Ivy Terms of Use

Effective on August 30, 2021

Through www.ivy.co and related services, sites, and apps that are offered under these Terms of Use (collectively, the “Ivy Platform”), we provide interior designers, architects, builders and other professionals (“Pros”) with tools to better manage their day-to-day business and workflow with their clients (“Clients”) and third-party vendors (“Vendors”). The Ivy Platform is also designed to improve the design experience for Clients, by allowing them to review project-related documents from Pros and to pay Pros. The Ivy Platform includes our plug-ins, for example, the Product Clipper browser extension. We announced that the Ivy Platform joined the Houzz family in February 2018. Houzz Inc. is referred to in these Terms of Use as “Houzz,” “we,” “us,” and “our.”

Please review these Terms of Use carefully. If you agree to pay for or use the Ivy Platform products or services as a Pro, a Client or a Vendor, these Terms of Use will apply to you and set forth the legal agreement between you and us, including your agreement to receive promotional text messages and calls through automatic telephone dialing systems, your grant of rights to your content, our limitation of liability to you and your agreement to resolve any disputes by individual arbitration and to waive the right to participate in a class action.

1. Contract

a. Legal Agreement. These Terms of Use are legally binding terms governing your use of the Ivy Platform. We encourage you to read them carefully and not to use the Ivy Platform if you do not wish to be legally bound by these Terms of Use.

b. Modifications. We reserve the right to modify these Terms of Use at any time. If we make material changes, we will provide you notice through the Ivy Platform, or by other means, to provide you the opportunity to review the changes before they become effective. Your continued use of the Ivy Platform after we publish or send a notice about the changes to these Terms of Use means that you are agreeing to the changes.

c. Additional Terms. In addition, when using certain services on the Ivy Platform, you will be subject to any additional terms applicable to such services that are made available on the Ivy Platform, including our Privacy Policy. All such terms are hereby incorporated by reference into these Terms of Use.

2. Ivy Platform

a. Eligibility. You are allowed to use the Ivy Platform if you are at least 16 years of age or if older, the minimum age lawfully allowed to use the Ivy Platform without parental consent.

b. Accounts. If you create an account on the Ivy Platform, you are responsible for keeping your password confidential and secure, and you agree to provide us with truthful and correct information about you as prompted and to keep this information updated (including contact information). You must notify us immediately of any breach of security or unauthorized use of your account. Accounts are not transferable. We reserve the right to close an account for any reason we deem reasonable. We reserve the right to terminate accounts that are inactive for an extended period of time.

c. Transactions. The Ivy Platform may allow contracts and proposals to be made available for review and signature (including e-signature) and payments to be accepted or made. We are not responsible for any contracts or proposals made available through the Ivy Platform. We have no control over and do not guarantee the existence, quality, safety or legality of any goods or services advertised by Pros or Vendors; the truth or accuracy of any advertisements; the ability of Pros or Vendors to sell or provide goods or services; the ability of any user to pay for any goods or services; or the completion of any transaction on the Ivy Platform. We do not warrant or guarantee that any goods or services offered through the Ivy Platform will meet your requirements. As a Pro or Vendor, you are responsible for any contracts or proposals made available through the Platform, performing such contracts, delivering to Clients any items or materials purchased on their behalf, and paying for all purchases made on behalf of your clients and customers.

d. Communications. By agreeing to these Terms of Use, you agree to receive certain communications from us and our affiliates, including emails related to transactions. You are not required to agree to receive promotional texts, calls, pre-recorded messages, emails or push notifications as a condition of using the Ivy Platform. If you elect to submit your phone number to us, you agree to receive communications from us and our affiliates, including via text messages, calls, pre-recorded messages, emails and push notifications, any of which may be generated by automatic telephone dialing systems. These communications include, for example, operational communications concerning your account or use of the Ivy Platform, updates concerning new and existing features on the Ivy Platform, communications concerning promotions run by us or third parties, and news relating to the Ivy Platform and industry developments. Standard text messaging charges applied by your cell phone carrier will apply to text messages we send. If you wish to stop receiving promotional text messages, please follow the instructions we provide.

e. Ivy Platform Modifications. We reserve the right to modify or discontinue the Ivy Platform (or any aspect of the Ivy Platform), temporarily or permanently, with or without notice. You agree that we will not be liable to you or to any third party for any modification, suspension or discontinuance of the Ivy Platform. We also may provide you certain features as part of your Ivy Platform for a limited promotional period.

f. Ivy Platform Limitations. You acknowledge that we may establish general practices and limits concerning use of the Ivy Platform, including the maximum period of time that data or other content will be retained by the Ivy Platform and the maximum storage space that will be allotted to you. Each pricing plan is subject to a maximum number of “activated” projects as further described here.

g. User Disputes. We are not a party to any agreement between our users, including Pros, Clients or Vendors. As a Pro, Client or Vendor, you release us from any liability for any agreements or interactions with any other Pros, Clients or Vendors. You agree that you are solely responsible for your interactions with any other user in connection with the Ivy Platform, and we will have no liability or responsibility with respect thereto. We reserve the right, but have no obligation, to become involved in any way with disputes between you and any other user of the Ivy Platform. In entering into this release you expressly waive any protections, statutory or otherwise, that would limit the coverage of this release to include only those claims which you may know or suspect to exist in your favor at the time of agreeing to this release. The release in the preceding sentence includes California Civil Code Section 1542, which provides as follows: “A GENERAL RELEASE DOES NOT EXTEND TO CLAIMS WHICH THE CREDITOR DOES NOT KNOW OR SUSPECT TO EXIST IN HIS OR HER FAVOR AT THE TIME OF EXECUTING THE RELEASE, WHICH IF KNOWN BY HIM OR HER MUST HAVE MATERIALLY AFFECTED HIS OR HER SETTLEMENT WITH THE DEBTOR.”

h. Personal Data.

