIKELIHOOD OF
SUCH DAMAGES OCCURRING OR ANY LOSSES OR DAMAGES WERE OTHERWISE
FORESEEABLE.
17.2. Monetary Cap on Liability. UNDER NO CIRCUMSTANCES WILL THE
AGGREGATE LIABILITY OF SPROUT SOCIAL AND OUR RESPECTIVE AFFILIATES
ARISING OUT OF OR RELATED TO THESE TERMS (INCLUDING BUT NOT LIMITED
TO WARRANTY CLAIMS), REGARDLESS OF THE FORUM AND REGARDLESS OF
WHETHER ANY ACTION OR CLAIM IS BASED ON CONTRACT, TORT (INCLUDING
NEGLIGENCE), STRICT LIABILITY, OR ANY OTHER LEGAL OR EQUITABLE THEORY,
EXCEED THE TOTAL AMOUNT PAID BY YOU TO SPROUT SOCIAL UNDER THE
APPLICABLE PLAN DURING THE TWELVE MONTHS PRECEDING THE EVENT
GIVING RISE TO THE CLAIM. THE FOREGOING LIMITATIONS WILL NOT IN ANY
WAY LIMIT YOUR PAYMENT OBLIGATIONS UNDER SECTION 6 ABOVE. THE
LIMITATION OF LIABILITY PROVIDED FOR HEREIN WILL APPLY IN AGGREGATE TO
YOU AND YOUR AFFILIATES.
17.3. Independent Allocations of Risk. EACH PROVISION OF THESE TERMS THAT
PROVIDES FOR A LIMITATION OF LIABILITY, DISCLAIMER OF WARRANTIES, OR
EXCLUSION OF DAMAGES IS TO ALLOCATE THE RISKS OF THESE TERMS
BETWEEN THE PARTIES. THIS ALLOCATION IS REFLECTED IN THE PRICING
OFFERED BY SPROUT SOCIAL TO YOU AND IS AN ESSENTIAL ELEMENT OF THE
BASIS OF THE BARGAIN BETWEEN THE PARTIES. EACH OF THESE PROVISIONS
IS SEVERABLE AND INDEPENDENT OF ALL OTHER PROVISIONS OF THESE
TERMS. THE LIMITATIONS IN THIS SECTION WILL APPLY NOTWITHSTANDING THE
FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY.
17.4. State Prohibition of Limitation of Liability and Disclaimer of Implied
Warranties. Some states do not allow the exclusion of implied warranties or
limitation of liability for incidental or consequential damages, which means that
some of the above limitations may not apply. IN THESE STATES, EACH PARTY’S
LIABILITY WILL BE LIMITED TO THE GREATEST EXTENT PERMITTED BY LAW.
18.MISCELLANEOUS
18.1. Use of Logo. As a Customer, you grant us the right to use your company name
and logo on our website and in any promotional materials press releases, investor
materials, and other stockholder communications. If you do not wish to have your
name or logo be used in this way, or wish to remove your name or logo from such
list, please email logo@sproutsocial.com.
18.2. Updates To Terms. We may revise and update these Terms from time to time,
in our sole discretion. Any changes we make to these Terms are effective
immediately when we post them. We will provide notice to the account owner
designated on the account of any material changes. Continued use of our Products
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
2/23/2021 Terms of Service | Sprout Social
https://sproutsocial.com/terms/14/16
after we provide you notice of the updated Terms shall constitute acceptance of the
updated Terms.
18.3. Export Compliance and Anti-Corruption. The Products may be subject to
export laws and regulations of the United States and other jurisdictions. You
represent that you are not named on any U.S. government denied-party list. You will
not permit Users or any other third party to access or use the Products subject to a
U.S. government embargo or in violation of any U.S. export law or regulation. You
further represent that you have not received or been offered any illegal or improper
bribe, kickback, payment, gift, or thing of value in connection with your purchase or
use of our Products (excluding any reasonable gifts and entertainment provided in
the ordinary course of business).
18.4. Federal Government End Use Provisions. If you are a U.S. federal
government end user, the Products are “Commercial Items” as that term is defined
at 48 C.F.R. §2.101, consisting of “Commercial Computer Software” and “Commercial
Computer Software Documentation”, as those terms are used in 48 C.F.R. §12.212 or
48 C.F.R. §227.7202. Consistent with 48 C.F.R. §12.212 or 48 C.F.R. §227.7202-1
through 227.7202-4, as applicable, the Products are licensed to you with only those
rights as provided under these Terms.
18.5. Assignability. Neither party may assign its right, duties, and obligations under
these Terms without the other party’s prior written consent, which consent will not
be unreasonably withheld or delayed, except that Sprout Social may assign these
Terms, and the licenses granted to Sprout Social under these Terms, without your
consent to a successor (including a successor by way of merger, acquisition, sale of
assets, or operation of law) if the successor agrees to assume and fulfill all of Sprout
Social’s obligations under these Terms.
18.6. Notices. Except as otherwise specified in these terms, any notices under
these Terms must be sent to Sprout Social by email to legal@sproutsocial.com,
with a duplicate copy sent via registered mail (return receipt requested) to: Sprout
Social, Inc., Attention: Legal Department; 131 S. Dearborn Suite 700, Chicago, Illinois
60603. Any notices under these Terms that are sent to you shall be sent via email
to the named account owner of your Sprout Social account. You are responsible for
maintaining the accuracy of the email address and other contact information of your
named account owner on the “Personal Settings” page within the Application.
18.7. Force Majeure. Neither party will be liable for, or be considered to be in
breach of or default under these Terms on account of, any delay or failure to
perform as required by these Terms as a result of any cause or condition beyond its
reasonable control, so long as that party uses commercially reasonable efforts to
avoid or remove the causes of non-performance.
18.8. Governing Law. These Terms will be interpreted, construed, and enforced in
all respects in accordance with the local laws of the State of Illinois, U.S.A., without
reference to its choice of law rules and not including the provisions of the 1980 U.N.
Convention on Contracts for the International Sale of Goods.