(i) You have provided appropriate notice and have obtained all consents and rights necessary for us to process any personal data you may provide to the Ivy Platform (“Submitted Personal Data”) in accordance with these Terms of Use and our Privacy Policy (including to transfer the Submitted Personal Data to third parties and third party services that you select), and to transfer the Submitted Personal Data outside of the country of residence of the individual to which the Submitted Personal Data relates, if applicable, pursuant to our Privacy Policy. We may use Submitted Personal Data as provided under our Privacy Policy, including to provide you the Ivy Platform, to improve the Ivy Platform and to provide the Ivy Platform and Submitted Personal Data to the Clients, Pros and Vendors that you select to receive the Submitted Personal Data.

(ii) If and to the extent we and/or our affiliates transfers (directly or via onward transfer) Submitted Personal Data that is protected by EU Data Protection Law and/or that originates from Switzerland and/or the United Kingdom in or to any country or recipient not recognized by the European Commission as providing an adequate level of protection for personal data (as described in EU Data Protection Law), Houzz and/or its affiliates will transfer such data in accordance with the Standard Contractual Clauses available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en (as amended, superseded or updated from time to time). In the event, that you are established in the EEA, you agree (i) the Standard Contractual Clauses set forth in Exhibit A form an integral part of this Agreement (for purposes of Exhibit A, “you” are referred to as “Customer”), and (ii) we and/or our affiliates (as applicable) shall be the “data importer” and you (acting on behalf of your business) shall be the “data exporter” (notwithstanding that you may be located outside the European Economic Area, Switzerland and/or the United Kingdom).

(iii) To the extent that you receive personal data through the Ivy Platform (“Platform Personal Data”), you may process the Platform Personal Data only for the intended purpose for which it was provided or to the extent that you have obtained consent as required under applicable law from the person to which the Platform Personal Data relates. You shall protect the confidentiality of Platform Personal Data and use appropriate security safeguards to protect Platform Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, alteration, disclosure or access. You may share such Platform Personal Data only to the extent authorized by the person to which such Platform Personal Data relates or to your subcontractors, provided that you are responsible for ensuring the subcontractors’ compliance with this provision. Without limiting the foregoing, you shall not sell Platform Personal Data.

(iii) You must ensure that your use of personal data is at all times compliant with all applicable laws (including with respect to the period with which you retain personal data) and that you honor requests by individuals exercising their rights under applicable law (e.g. with respect to data deletion or data access). If you receive any privacy inquiry or complaint from an individual, regulator or other party related to the Ivy Platform, Submitted Personal Data or Platform Personal Data, you will promptly inform us of such complaint and will cooperate reasonably and in good faith to respond to such inquiry or complaint.

3. Payments

a. Pro and Vendor Fees and Costs.

(i) Amount of Fees: As a Pro or Vendor, you will be required to pay for certain aspects of the Ivy Platform. Current fees related to our plans can be found here and fees related to our payment processing can be found here.

Plan pricing may be based on the number of “activated” projects during the term of that plan. A project in your account on the Ivy Platform is considered “activated” upon the first to occur of any of the following events: (A) a new invoice is created, (B) a payment is received on the project (whether or not through the Ivy Platform), (C) a retainer request document is downloaded or emailed to a Client, (D) or a proposal document is downloaded or emailed to a Client or (E) an associated room board is downloaded or emailed. If you exceed the number of activated projects for your pricing tier, your account will be changed to the plan at the next higher pricing tier and, starting with your next billing period, you will be charged the fees for the next higher pricing tier. The agreed upon fees for each pricing tier may be accessed through your account page in the Ivy Platform.

(ii) Payments Generally: You agree to pay us the applicable fees when they are due. You agree to pay the fees associated with the initial plan you select and any subsequent changes (whether manual or automatic), including any automatically recurring fees, usage-based fees, transaction fees deducted automatically from payments made to you through the Ivy Platform, one-time fees that you may incur, and surcharges for using a payment card. Fees or surcharges for using a payment card will be identified in the Agreement. We may set off amounts payable by us to you against amounts payable by you to us.

(iii) Automatic Payments and Renewal: If you subscribe to a plan for the Ivy Platform, you will be charged (using the payment method associated with your account) the applicable fee at the beginning of each term (either 12-months for the annual plan or 1 month for the monthly plan). Plans will automatically renew at the end of each term at the pricing tier in place at the time of renewal. If you do not want your plan to renew, you must contact us at least 30 days before the end of the term if you have an annual plan and before the end of the term if you have a monthly plan. Otherwise, your plan will renew, and you are still responsible for paying for your plan for each renewal term. In all cases, you are responsible for paying for the full current term of your plan. Houzz has the right to store and update your payment method and to automatically charge your payment method for the applicable Ivy Platform plan.

(iv) Payments from Clients: To the extent that you receive payment from Clients through the Ivy Platform, payments will be disbursed to you according to the schedules listed here. Please note that all payments made through the Ivy Platform are facilitated through a third-party payment processor. We do not take custody of your funds, nor can we access such funds.