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
2/23/2021 Terms of Service | Sprout Social
https://sproutsocial.com/terms/15/16
18.9. Venue. In circumstances where the Agreement to Arbitrate Disputes (Section
18.10) permits the parties to litigate in court, these Terms shall be governed by and
construed in accordance with the laws of the State of Illinois, excluding its conflict of
law rules. Under such limited circumstances, each party hereby expressly and
irrevocably consents to the exclusive jurisdiction and venue of the federal, state,
and local courts in Cook County, Illinois in connection with such an action.
18.10. Agreement to Arbitrate Disputes. You and Sprout Social agree to resolve
any claims relating to these Terms through final and binding arbitration, except to
the extent you have in any manner violated or threatened to violate Sprout Social’s
Intellectual Property Rights. Under such limited circumstances, Sprout Social may
bring a lawsuit solely for injunctive relief to stop unauthorized use or abuse of the
Products, or intellectual property infringement without first engaging in arbitration
or the informal dispute-resolution process described herein. In all other cases, both
parties hereby agree to submit to arbitration administered by the American
Arbitration Association under its Commercial Arbitration Rule with one (1) arbitrator
to be selected by mutual agreement of the parties. If we cannot agree on the
arbitrator selection, then the American Arbitration Association shall choose an
arbitrator for us from the National Panel of Arbitrators. You agree that an arbitrator
cannot award punitive damages to either party and to abide by and perform any
award rendered by the arbitrator. Judgment upon the award rendered by the
arbitrator may be entered in any court having jurisdiction, which shall include, but
not be limited to, the courts within Cook County, Illinois.
18.11. Waiver and Severability. The waiver by Sprout Social of any term or condition
set out in these Terms shall not be deemed a further or continuing waiver of any
other provision of these Terms, and any failure of Sprout Social to assert a right or
provision under these Terms shall not constitute a waiver of such right or provision.
If any provision of these Terms is held by a court or other tribunal of competent
jurisdiction to be invalid, unenforceable, or illegal for any reason, such provision
shall be limited to the minimum extent such that the remaining provisions of the
Terms will continue in full force and effect.
18.12. Entire Agreement. Except for any service order, these Terms are the final and
complete expression of the agreement between these parties regarding your use
of the Products and Application. These Terms supersede, and the terms of these
Terms govern, all previous oral and written communications regarding these
matters, all of which are merged into these Terms. Sprout Social will not be bound
by, and specifically objects to, any term, condition, or other provision that is
different from or in addition to these Terms (whether or not it would materially alter
this agreement) that is proffered by you in any receipt, invoice, acceptance,
purchase order, confirmation, correspondence, or otherwise, regardless of Sprout
Social’s failure to object to such terms, provisions or conditions.
18.13. Relationship; Independent Contractor. Nothing herein contained shall be so
construed as to constitute the parties as principal and agent, employer and
employee, partners or joint venturers, nor shall any similar relationship be deemed
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
2/23/2021 Terms of Service | Sprout Social
https://sproutsocial.com/terms/16/16
to exist between the parties. Neither party shall have any power to obligate or bind
the other party, except as specifically provided herein.
18.14. Survival. Section 5 (Use of Third Party Services), Section 6 (Payment Terms),
Section 7 (Cancellation and Termination), Section 8 (Your Use of the Product),
Section 9 (Confidential Information). Section 12 (Your Rights and Our Rights to IP),
Section 14 (Warranty), Section 15 (Our Indemnification of You), Section 16 (Your
Indemnification of Us), Section 17 (Limitation of Liability), and Section 18
(Miscellaneous) will survive any termination of these Terms.
18.15. DMCA. The Digital Millennium Copyright Act of 1998 (the “DMCA”) provides
recourse for copyright owners who believe that material appearing on the Internet
infringes their rights under U.S. copyright law. If you believe in good faith that
content or material on the Products, the Applications (app.sproutsocial.com,
app.getbambu.com, and/or app.simplymeasured.com), or on Sprout Social’s website
(www.sproutsocial.com) or any of its web properties hosted on the sproutsocial.com
domain infringes a copyright owned by you, you (or your agent) may send Sprout
Social DMCA agent a notice requesting that the material be removed, or access to
it blocked. This request should be sent to: legal@sproutsocial.com; or, alternatively
to: Sprout Social, Inc., Attn: DMCA Registered Agent, 131 S. Dearborn St., Ste. 700,
Chicago, IL 60603; (866) 878-3231. The notice must include the following
information: (a) a physical or electronic signature of a person authorized to act on
behalf of the owner of an exclusive right that is allegedly infringed; (b) identification
of the copyrighted work claimed to have been infringed; (c) identification of the
material that is claimed to be infringing or the subject of infringing activity; (d) the
name, address, telephone number, and email address of the complaining party; (e) a
statement that the complaining party has a good faith belief that use of the material
in the manner complained of is not authorized by the copyright owner, its agent or
the law; and (f ) a statement that the information in the notification is accurate and,
under penalty of perjury, that the complaining party is authorized to act on behalf of
the owner of an exclusive right that is allegedly infringed. If you believe in good
faith that a notice of copyright infringement has been wrongly filed against you, the
DMCA permits you to send us a counter-notice. Notices and counter-notices must
meet the then-current statutory requirements imposed by the DMCA. Notices and
counter-notices with respect to the website should be sent to the address above.
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
EXHIBIT B
Amendment to Sprout Social Terms of Service
(Applicable to Local Government Agencies)
This Amendment to Sprout Social Terms of Service (“Amendment”) is an agreement between Sprout
Social, Inc., including its affiliates (collectively, Sprout Social”) and subscriber who is a local government
agency (“Local Government Agency” or “You” or “Your”), effective as of the date signed by Sprout Social.
Sprout Social and Local Government Agency (together, the “Parties”) agree that modifications to Sprout
Social’s Terms of Service, attached and incorporated as Exhibit A to the Parties’ Service Order
(“Agreement”), are appropriate to accommodate Your status as a public entity as a Local Government
Agency. Accordingly, the Agreement is hereby modified by this Amendment as it pertains to Your use of the
Service.