(v) Price Changes: We reserve the right to change our prices. If we change or update prices, we will provide notice of the change on the Ivy Platform or by email, at Ivy’s option, at least 30 days before the change takes effect. To the extent you continue to use the Ivy Platform after the price change becomes effective, such use constitutes your agreement to pay the prices as amended. We may choose to temporarily change our fees for promotional events or new services; these changes are effective when we announce the promotional event or new service and end the earlier of the date identified or 30 days after the initial announcement.

b. Payments by Clients. As a Client, you may pay Pros or Vendors for goods or services through the Ivy Platform by authorizing us and our third-party payment processor to charge the method of payment associated with your account. You agree to pay the entire amount that you approve, including any taxes or fees. If such amounts are reversed and deducted from our accounts, you agree to remit the amounts to us and, if you fail to do so, you authorize us and our third-party payment processor to collect the amounts from you, using any legal manner without prejudice to any other right or remedy we may be entitled to under these Terms or by law.

c. Payment Method. To the extent the Ivy Platform or any aspect thereof is made available for any fee, or you are paying or receiving payment for goods or services via the Ivy Platform, you will be required to provide us information regarding your credit card or other payment method or bank account. You represent and warrant to us that (i) such information is true; (ii) you are authorized to use the payment method; (iii) you are authorized to provide such payment information to us; (iv) such action does not violate the terms and conditions applicable to your use of such payment method or applicable law; and (v) you authorize us, our affiliates and our third-party payment processor to charge your payment method for the amount displayed through the Ivy Platform. You will promptly update your Account information with any changes (for example, a change in your billing address or credit card expiration date) that may occur. We do not have access to information about your payment method, other than your name and contact information as required for customer service, but our payment processor may store and update your payment method, and we may continue billing your payment method (e.g. credit card) even after it has expired or been updated, to avoid interruptions in your use of the Ivy Platform and for other transactions you authorize through the Ivy Platform.

d. Payment Disputes. If you dispute any charges by us, you must let us know within thirty (30) days after the date that we charge you. If you dispute any charges by another user, you must contact the user directly. If you, as Pro, Client or Vendor, are involved in a credit card dispute involving a payment made through or in connection with the Ivy Platform, such as a chargeback, you agree to provide us and our third-party payment processor with all information relevant to the dispute. If any funds are withdrawn from our accounts as a result of the dispute or chargeback, you agree to reimburse us within 48-hours of the date the dispute was initiated. We may obtain reimbursement of any amounts owed to us by instructing our payment processor to deduct such amounts from your account, deducting from future payments owed to you, reversing any credits to your account balance, charging your credit card, or through any other lawful means, including by using third-party collections services. You authorize us to use any or all of the foregoing methods to seek reimbursement. It is our business practice to identify and investigate disputed transactions and transactions with high levels of repayment risk, and we reserve the right to withhold disbursements until we complete our investigations of disputed or high-risk transactions. As a Pro or Vendor, if you agree to refund any fees to another party, you are responsible and will pay us (and we may retain) any transaction costs associated with such refund. If we are unable to collect any fees from you, we may limit your ability to use the Ivy Platform, and we may collect fees owed using any legal manner without prejudice to any other right or remedy we may be entitled to under these Terms of Use or by law. All amounts paid are not refundable unless otherwise expressly provided by us. In the event that we bring any action or suit to collect any fees owed under these Terms of Use, we will be entitled to recover costs, including reasonable attorneys’ fees, incurred in such collection. Any amounts past due will be subject to a late fee of the lesser of 1.5% per month or the maximum amount permitted by law.

e. Taxes. All consideration to be paid or provided made under or in connection with this Agreement is exclusive of taxes, duties and levies, including state sales taxes, VAT or GST (collectively, “Taxes”). You are responsible for paying all Taxes, excluding only taxes based on Houzz’s net income. If we have the legal obligation to pay or collect Taxes for which you are responsible under these Terms of Use, the appropriate amount shall be invoiced to and paid by you unless you provide us with a valid tax exemption certificate authorized by the appropriate taxing authority.

4. Intellectual Property Rights

a. Content. You may submit or transmit content (including data, text, information, screen names, graphics, photos, profiles, audio and other media, links) through the Ivy Platform (“Your Content”), for example, as part of registration, the listing process (which may include items, item descriptions, messaging text, newsletters, photographs, audio, video and descriptions), the messaging service, any public message area (including forums or feedback) or any email feature. The Ivy Platform allows messaging and sharing of information in many ways. Your Content that you share or post may be seen by other users. You are solely responsible for Your Content.

b. Rights Granted by You. As between you and us, you own Your Content, and you grant to us and our affiliates, without compensation or further consent or notice to you or others, a non-exclusive, perpetual, irrevocable, royalty-free, fully paid-up, worldwide, sublicensable license: (a) to use, reproduce, process, adapt, publicly perform, publicly display, modify, prepare derivative works, publish, transmit and distribute Your Content, or any portion thereof; (b) to use your trademark and logo; and (c) if you identify yourself by name or provide a picture or audio or video recording of yourself, to reproduce, print, publish and disseminate your name, voice and likeness; in each case, in any format, media or distribution method (whether now known or hereafter created), including in promotional campaigns, marketing materials and to identify you as a customer. Further, to the extent permitted under applicable law, you waive and release and covenant not to assert any moral rights that you may have in Your Content. For clarity, we will not make your Proposals, Invoices, To-Do Lists, Schedules, Change Orders, Time and Expense Tracking, Roomboards and Tear Sheets publicly available. By submitting suggestions or other feedback to us, you agree that we and our affiliates can (but are not required to) use and share such feedback for any purpose without compensation to you.

c. Ivy Platform. We reserve all intellectual property rights in the Ivy Platform. Using the Ivy Platform does not give you any ownership in the Ivy Platform or the content or information made available through the Ivy Platform. Trademarks and logos used in connection with the Ivy Platform are the trademarks of their respective owners. The Ivy name and logos and other Ivy trademarks, service marks, graphics and logos used for the Ivy Platform are our trademarks.