Capitalized terms that are not expressly defined in this Amendment shall have the meaning ascribed to
them in the Agreement.
Indemnification. All provisions of the Agreement whereby You indemnify Sprout Social shall be deemed
effective only to the extent permitted by law.
Governing Law and jurisdiction. Provisions in the Agreement related to governing law and arbitration are
hereby deleted and shall remain silent to the extent the Local Government Agency requires governing law
to be the state in which Local Government Agency is located.
Automatic renewal of subscription. Provisions in the Agreement related to an automatic renewal of Your
subscription shall be deemed to be hereby deleted and not apply.
Liability cap. The limitation of liability in Section 17.2 of the Agreement shall be mutual and limit Your
liability to the same extent as the liability of Sprout Social.
Protection of Confidential Information. “Confidential Information” will not include any information that the
Local Government Agency is required to disclose under federal or state law, including but not limited to the
Washington Public Records Act.
Late Payments. Notwithstanding anything to the contrary in Section 6.5 of the Agreement, You shall not be
subject to any finance charges for any undisputed amounts not paid when due.
Update to Terms. Notwithstanding anything to the contrary in Section 18.2 of the Agreement, no terms
contained within the Agreement that are the subject of this Amendment shall be amended or updated by
Sprout Social and made applicable to You or Your use of the service without Your written approval.
The parties authorized signatories have duly executed this Amendment.
Local Government Agency
Signature:
Legal Name:
Print Name:
Title:
Date:
Sprout Social, Inc.
Signature:
Print Name:
Title:
Effective Date:
Page 1 of 1
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
City of KentDana Ralph
Mayor
02/24/2021
SPROUT SOCIAL, INC.
DATA PROCESSING ADDENDUM
Revised October 2020
This Data Processing Addendum ("DPA") forms part of the Agreement between Sprout Social,
Inc. and its affiliates ("Sprout Social") and the entity entering the Agreement as a customer of
Sprout Social’s Services ("Customer").
This DPA is supplemental to the Agreement and sets out the roles and obligations that apply when
Sprout Social processes Personal Data falling within the scope of the GDPR or Personal
Information falling within the scope of the CCPA on behalf of Customer in the course of providing
the Sprout Social Services.
All capitalized terms not defined in this DPA shall have the meanings set forth in the Agreement.
1.Definitions
1.1 For the purposes of this DPA:
(a)"Agreement" means the terms and conditions or other written or electronic
agreement between Sprout Social and Customer setting out the provision and use
of the Sprout Social Services.
(b)“CCPA” means the California Consumer Privacy Act.
(c)“EEA" means the European Economic Area.
(d)"GDPR” means Regulation 2016/679 of the European Parliament and of the Council
on the protection of natural persons with regard to the processing of personal data
and on the free movement of such data, and repealing Directive 95/46/EC.
(e)"Standard Contractual Clauses" means Annex 2, attached to and forming part of
this DPA pursuant to the European Commission Decision of 5 February 2010 on
standard contractual clauses for the transfer of personal data to processors
established in third countries under Directive 95/46/EC.
(I)The terms "Controller", "Processor", "Personal Data", "processing", "special
categories of data" and "data subject" have the meanings given to them in the
GDPR.
(g)The terms “Business”, “Service Provider”, “Third Party”, “Personal Information”,
“Consumer”, “sell”, and “Business Purposes” have the meanings given to them
in the CCPA.
2.Applicability of DPA
To the extent that Sprout Social processes Personal Data falling within the scope of the
GDPR on behalf of Customer in the course of providing the Sprout Social Services, the
relevant provisions of this DPA apply. To the extent that Sprout Social processes Personal
Information falling within the scope of the CCPA on behalf of Customer in the course of
providing the Sprout Social Services, the relevant provisions of this DPA apply. For the
avoidance of doubt, where it is not clear whether the GDPR, the CCPA, or both apply, all
provisions of this DPA shall apply.
EXHIBIT C
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
3.Roles and Responsibilities
3.1 Roles of the Parties. As between Sprout Social and Customer, Customer is the Data
Controller for purposes of the GDPR of the Personal Data, and the Business for
purposes of the CCPA with respect to the Personal Information, that is provided to Sprout
Social for processing under the Agreement and as described in Appendix 1 and Sprout Social
shall process the Personal Data and/or Personal Information as a Data Processor and/or
Services Provider on behalf of Customer.
3.2 Customer Processing of Personal Data/Personal Information. Customer shall be responsible
for:
(a) Complying with all applicable laws relating to privacy and data protection in respect
of its use of the Sprout Social Services, its processing of the Personal Data and/or
Personal Information, and any processing instructions it issues to Sprout Social;
(b) Ensuring it has the right to transfer, or provide access to, the Personal Data and/or
Personal Information to Sprout Social for processing pursuant to the Agreement and
this DPA; and
(c) Ensuring that it shall not disclose (nor permit any data subject to disclose) any
special categories of data to Sprout Social for processing.
3.3 Sprout Social's processing of Personal Data/Personal Information. Sprout Social shall
process the Personal Data and/or Personal Information only for the purposes described in
the Agreement and in accordance with the lawful, documented instructions of Customer
(including the instructions of any users accessing the Sprout Social Services on Customer's
behalf) as set out in the Agreement, this DPA or otherwise in writing. Sprout Social shall not:
(a) sell the Personal Data or Personal Information; (b) retain, use, or disclose the Personal
Data or Personal Information for any purpose other than for the specific purpose of
performing the Sprout Social Services; (c) retain, use, or disclose the Personal Data or
Personal Information for a commercial purpose other than providing the Sprout Social
Services; or (d) retain, use, or disclose the information outside of the direct business
relationship between Sprout Social and the Customer. Sprout Social certifies that it
understands these restrictions and will comply with them.
4.Security
4.1 Security. Sprout Social shall implement appropriate technical and organizational measures
to protect the Personal Data and/or Personal Information from accidental or unlawful destruction,
loss, alteration, unauthorized disclosure or access (a “Security Incident”).
4.2 Confidentiality Obligations. Sprout Social shall ensure that any personnel that it authorizes
to process the Personal Data and/or Personal Information shall be subject to a duty of
confidentiality.
4.3 Security Incidents. Upon becoming aware of a Security Incident, Sprout Social shall notify
Customer without undue delay and shall provide reasonable information and cooperation to
Customer so that Customer can fulfill any data breach reporting obligations it may have under
the GDPR or other applicable laws.
4.4 Appropriate Use of Products and Services. Customer agrees that, without prejudice to Sprout
Social’s obligations under this DPA, (i) Customer is solely responsible for its use of Sprout
Social’s products and services, including (a) making appropriate use of the products and
services to ensure a level of security appropriate to the risk in respect of Customer Personal
Data/Personal Information; and (b) securing the account authentication
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
credentials, systems and devices Customer uses to access the products or services; and (ii)
Sprout Social has no obligation to protect Customer Personal Data/Personal Information that
Customer elects to store or transfer outside of Sprout Social’s and/or its sub- processors’
systems.
5.Sub-processing
5.1 Sub-processors. Customer agrees that Sprout Social may engage Sprout Social affiliates
and third party sub-processors ("Sub-processors") to process Personal Data and/or
Personal Information on Sprout Social's behalf provided that:
(a)Sprout Social shall maintain an up to date list of Sub-processors which it shall update
with details of any change in Sub-processors at least five (5) days prior to any such
change and shall notify Customer in advance of such change;
(b) Sprout Social imposes on such Sub-processors data protection terms that require it
to protect the Personal Data and/or Personal Information to the standard required by
applicable data protection laws; and
(c) The copies of the Sub-processor agreements that must be provided by Sprout Social
to Customer pursuant to Clause 5(j) of the Standard Contractual Clauses may have
all commercial information, or clauses unrelated to the Standard Contractual Clauses
or their equivalent, removed by Sprout Social beforehand; and, that such copies will
be provided by Sprout Social, in a manner to be determined in its discretion, only
upon request by Customer.
(d) Sprout Social remains liable for any breach of the DPA caused by a Sub-- processor.
(e) All such Sub-processors shall be Service Providers for purposes of the CCPA.
5.2 Objection to Sub-processors. Customer may object prior to Sprout Social's appointment or
replacement of a Sub-processor provided such objection is based on reasonable grounds
relating to data protection. In such event, the parties shall cooperate in good faith to reach a
resolution and if such resolution cannot be reached, then Sprout Social, at its discretion, will
either not appoint or replace the Sub-processor or, will permit Customer to suspend or
terminate the affected Sprout Social Service (without prejudice to any fees incurred by
Customer prior to suspension or termination).
6.International Transfers
Standard Contractual Clauses. The Standard Contractual Clauses, attached hereto as
Annex A, will apply to Customer Data that is transferred outside the EEA or the United
Kingdom, either directly or via onward transfer, to any country not recognized by the
European Commission as providing an adequate level of protection for Personal Data. The
Standard Contractual Clauses will not apply to Customer Data that is not transferred, either
directly or via onward transfer, outside the EEA or the United Kingdom. Notwithstanding the
foregoing, the Standard Contractual Clauses (or obligations the same as those under the
Standard Contractual Clauses) will not apply if Sprout Social has adopted, at its sole
discretion, Binding Corporate Rules for Processors or an alternative, recognized compliance
standard for the lawful transfer of Personal Data outside the EEA or the United Kingdom.
7.Cooperation and Audits
7.1 Data subject and consumer rights. Sprout Social shall provide reasonable assistance to
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
Customer, insofar as this is possible and at Customer's expense, to enable Customer to
respond to requests from data subjects and/or consumers seeking to exercise their rights
under the GDPR or the CCPA. In the event such request is made directly to Sprout Social,
Sprout Social shall promptly inform Customer of the same. Customer authorizes Sprout
Social to respond to requests from data subjects/or Consumers seeking to exercise their
rights under the GDPR or the CCPA in order to clarify requests.
7.2 Data protection impact assessments. Sprout Social shall, taking into account the nature of
the processing and the information available to it, provide reasonable assistance needed to
fulfil Customer's obligation under the GDPR to carry out data protection impact assessments
and prior consultations with supervisory authorities, provided, however, that Sprout Social
shall not be liable for any failure of Customer to comply with Customer’s own obligations
related thereto.
Sprout Social will be assessed against industry security frameworks or standards including,
but not limited to, SOC 2 standards. Upon request, Sprout Social shall provide a summary
copy of its most recent certified audit report to Customer, which reports shall be subject to
Sprout Social’s confidentiality terms under the Agreement.
7.3 Audits. Upon Customer’s reasonable request, and no more than once per calendar year,
Sprout Social will make available for Customer’s inspection and audit, copies of certifications,
records or reports demonstrating Sprout Social’s compliance with this DPA. In the event that
Customer reasonably determines that it must inspect Sprout Social’s premises or equipment
for purposes of this DPA, then no more than once per calendar year, any audits described in
this Section 7.3 will be conducted, at Customer’s expense, through an independent third-
party auditor (“Independent Auditor”) designated by Customer. Before the commencement
of any such on-site inspection, Customer and Sprout Social shall mutually agree on
reasonable timing, scope, and security controls applicable to the audit (including without
limitation restricting access to Sprout Social’s trade secrets and data belonging to Sprout
Social’s other customers). Any inspection will be of reasonable duration and will not
unreasonably interfere with Sprout Social’s day-to-day operations. All Independent Auditors
are required to enter into a non-disclosure agreement containing confidentiality provisions
reasonably acceptable to Sprout Social and intended to protect Sprout Social’s and its
customers’ confidential and proprietary information. Customer will make (and ensure that any
Independent Auditor makes) reasonable endeavors to avoid causing any damage, injury or
disruption to Sprout Social’s premises, equipment, personnel and business in the course of
such an audit or inspection. To the extent that Customer or any Independent Auditor causes
any damage, injury or disruption to the Sprout Social’s premises, equipment, personnel and
business in the course of such an audit or inspection, Customer will be solely responsible for
any costs associated therewith.