5. Conditions of Use

a. Compliance with Laws. You agree to comply with all applicable domestic, local, state and international laws, statutes, ordinances and regulations regarding your use of our Ivy Platform and your listings, purchases, solicitation of offers, sale of items and Your Content, if and to the extent applicable.

b. Prohibited Conduct. Any use of the Ivy Platform or the content other than as specifically authorized on the Ivy Platform (including these Terms of Use) is prohibited. The following are examples of content and use that is prohibited on the Ivy Platform. You agree not to:

upload any content that (i) you do not have a right to upload under any law or under contractual or fiduciary relationships; (ii) poses or creates a privacy or security risk to any person; (iii) constitutes unsolicited or unauthorized advertising, promotional materials, commercial activities or sales, “junk mail,” “spam,” “chain letters,” “pyramid schemes,” “contests,” “sweepstakes,” or any other form of solicitation; or in our sole judgment, is objectionable or which restricts or inhibits any other person from using or enjoying the Ivy Platform, or which may expose us or our users to any harm or liability of any type;
solicit, harass, stalk, impersonate or abuse another user of the Ivy Platform;
be false, misleading, untruthful, inaccurate, defamatory, trade libelous, threatening, harassing, harmful, abusive or vulgar; promote violence, racial hatred terrorism or illegal acts;
be fraudulent or involved in the sale of illegal, counterfeit, stolen items or items which violate these Terms of Use in any way;
infringe any patent, trademark, trade secret, copyright, right of publicity or other right of any other person or entity;
be obscene or transmit pornography;
transmit software viruses, worms, trojan horses, time bombs, trap doors or any other computer code, files or programs or repetitive requests for information designed to interrupt, destroy or limit the functionality of any computer software or hardware or telecommunications equipment or to diminish the quality of, interfere with the performance of, or impair the functionality of the Ivy Platform;
interfere with or disrupt the Ivy Platform or servers or networks connected to the Ivy Platform, or disobey any requirements, procedures, policies or regulations of networks connected to the Ivy Platform; impersonate any person or entity, or falsely state or otherwise misrepresent your credentials or your affiliation with a person or entity;
solicit personal information from anyone under the age of 18;
create liability for us or cause us to lose (in whole or in part) the services of our ISPs or other suppliers;
lead us to violate any applicable law, statute, ordinance or regulation, or these Terms of Use;
modify, adapt or hack the Ivy Platform or modify another website so as to falsely imply that it is associated with the Ivy Platform;
unless otherwise expressly authorized by us or in the Ivy Platform, display, distribute, license, perform, publish, reproduce, duplicate, copy, create derivative works from, modify, sell, resell, exploit, transfer, frame, scrape, rent, lease, loan, reverse engineer or otherwise attempt to discover the source code of any portion of the Ivy Platform, use of the Ivy Platform, or access to the Ivy Platform (including Content in the Ivy Platform);
engage in or use any data mining, robots, scraping or similar data gathering or extraction methods;
implement any measures to circumvent restrictions to or within the Ivy Platform (e.g., by masking or blocking your IP address or using a proxy IP address).

c. Violations. We reserve the right to investigate and take appropriate legal action against anyone who, in our sole discretion, violates this provision, including removing the offending content from the Ivy Platform, suspending or terminating the account of such violators and reporting you to law enforcement authorities. We have the right (but not the obligation) in our sole discretion to refuse or remove any content that is available via the Ivy Platform.

6. Other Content, Sites and Apps.

By using the Ivy Platform, you may encounter content or information that might be inaccurate, incomplete, delayed, misleading, illegal, offensive or otherwise harmful. We generally do not review content provided by our users or others. You agree that we are not responsible for others’ (including users’) content or information. We cannot always prevent misuse of the Ivy Platform, and you agree that we are not responsible for any such misuse.

You are responsible for deciding if you want to access or use third party apps or sites that link from the Ivy Platform. Third party apps and sites have their own legal terms and privacy policies, and you may be giving others permission to use your information in ways we would not. Except as may be required by applicable law, we are not responsible for these other sites and apps – use these at your own risk.

Payment processing services on the Ivy Platform are provided by Stripe and are subject to the Stripe Connected Account Agreement (available at: https://stripe.com/us/connect-account/legal), which includes the Stripe Terms of Service (collectively, the “Stripe Services Agreement”). By agreeing to these Terms of Use or continuing to use an account, you agree to be bound by the Stripe Services Agreement, as the same may be modified by Stripe from time to time. As a condition of our enabling payment processing services through Stripe, you agree to provide us with accurate and complete information about you and your business, and you authorize us to share it and transaction information related to your use of the payment processing services provided by Stripe.

7. Copyright Infringement Policy.

We are committed to protecting the rights of copyright rights holders and seek to comply with all applicable laws and regulations regarding the protection of intellectual property.

If you are a copyright owner or an agent thereof and believe that any user submission or other content infringes upon your copyrights, you may submit a notification pursuant to the Digital Millennium Copyright Act (“DMCA”) by providing our agent identified below with the following information in writing (see 17 U.S.C. § 512(c)(3) for further detail):

A physical or electronic signature of a person authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.
Identification of the copyrighted work claimed to have been infringed, or if multiple copyrighted works within the Ivy Platform are covered by a single notification, a representative list of such works that appear within the Ivy Platform;
Identification of the material that is claimed to be infringing or to be the subject of infringing activity and that is to be removed or access to which is to be disabled and information reasonably sufficient to permit us to locate the material;
Information reasonably sufficient to permit us to contact you, such as an address, telephone number, and, if available, an email;
A statement that you have a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law; and
A statement that the information in the notification is accurate, and under penalty of perjury, that you are authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.