8.Return/Deletion of Data
Return or deletion of PersonaI Data. Upon request by Customer at the termination of the
Agreement, Sprout Social shall delete or return to Customer the Customer’s Personal Data
and/or Personal Information in Sprout Social's possession, except to the extent such data
may be required to be retained by Sprout Social under applicable laws or Sprout Social’s
data retention policies adopted in accordance with such laws, including on backup
systems; provided, however, the confidentiality obligations and use restrictions in the
Agreement will continue to apply to such Customer Personal Data for the duration of
retention. Customer acknowledges that notwithstanding the foregoing language of this
section, Sprout Social retains Customer Personal Data for up to thirteen (13) months after
the termination of any Agreement for the purposes of future account reactivation. The
parties agree that the certification of deletion of Personal Data that is described in Clause
12(1) of the Standard Contractual Clauses shall be provided by Sprout Social to Customer
only upon Customer’s request.
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
9.Liability
Each party’s liability to the other taken together in the aggregate, arising out of or related to
this DPA, whether in contract, tort or under any other theory of liability, is subject to the
limitations on liability set forth in the Agreement. Sprout Social’s total liability for all claims
from the Customer arising out of or related to the Agreement and each DPA shall apply in
the aggregate for all claims under both the Agreement and all DPAs established under this
Agreement.
10.Miscellaneous
10.1 Except as amended by this DPA, the Agreement will remain in full force and effect.
10.2 Any claims brought under this DPA shall be subject to the Agreement, including but not
limited to the exclusions and limitations of liability set forth in the Agreement.
10.3 This DPA is incorporated into and forms part of the Agreement. For matters not addressed
under this DPA, the terms of the Agreement apply. With respect to the rights and obligation
of the parties vis-à-vis each other, if there is a conflict between this DPA and the
Agreement, the DPA will control. In the event of a conflict between the terms of the DPA
and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail.
10.4 This DPA shall be governed by, and construed in accordance with, the laws of the State of
Illinois and the courts of Cook County, Illinois shall have exclusive jurisdiction to hear any
dispute or other issue arising out of, or in connection with, this DPA, except where
otherwise required by applicable data protection law or by the jurisdictional provisions set
forth in the applicable Standard Contractual Clauses.
10.5 Customer agrees that Sprout Social may modify this DPA at any time provided Sprout
Social may only modify the Standard Contractual Clauses in Annex A (i) to incorporate
any new version of the Standard Contractual Clauses (or similar model clauses) that may
be adopted under GDPR or (ii) to comply with applicable law, applicable regulation, a
court order or guidance issued by a governmental regulator or agency. If Sprout Social
makes any material modifications to this DPA, Sprout Social shall provide Customer with
at least ten (10) days notice (or such shorter period as may be required to comply with
applicable law, applicable regulation, a court order or guidance issued by a governmental
regulator or agency) before the change will take effect by either: (a) sending an email to
the email address of the designated account owner in Customer’s Sprout Social Services
account; or (b) alerting Customer via the user interface. If Customer reasonably objects to
any such change, Customer may terminate the Agreement by giving written notice to
Sprout Social within ten (10) days of notice from Sprout Social of the change.
The parties' authorized signatories have duly executed this DPA.
Customer
Signature:
Sprout Social, Inc.
Signature:
Customer Legal Name:
Print Name:
Print Name: Aaron Rankin
Title: Chief Technology Officer
Title:
Date:
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
City of Kent
Dana Ralph
Mayor
02/24/2021
ANNEX A
Standard Contractual Clauses (processors)
For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to
processors established in third countries which do not ensure an adequate level of data protection
Name of the data exporting organisation:
Address:
Tel.: ; fax: ; e-mail:
Other information needed to identify the organisation
……………………………………………………………
(the data exporter)
And
Name of the data importing organisation: Sprout Social, Inc.
Address: 131 S. Dearborn St., Suite 700, Chicago, IL 60603
Tel.: (866) 878-3231; e-mail: privacy@sproutsocial.com
Other information needed to identify the organisation:
…………………………………………………………………
(the data importer)
each a “party”; together “the parties”,
HAVE AGREED on the following Contractual Clauses (the Clauses) in order to adduce adequate
safeguards with respect to the protection of privacy and fundamental rights and freedoms of
individuals for the transfer by the data exporter to the data importer of the personal data specified in
Appendix 1.
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
Background
The data exporter has entered into a data processing addendum (“DPA”) with the data importer.
Pursuant to the terms of the DPA, it is contemplated that services provided by the data importer will
involve the transfer of personal data to data importer. Data importer is located in a country not
ensuring an adequate level of data protection. To ensure compliance with Directive 95/46/EC and
applicable data protection law, the controller agrees to the provision of such Services, including the
processing of personal data incidental thereto, subject to the data importer’s execution of, and
compliance with, the terms of these Clauses.
Clause 1
Definitions
For the purposes of the Clauses:
(a) 'personal data', 'special categories of data', 'process/processing', 'controller', 'processor',
'data subject' and 'supervisory authority' shall have the same meaning as in Directive
95/46/EC of the European Parliament and of the Council of 24 October 1995 on the
protection of individuals with regard to the processing of personal data and on the free
movement of such data;
(b) 'the data exporter' means the controller who transfers the personal data;
(c) 'the data importer' means the processor who agrees to receive from the data exporter
personal data intended for processing on his behalf after the transfer in accordance with his
instructions and the terms of the Clauses and who is not subject to a third country's system
ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;
(d) 'the subprocessor' means any processor engaged by the data importer or by any other
subprocessor of the data importer who agrees to receive from the data importer or from any
other subprocessor of the data importer personal data exclusively intended for processing
activities to be carried out on behalf of the data exporter after the transfer in accordance
with his instructions, the terms of the Clauses and the terms of the written subcontract;
(e) 'the applicable data protection law' means the legislation protecting the fundamental rights and
freedoms of individuals and, in particular, their right to privacy with respect to the processing
of personal data applicable to a data controller in the Member State in which the data
exporter is established;
(f) 'technical and organisational security measures' means those measures aimed at protecting
personal data against accidental or unlawful destruction or accidental loss, alteration,
unauthorised disclosure or access, in particular where the processing involves the
transmission of data over a network, and against all other unlawful forms of processing.