We will process any notices of alleged copyright infringement and will take appropriate actions under the DMCA. Upon receipt of notices complying with the DMCA, we will act expeditiously to remove or disable access to any material claimed to be infringing or claimed to be the subject of infringing activity and will act expeditiously to remove or disable access to any reference or link to material or activity that is claimed to be infringing.

We may notify the owner or administrator of the affected content so that he or she can make a counter-notification pursuant to his or her rights under the DMCA. If you receive such a notice, you may provide counter-notification in writing to our agent identified below that includes the information below. To be effective, the counter-notification must be a written communication that includes the following:

Your physical or electronic signature;
Identification of the material that has been removed or to which access has been disabled, and the location at which the material appeared before it was removed or access to it was disabled;
A statement from you under the penalty of perjury, that you have a good faith belief that the material was removed or disabled as a result of a mistake or misidentification of the material to be removed or disabled; and
Your name, physical address and telephone number, and a statement that you consent to the jurisdiction of a Federal District Court for the judicial district in which your physical address is located, or if your physical address is outside of the United States, for any judicial district in which we may be found, and that you will accept service of process from the person who provided notification of allegedly infringing material or an agent of such person.

Notices of claimed infringement and counter-notifications should be directed to our agent by mailing all required documentation to:

DMCA Complaints

Houzz Inc.

285 Hamilton Avenue

4th Floor

Palo Alto, CA 94301

Fax: (650) 433-4249

8. Indemnification

You agree to indemnify, defend and hold us, our affiliates, shareholders, officers, directors, employees, agents, representatives and those that we work with to provide the Ivy Platform (collectively, the “Ivy Entities”) harmless from and against any and all claims, loss, damage, tax, liability and expense, including but not limited to legal costs made by any third party due to or arising out of your breach of these Terms of Use, the Privacy Policy or any other policy documents and community guidelines as may be posted on the Ivy Platform from time to time, or your violation of any law or the right of a third party.

9. Disclaimer of Warranties

THE IVY ENTITIES PROVIDE THE IVY PLATFORM “AS IS” AND WITHOUT ANY WARRANTY OR CONDITION, EXPRESS, IMPLIED OR STATUTORY. THE IVY ENTITIES DISCLAIM ANY IMPLIED WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.

THE IVY ENTITIES DO NOT BUY OR SELL OR REPRESENT ANY PRO OR ITEMS ON THE IVY PLATFORM AND DISCLAIMS ANY LIABILITY FOR THE SALE OR ATTEMPTED SALE OF ITEMS ON AND VIA THE IVY PLATFORM. THE IVY ENTITIES DO NOT WARRANT THAT THE IVY PLATFORM WILL BE UNINTERRUPTED OR ERROR-FREE, THAT THE IVY PLATFORM WILL MEET YOUR REQUIREMENTS OR THAT ANY DEFECTS IN THE IVY PLATFORM WILL BE CORRECTED. THERE MAY BE DELAYS, OMISSIONS AND INTERRUPTIONS IN THE AVAILABILITY OF THE IVY PLATFORM.

10. Limitation of Liability

YOU EXPRESSLY UNDERSTAND AND AGREE THAT THE IVY ENTITIES WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY DAMAGES, PUNITIVE DAMAGES, OR DAMAGES FOR LOSS OF PROFIT INCLUDING BUT NOT LIMITED TO, DAMAGES FOR LOSS OF GOODWILL, USE, DATA OR OTHER INTANGIBLE LOSSES (EVEN IF AN IVY ENTITY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES), WHETHER BASED ON CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY OR OTHERWISE, RESULTING FROM: (I) THE USE OR THE INABILITY TO USE THE IVY PLATFORM; (II) THE COST OF PROCUREMENT OF SUBSTITUTE GOODS AND SERVICES RESULTING FROM ANY GOODS, DATA, INFORMATION OR SERVICES PURCHASED OR OBTAINED OR MESSAGES RECEIVED OR TRANSACTIONS ENTERED INTO THROUGH OR FROM THE IVY PLATFORM; (III) UNAUTHORIZED ACCESS TO, ALTERATION OF, OR LOSS OF YOUR CONTENT OR DATA; (IV) STATEMENTS OR CONDUCT OF ANY THIRD PARTY ON THE IVY PLATFORM; OR (V) ANY OTHER MATTER RELATING TO THE IVY PLATFORM. IN NO EVENT WILL THE IVY ENTITIES’ TOTAL LIABILITY TO YOU FOR ALL DAMAGES, LOSSES OR CAUSES OF ACTION EXCEED THE AMOUNT YOU HAVE PAID US IN THE LAST SIX (6) MONTHS, OR, IF GREATER, ONE HUNDRED DOLLARS ($100).

SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF CERTAIN WARRANTIES OR THE LIMITATION OR EXCLUSION OF LIABILITY FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES. ACCORDINGLY, SOME OF THE ABOVE LIMITATIONS SET FORTH ABOVE MAY NOT APPLY TO YOU. IF YOU ARE DISSATISFIED WITH ANY PORTION OF THE IVY PLATFORM OR WITH THESE TERMS OF USE, YOUR SOLE AND EXCLUSIVE REMEDY IS TO DISCONTINUE USE OF THE IVY PLATFORM.

11. Disputes and Governing Law

a. Controlling Law and Jurisdiction. This Agreement will be interpreted in accordance with the laws of the State of California and the United States of America, without regard to their conflict-of-law provisions. You and we agree to submit to the personal jurisdiction of a federal or state court located in San Francisco, California for any actions for which the arbitration provision, as set forth in Section 11, does not apply.

b. Dispute Resolution. If you have a dispute with Houzz, you agree to contact us regarding your dispute to attempt to resolve the issue informally first by your Houzz representative or as may be escalated to Houzz legal and/or the Houzz leadership team. If we are not able to resolve the dispute informally, then this section will govern any legal dispute that arises out of or relates to the Ivy Platform or involves our Services.

c. Binding Arbitration. You and Houzz agree that any dispute, claim or controversy arising out of or relating to this Agreement or to your use of the Ivy Platform (collectively “Disputes”) will be settled by binding arbitration, except that each party retains the right to seek injunctive or other equitable relief in a court of competent jurisdiction to prevent the actual or threatened infringement, misappropriation, or violation of a party’s copyrights, trademarks, trade secrets, patents, or other intellectual property rights. This means that you and Houzz both agree to waive the right to a trial by jury.

d. Class Action Waiver. You and Houzz agree that any proceedings to resolve Disputes will be conducted on an individual basis and not in a class, consolidated, or representative action. This means that, in connection with any Dispute, you and Houzz both agree to waive the right to participate as a plaintiff as a class member in any class action proceeding. Further, unless you and Houzz agree otherwise in writing, the arbitrator in any Dispute may not consolidate more than one person’s claims and may not preside over any form of class action proceeding.

e. Arbitration Administration and Rules. The arbitration will be administered by the American Arbitration Association (“AAA”) in accordance with the Commercial Arbitration Rules then in effect (the “AAA Rules”), except as modified by this “Dispute Resolution” section. (The AAA Rules are available at http://www.adr.org.)

f. Arbitration Process. A party who desires to initiate the arbitration must provide the other party with a written Demand for Arbitration as specified in the AAA Rules. The arbitrator will be either a retired judge or an attorney licensed to practice law and will be selected by the parties from the AAA’s roster of arbitrators with relevant experience. If the parties are unable to agree upon an arbitrator within 7 days of delivery of the Demand for Arbitration, then the AAA will appoint the arbitrator in accordance with AAA Rules.

g. Arbitration Location and Procedure. The seat of the arbitration shall be in San Francisco, California unless you and Houzz agree otherwise or the AAA Rules provide otherwise. If your claim does not exceed USD$10,000, then the arbitration will be conducted solely on the basis of documents you and Houzz submit to the arbitrator, unless you request a hearing and the arbitrator then determines that a hearing is necessary. If your claim exceeds USD$10,000, your right to a hearing will be determined by AAA Rules. Subject to AAA Rules, the arbitrator will have the discretion to direct a reasonable exchange of information by the parties, consistent with the expedited nature of the arbitration. Hearings may be conducted by telephone or video conference, if requested and agreed to by the parties.

h. Arbitrator’s Decision and Governing Law. The arbitrator shall apply California law consistent with the Federal Arbitration Act and applicable statutes of limitations, and shall honor claims of privilege recognized by law. The arbitrator will render an award within the timeframe specified in the AAA Rules. Judgment on the arbitration may be entered in any court having jurisdiction thereof. Any award of damages by an arbitrator must be consistent with the “Limitation of Liability; Disclaimer” section above. The arbitrator may award declaratory or injunctive relief in favor of the claimant only to the extent necessary to provide relief warranted by the claimant’s individual claim.

i. Fees. Each party’s responsibility to pay the arbitration filing, administrative and arbitrator fees will depend on the circumstances of the arbitration and are set forth in the AAA Rules.

12. Termination

a. Termination by Houzz. If you materially breach these Terms of Use, we may terminate these Terms of Use by providing written notice to you. In such case, we have no obligation to refund any amounts to you, and you immediately shall pay any additional amounts due to us as of the effective date of termination. These Terms of Use also may be terminated by us for any other reason by providing you 30 days prior written notice, and if you have an Ivy subscription in such case, we will promptly refund you any prepaid amounts, on a pro rata basis, for any Ivy Platform services not delivered.

b. Termination by Customer. You may terminate these Terms of Use (a) by electing not to renew your Ivy subscription in accordance with Section 3(a)(iii), or (b) upon 60 days notice to Houzz in the event of our material breach of these Terms of Use, provided that we have not cured such material breach within such 60 day period.

c. Termination Generally. In addition, unless you have an Ivy subscription, either you or we may terminate these Terms of Use at any time with notice to the other. On the effective date of termination, you lose all right to access or use the Ivy Platform. You are responsible for making a copy of or otherwise retaining any of your data that you stored or created on the Ivy Platform prior to the effective date of termination. The following shall survive any termination of these Terms of Use:

This Section 12
Sections 3, 4 and 8 through 11 of these Terms of Use regarding payments, intellectual property rights, indemnification, disclaimer of warranties, limitation of liability, disputes and governing law;
Any amounts owed by either party prior to termination remain owed after termination.

You agree that we will not be liable to you or any third party for any termination of your access to the Ivy Platform. Neither your election to terminate your account nor any termination by us for your material breach will entitle you to a refund of any payment or void your responsibility to pay for the full term of any paid plan that you agreed to purchase.