Clause 2
Details of the transfer
The details of the transfer and in particular the special categories of personal data where applicable are
specified in Appendix 1 which forms an integral part of the Clauses.
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
Clause 3
Third-party beneficiary clause
1.The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i),
Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9
to 12 as third-party beneficiary.
2.The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and
(g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter
has factually disappeared or has ceased to exist in law unless any successor entity has
assumed the entire legal obligations of the data exporter by contract or by operation of law, as
a result of which it takes on the rights and obligations of the data exporter, in which case the
data subject can enforce them against such entity.
3.The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and
(g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data
exporter and the data importer have factually disappeared or ceased to exist in law or have
become insolvent, unless any successor entity has assumed the entire legal obligations of the
data exporter by contract or by operation of law as a result of which it takes on the rights and
obligations of the data exporter, in which case the data subject can enforce them against such
entity. Such third-party liability of the subprocessor shall be limited to its own processing
operations under the Clauses.
4.The parties do not object to a data subject being represented by an association or other
body if the data subject so expressly wishes and if permitted by national law.
Clause 4
Obligations of the data exporter
The data exporter agrees and warrants:
(a) that the processing, including the transfer itself, of the personal data has been and will
continue to be carried out in accordance with the relevant provisions of the applicable data
protection law (and, where applicable, has been notified to the relevant authorities of the
Member State where the data exporter is established) and does not violate the relevant
provisions of that State;
(b) that it has instructed and throughout the duration of the personal data processing services
will instruct the data importer to process the personal data transferred only on the data
exporter's behalf and in accordance with the applicable data protection law and the Clauses;
(c) that the data importer will provide sufficient guarantees in respect of the technical and
organisational security measures specified in Appendix 2 to this contract;
(d) that after assessment of the requirements of the applicable data protection law, the security
measures are appropriate to protect personal data against accidental or unlawful destruction
or accidental loss, alteration, unauthorised disclosure or access, in particular where the
processing involves the transmission of data over a network, and against all other unlawful
forms of processing, and that these measures ensure a level of security appropriate to the risks
presented by the processing and the nature of the data to be protected having regard to the
state of the art and the cost of their implementation;
(e) that it will ensure compliance with the security measures;
(f) that, if the transfer involves special categories of data, the data subject has been informed or
will be informed before, or as soon as possible after, the transfer that its data could be
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
transmitted to a third country not providing adequate protection within the meaning of
Directive 95/46/EC;
(g) to forward any notification received from the data importer or any subprocessor pursuant to
Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter
decides to continue the transfer or to lift the suspension;
(h) to make available to the data subjects upon request a copy of the Clauses, with the
exception of Appendix 2, and a summary description of the security measures, as well as a
copy of any contract for subprocessing services which has to be made in accordance with
the Clauses, unless the Clauses or the contract contain commercial information, in which
case it may remove such commercial information;
(i) that, in the event of subprocessing, the processing activity is carried out in accordance with
Clause 11 by a subprocessor providing at least the same level of protection for the personal
data and the rights of data subject as the data importer under the Clauses; and
(j) that it will ensure compliance with Clause 4(a) to (i).
Clause 5
Obligations of the data importer
The data importer agrees and warrants:
(a) to process the personal data only on behalf of the data exporter and in compliance with its
instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it
agrees to inform promptly the data exporter of its inability to comply, in which case the data
exporter is entitled to suspend the transfer of data and/or terminate the contract;
(b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling
the instructions received from the data exporter and its obligations under the contract and that
in the event of a change in this legislation which is likely to have a substantial adverse effect
on the warranties and obligations provided by the Clauses, it will promptly notify the change
to the data exporter as soon as it is aware, in which case the data exporter is entitled to
suspend the transfer of data and/or terminate the contract;
(c) that it has implemented the technical and organisational security measures specified in
Appendix 2 before processing the personal data transferred;
(d) that it will promptly notify the data exporter about:
(i) any legally binding request for disclosure of the personal data by a law enforcement
authority unless otherwise prohibited, such as a prohibition under criminal law to
preserve the confidentiality of a law enforcement investigation,
(ii) any accidental or unauthorised access, and
(iii) any request received directly from the data subjects without responding to that
request, unless it has been otherwise authorised to do so;
(e) to deal promptly and properly with all inquiries from the data exporter relating to its
processing of the personal data subject to the transfer and to abide by the advice of the
supervisory authority with regard to the processing of the data transferred;
(f) at the request of the data exporter to submit its data processing facilities for audit of the
processing activities covered by the Clauses which shall be carried out by the data exporter
or an inspection body composed of independent members and in possession of the required
professional qualifications bound by a duty of confidentiality, selected by the data exporter,
where applicable, in agreement with the supervisory authority;
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
(g) to make available to the data subject upon request a copy of the Clauses, or any existing
contract for subprocessing, unless the Clauses or contract contain commercial information,
in which case it may remove such commercial information, with the exception of Appendix
2 which shall be replaced by a summary description of the security measures in those cases
where the data subject is unable to obtain a copy from the data exporter;
(h) that, in the event of subprocessing, it has previously informed the data exporter and
obtained its prior written consent;
(i) that the processing services by the subprocessor will be carried out in accordance with
Clause 11;
(j) to send promptly a copy of any subprocessor agreement it concludes under the Clauses to
the data exporter.
Clause 6
Liability
1.The parties agree that any data subject, who has suffered damage as a result of any breach
of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is
entitled to receive compensation from the data exporter for the damage suffered.
2.If a data subject is not able to bring a claim for compensation in accordance with paragraph 1
against the data exporter, arising out of a breach by the data importer or his subprocessor of
any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has
factually disappeared or ceased to exist in law or has become insolvent, the data importer
agrees that the data subject may issue a claim against the data importer as if it were the data
exporter, unless any successor entity has assumed the entire legal obligations of the data
exporter by contract of by operation of law, in which case the data subject can enforce its rights
against such entity.
The data importer may not rely on a breach by a subprocessor of its obligations in order to
avoid its own liabilities.
3.If a data subject is not able to bring a claim against the data exporter or the data importer
referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of their
obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the
data importer have factually disappeared or ceased to exist in law or have become insolvent,
the subprocessor agrees that the data subject may issue a claim against the data subprocessor
with regard to its own processing operations under the Clauses as if it were the data exporter
or the data importer, unless any successor entity has assumed the entire legal obligations of
the data exporter or data importer by contract or by operation of law, in which case the data
subject can enforce its rights against such entity. The liability of the subprocessor shall be
limited to its own processing operations under the Clauses.
Clause 7
Mediation and jurisdiction
1.The data importer agrees that if the data subject invokes against it third-party beneficiary
rights and/or claims compensation for damages under the Clauses, the data importer will
accept the decision of the data subject:
(a) to refer the dispute to mediation, by an independent person or, where applicable, by
the supervisory authority;
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
(b) to refer the dispute to the courts in the Member State in which the data exporter is
established.
2.The parties agree that the choice made by the data subject will not prejudice its substantive or
procedural rights to seek remedies in accordance with other provisions of national or
international law.
Clause 8
Cooperation with supervisory authorities
1.The data exporter agrees to deposit a copy of this contract with the supervisory authority if
it so requests or if such deposit is required under the applicable data protection law.
2.The parties agree that the supervisory authority has the right to conduct an audit of the data
importer, and of any subprocessor, which has the same scope and is subject to the same
conditions as would apply to an audit of the data exporter under the applicable data
protection law.
3.The data importer shall promptly inform the data exporter about the existence of legislation
applicable to it or any subprocessor preventing the conduct of an audit of the data importer,
or any subprocessor, pursuant to paragraph 2. In such a case the data exporter shall be
entitled to take the measures foreseen in Clause 5 (b).
Clause 9
Governing Law
The Clauses shall be governed by the law of the Member State in which the data exporter is
established.
Clause 10
Variation of the contract
The parties undertake not to vary or modify the Clauses. This does not preclude the parties from
adding clauses on business related issues where required as long as they do not contradict the
Clause.
Clause 11
Subprocessing
1.The data importer shall not subcontract any of its processing operations performed on behalf
of the data exporter under the Clauses without the prior written consent of the data exporter.
Where the data importer subcontracts its obligations under the Clauses, with the consent of
the data exporter, it shall do so only by way of a written agreement with the subprocessor
which imposes the same obligations on the subprocessor as are imposed on the data
importer under the Clauses. Where the subprocessor fails to fulfil its data protection
obligations under such written agreement the data importer shall remain fully liable to the
data exporter for the performance of the subprocessor's obligations under such agreement.
2.The prior written contract between the data importer and the subprocessor shall also provide
for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject
is not able to bring the claim for compensation referred to in paragraph 1 of
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
Clause 6 against the data exporter or the data importer because they have factually
disappeared or have ceased to exist in law or have become insolvent and no successor
entity has assumed the entire legal obligations of the data exporter or data importer by contract
or by operation of law. Such third-party liability of the subprocessor shall be limited to its own
processing operations under the Clauses.
3.The provisions relating to data protection aspects for subprocessing of the contract referred to
in paragraph 1 shall be governed by the law of the Member State in which the data exporter is
established.
4.The data exporter shall keep a list of subprocessing agreements concluded under the Clauses
and notified by the data importer pursuant to Clause 5 (j), which shall be updated at least once
a year. The list shall be available to the data exporter's data protection supervisory authority.
Clause 12
Obligation after the termination of personal data processing services
1.The parties agree that on the termination of the provision of data processing services, the
data importer and the subprocessor shall, at the choice of the data exporter, return all the
personal data transferred and the copies thereof to the data exporter or shall destroy all the
personal data and certify to the data exporter that it has done so, unless legislation imposed
upon the data importer prevents it from returning or destroying all or part of the personal
data transferred. In that case, the data importer warrants that it will guarantee the
confidentiality of the personal data transferred and will not actively process the personal
data transferred anymore.
2.The data importer and the subprocessor warrant that upon request of the data exporter
and/or of the supervisory authority, it will submit its data processing facilities for an audit of
the measures referred to in paragraph 1.
On behalf of the data exporter:
Name (written out in full):
Position:
Address:
Other information necessary in order for the contract to be binding (if any):
Signature……………………………………….
On behalf of the data importer:
Name (written out in full): Aaron Rankin
Position: Chief Technology Officer
Address: 131 S. Dearborn St., Suite 700, Chicago, IL 60603
Other information necessary in order for the contract to be binding (if any):
Signature……………………………………….
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
APPENDIX 1 TO THE STANDARD CONTRACTUAL CLAUSES
This Appendix forms part of the Clauses and must be completed and signed by the parties
The Member States may complete or specify, according to their national procedures, any additional
necessary information to be contained in this Appendix.
Data exporter
The data exporter is:
Data importer
The data importer is: Sprout Social
Data subjects
The personal data transferred concern the following categories of data subjects:
Other data subjects:
Sprout Social: The personal data and personal information processed concern individuals who
interact with connected social media accounts, which are owned and/or operated by Customer
Bambu: The personal data and personal information processed concern Bambu users (typically
employees of Customer) who interact with the Bambu platform and share content that is uploaded
and posted by Customer
Simply Measured: The personal data and personal information processed concern individuals who
interact with connected social media accounts, which are owned and/or operated by the Customer.