13. General

These Terms of Use constitute the entire agreement between you and us and govern your use of the Ivy Platform, superseding any prior agreements between you and Ivy with respect to the Ivy Platform. You may not assign these Terms of Use without our prior written consent, but we may assign or transfer these Terms of Use or delegate its responsibilities under these Terms of Use, in whole or in part, without restriction. If a court with authority over these Terms of Use finds any part of it not enforceable, you and us agree that the court should modify the terms to make that part enforceable while still achieving its intent. If the court cannot do that, you and us agree to ask the court to remove that unenforceable part and still enforce the rest of these Terms of Use. To the extent allowed by law, the English language version of these Terms of Use is binding and other translations are for convenience only. These Terms of Use (including additional terms that may be provided by us when you engage with the Ivy Platform) is the only agreement between us regarding the Ivy Platform and supersedes all prior agreements for the Ivy Platform. If we don’t act to enforce a breach of these Terms of Use, that does not mean that we have waived our right to enforce these Terms of Use. There are no third party beneficiaries to these Terms of Use.

14. Notice for California Users

Under California Civil Code Section 1789.3, users of the Ivy Platform from California are entitled to the following specific consumer rights notice: The Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs may be contacted in writing at 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (916) 445-1254 or (800) 952-5210. You may contact us at Houzz Inc., 650-326-3000, 285 Hamilton Avenue, Palo Alto, CA 94301.

15.Questions? Concerns? Suggestions?

Please contact us at support@ivy.co to report any violations of these Terms of Use or to pose any questions regarding this Terms of Use or the Ivy Platform.

Exhibit A

STANDARD CONTRACTUAL CLAUSES –

MODULE ONE: Transfer Controller to Controller (C2C)

SECTION I

Clause 1

Purpose and scope

(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)1 for the transfer of personal data to a third country.

(b) The Parties:

(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A. (hereinafter each “data exporter”), and

(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A. (hereinafter each “data importer”)

have agreed to these standard contractual clauses (hereinafter: “Clauses”).

(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.

Clause 2

Effect and invariability of the Clauses

(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46 (2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.

(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.

Clause 3

Third-party beneficiaries

(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:

(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;

(ii) Clause 8 – Clause 8.5 (e) and Clause 8.9(b);

(iii) Clause 9 – [not used in Module One (C2C) Standard Contractual Clauses];

(iv) Clause 12 – Clause 12(a) and (d);

(v) Clause 13;

(vi) Clause 15.1(c), (d) and (e);

(vii) Clause 16(e);

(viii) Clause 18 – Clause 18(a) and (b).

(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.

Clause 4

Interpretation

(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.

Clause 5

Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6

Description of the transfer(s)

The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

Clause 7

Docking clause

(a) An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.

(b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.

(c) The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party.

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 8

Data protection safeguards

The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.

8.1 Purpose limitation

The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B. It may only process the personal data for another purpose:

(i) where it has obtained the data subject’s prior consent;

(ii) where necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or

(iii) where necessary in order to protect the vital interests of the data subject or of another natural person.

8.2 Transparency

(a) In order to enable data subjects to effectively exercise their rights pursuant to Clause 10, the data importer shall inform them, either directly or through the data exporter:

(i) of its identity and contact details;

(ii) of the categories of personal data processed;

(iii) of the right to obtain a copy of these Clauses;

(iv) where it intends to onward transfer the personal data to any third party/ies, of the recipient or categories of recipients (as appropriate with a view to providing meaningful information), the purpose of such onward transfer and the ground therefore pursuant to Clause 8.7.

(b) Paragraph (a) shall not apply where the data subject already has the information, including when such information has already been provided by the data exporter, or providing the information proves impossible or would involve a disproportionate effort for the data importer. In the latter case, the data importer shall, to the extent possible, make the information publicly available.

(c) On request, the Parties shall make a copy of these Clauses, including the Appendix as completed by them, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the Parties may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.

(d) Paragraphs (a) to (c) are without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.

8.3 Accuracy and data minimisation

(a) Each Party shall ensure that the personal data is accurate and, where necessary, kept up to date. The data importer shall take every reasonable step to ensure that personal data that is inaccurate, having regard to the purpose(s) of processing, is erased or rectified without delay.

(b) If one of the Parties becomes aware that the personal data it has transferred or received is inaccurate, or has become outdated, it shall inform the other Party without undue delay.

(c) The data importer shall ensure that the personal data is adequate, relevant and limited to what is necessary in relation to the purpose(s) of processing.

8.4 Storage limitation

The data importer shall retain the personal data for no longer than necessary for the purpose(s) for which it is processed. It shall put in place appropriate technical or organisational measures to ensure compliance with this obligation, including erasure or anonymization2 of the data and all back-ups at the end of the retention period.

8.5 Security of processing

(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the personal data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access (hereinafter “personal data breach”). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subject. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner.

(b) The Parties have agreed on the technical and organisational measures set out in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.

(c) The data importer shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

(d) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the personal data breach, including measures to mitigate its possible adverse effects.

(e) In case of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the data importer shall without undue delay notify both the data exporter and the competent supervisory authority pursuant to Clause 13. Such notification shall contain i) a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), ii) its likely consequences, iii) the measures taken or proposed to address the breach, and iv) the details of a contact point from whom more information can be obtained. To the extent it is not possible for the data importer to provide all the information at the same time, it may do so in phases without undue further delay.

(f) In case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the data importer shall also notify without undue delay the data subjects concerned of the personal data breach and its nature, if necessary in cooperation with the data exporter, together with the information referred to in paragraph (e), points ii) to iv), unless the data importer has implemented measures to significantly reduce the risk to the rights or freedoms of natural persons, or notification would involve disproportionate efforts. In the latter case, the data importer shall instead issue a public communication or take a similar measure to inform the public of the personal data breach.

(g) The data importer shall document all relevant facts relating to the personal data breach, including its effects and any remedial action taken, and keep a record thereof.