Other data subjects:
Categories of data
The personal data transferred concern the following categories of data:
Sprout Social: customer & third-party social media profile information including temporary
authorization tokens for any linked accounts on social media networks; geographic location; usage;
social media content; social media performance
Bambu: social media profile information including temporary authorization tokens for any linked
accounts on social media networks; social media content; social media performance
Simply Measured: geographic location; type of device used; social media profile information
including temporary authorization tokens for any linked accounts on social media networks; usage
Other categories of data:
Special categories of data (if appropriate)
The personal data transferred concern the following special categories of data:
Customer does not intentionally collect or transfer any sensitive personal data in relation to these
data subjects
Other categories of special data:
Processing operations
The personal data transferred will be subject to the following basic processing activities:
Sprout Social:
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
•Personal data and personal information will be transferred from the Customer to Sprout
Social to provide social media-related engagement, publishing, analytics, listening, and
monitoring software services to the Customer
•These services will consist of providing a platform and performance analytics to the
Customer in relation to connected social media profiles
•Full details about Sprout Social's social media management tool can be found at
https://sproutsocial. com/
Bambu:
•Personal data and personal information will be transferred from the Customer to Sprout
Social for Sprout Social to provide its Bambu platform to Customer.
•These services will consist of providing a sharing platform to the Customer for its
employees to share curated content on their connected social media profiles.
Simply Measured:
•Personal data and personal information will be transferred from the Customer to Simply
Measured for Simply Measured to provide social media-related engagement, publishing
and analytics services on behalf of the Customer.
•These services will consist of providing a platform and performance analytics to the
Customer in relation to connected social media profiles.
•Full details about Simply Measured's products and services can be found at
https://simplymeasured. com.
Other processing activities:
DATA EXPORTER
Name:
Authorised Signature ……………………
DATA IMPORTER
Name: Aaron Rankin
Authorised Signature
……………………
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES
This Appendix forms part of the Clauses and must be completed and signed by the parties.
Description of the technical and organisational security measures implemented by the data
importer in accordance with Clauses 4(d) and 5(c):
The Security Standards described in Annex B to this GDPR Addendum for Processors
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
ANNEX B
Security Standards
These terms form part of the Data Processing Addendum for Vendors and, if applicable, the
Standard Contractual Clauses between Company and Vendor.
1.Personnel Security
Sprout Social employs appropriate technical and organizational measures to ensure personnel,
subcontractors, vendors, and agents who have access to Personal Data and/or Personal
Information (“Personnel”) conduct themselves in accordance with established company guidelines
and policies. Sprout Social maintains an Employee Handbook, which includes a Code of Conduct
and Acceptable Use Policy, to convey these controls and values to employees, including sanctions
for non-compliance, and employees receive semi-annual security and privacy training. Prospective
employees are screened, including, where permitted by law, background checks, before
employment and the conditions of employment are applied. Sprout Social has put in place
protocols designed to ensure that Personnel strictly follow established security policies and
procedures. Disciplinary process is applied if Personnel fail to adhere to relevant policies and
procedures.
2.Information Security Program
Sprout Social’s Information Security Program shall include specific security requirements aligned to
industry-recognized best practices, measured by a commitment to SOC 2 Type 2 controls,
ensuring the highest quality processes are in place. The Information Security Program includes,
but is not limited to, the following areas:
a.Information Security Policies and Standards: Sprout Social maintains information
security policies, standards, and procedures which are reviewed at least annually and
revised whenever material changes are made to the systems or procedures that access or
utilize Personal Data.
b.Identity and Access Management: Access to data is granted under the principle of
least privilege. Only authorized Sprout Social personnel, in service of the given customer,
have access to customer data. Sprout Social restricts access to the production
environments to designated personnel based on documented permissions as defined in a
user access matrix.
c.Authentication: User access to Sprout Social systems, tools, services, and
endpoints are subject to strict password standards in conjunction with multi-factor
authentication or integration into our central identity provider, which also enforces multi-
factor authentication.
d.Security Incident Response: Sprout Social maintains an Incident Response Plan, an
Incident Handling and Notification Policy, and other supporting procedures to ensure
consistent classification, documentation, response, and notification for security incidents.
These step-by-step procedures help ensure the Security and Legal teams, in conjunction
with Sprout Social management or other stakeholders, handle such incidents with
consistency and in accordance with our commitment to data privacy and data protection.
3.Application Security & Accessibility
Sprout Social uses industry-recognized best practices to maintain secure and accessible services.
a.Data Storage: Sprout Social leverages a third-party cloud hosted Infrastructure-as-
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37
a-Service (“IaaS”). Data stores containing customer information are co-mingled but logically
separated and encrypted-at-rest.
b.Transmission: Data is encrypted when transmitted over public networks. User
authentication information and the transmission of private or confidential information to the
Sprout Social application is encrypted-in-transit using TLS.
c.Data Backup/Restoration: Systems are designed for resiliency, durability, and
availability within the IaaS. Backups of data stores occur daily across multiple locations.
Server and infrastructure configuration is stored in version control, as is our software code.
In the event of a disaster, systems will be restored from these sources.
d.Penetration Testing: Sprout Social contracts with penetration testing vendors to
perform external penetration testing of the Sprout Social application.
e.Bug Bounty Program: A public bug bounty program is maintained and submissions
are reviewed by the Sprout Social Security team, escalated to the appropriate engineering
team, and tracked to resolution
f.Intrusion Detection System (IDS): Sprout Social utilizes IDS to detect, evaluate, and
respond to security threats and unusual system activity. Alerts sent to Infrastructure and
Security personnel are monitored 24/7.
4.Sub-Processor Security
Before engagement, new sub-processors go through an internal vendor review and approval
process which includes the Security, Legal, and Finance teams. Once assessed, the sub-
processors are required to enter into appropriate contractual agreements outlining security,
confidentiality, and availability. The Security team performs due diligence of our sub-processors
and critical third-party vendors on an annual basis to ensure compliance with service-level
agreements, contractual obligations, and information security controls.
DocuSign Envelope ID: 49EB3EF4-F732-494F-888A-4975C6CAFE37