8.6 Sensitive data

Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions or offences (hereinafter “sensitive data”), the data importer shall apply specific restrictions and/or additional safeguards adapted to the specific nature of the data and the risks involved. This may include restricting the personnel permitted to access the personal data, additional security measures (such as pseudonymisation) and/or additional restrictions with respect to further disclosure.

8.7 Onward transfers

The data importer shall not disclose the personal data to a third party located outside the European Union3 (in the same country as the data importer or in another third country, hereinafter “onward transfer”) unless the third party is or agrees to be bound by these Clauses, under the appropriate Module. Otherwise, an onward transfer by the data importer may only take place if:

(i) it is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;

(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU) 2016/679 with respect to the processing in question;

(iii) the third party enters into a binding instrument with the data importer ensuring the same level of data protection as under these Clauses, and the data importer provides a copy of these safeguards to the data exporter;

(iv) it is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings;

(v) it is necessary in order to protect the vital interests of the data subject or of another natural person; or

(vi) where none of the other conditions apply, the data importer has obtained the explicit consent of the data subject for an onward transfer in a specific situation, after having informed him/her of its purpose(s), the identity of the recipient and the possible risks of such transfer to him/her due to the lack of appropriate data protection safeguards. In this case, the data importer shall inform the data exporter and, at the request of the latter, shall transmit to it a copy of the information provided to the data subject.

Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.

8.8 Processing under the authority of the data importer

The data importer shall ensure that any person acting under its authority, including a processor, processes the data only on its instructions.

8.9 Documentation and compliance

(a) Each Party shall be able to demonstrate compliance with its obligations under these Clauses. In particular, the data importer shall keep appropriate documentation of the processing activities carried out under its responsibility.

(b) The data importer shall make such documentation available to the competent supervisory authority on request.

Clause 9

Use of sub-processors

[Not used in Module One (C2C) Standard Contractual Clauses]

Clause 10

Data subject rights

(a) The data importer, where relevant with the assistance of the data exporter, shall deal with any enquiries and requests it receives from a data subject relating to the processing of his/her personal data and the exercise of his/her rights under these Clauses without undue delay and at the latest within one month of the receipt of the enquiry or request4. The data importer shall take appropriate measures to facilitate such enquiries, requests and the exercise of data subject rights. Any information provided to the data subject shall be in an intelligible and easily accessible form, using clear and plain language.

(b) In particular, upon request by the data subject the data importer shall, free of charge :

(i) provide confirmation to the data subject as to whether personal data concerning him/her is being processed and, where this is the case, a copy of the data relating to him/her and the information in Annex I; if personal data has been or will be onward transferred, provide information on recipients or categories of recipients (as appropriate with a view to providing meaningful information) to which the personal data has been or will be onward transferred, the purpose of such onward transfers and their ground pursuant to Clause 8.7; and provide information on the right to lodge a complaint with a supervisory authority in accordance with Clause 12(c)(i);

(ii) rectify inaccurate or incomplete data concerning the data subject;

(iii) erase personal data concerning the data subject if such data is being or has been processed in violation of any of these Clauses ensuring third-party beneficiary rights, or if the data subject withdraws the consent on which the processing is based.

(c) Where the data importer processes the personal data for direct marketing purposes, it shall cease processing for such purposes if the data subject objects to it.

(d) The data importer shall not make a decision based solely on the automated processing of the personal data transferred (hereinafter “automated decision”), which would produce legal effects concerning the data subject or similarly significantly affect him / her, unless with the explicit consent of the data subject or if authorised to do so under the laws of the country of destination, provided that such laws lays down suitable measures to safeguard the data subject’s rights and legitimate interests. In this case, the data importer shall, where necessary in cooperation with the data exporter:

(i) inform the data subject about the envisaged automated decision, the envisaged consequences and the logic involved; and

(ii) implement suitable safeguards, at least by enabling the data subject to contest the decision, express his/her point of view and obtain review by a human being.

(e) Where requests from a data subject are excessive, in particular because of their repetitive character, the data importer may either charge a reasonable fee taking into account the administrative costs of granting the request or refuse to act on the request.

(f) The data importer may refuse a data subject’s request if such refusal is allowed under the laws of the country of destination and is necessary and proportionate in a democratic society to protect one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679.

If the data importer intends to refuse a data subject’s request, it shall inform the data subject of the reasons for the refusal and the possibility of lodging a complaint with the competent supervisory authority and/or seeking judicial redress.

Clause 11

Redress

(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.

(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.

(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:

(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;

(ii) refer the dispute to the competent courts within the meaning of Clause 18.

(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.

(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.

(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.

Clause 12

Liability

(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.

(b) Each Party shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages that the Party causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter under Regulation (EU) 2016/679.

(c) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.

(d) The Parties agree that if one Party is held liable under paragraph (c), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its / their responsibility for the damage.

(e) The data importer may not invoke the conduct of a processor or sub-processor to avoid its own liability.

Clause 13

Supervision

(a) The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.

(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.

SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY

PUBLIC AUTHORITIES

Clause 14

Local laws and practices affecting compliance with the Clauses

(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.

(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:

(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;

(ii) the laws and practices of the third country of destination- including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards5;

(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.

(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.

(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.

(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).

(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.

Clause 15

Obligations of the data importer in case of access by public authorities

15.1 Notification

(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:

(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or

(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.

(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.

(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authorities, whether requests have been challenged and the outcome of such challenges, etc.).

(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent suspensory authority on request.

(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.

15.2 Review of legality and data minimisation

(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).

(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.

(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.

SECTION IV – FINAL PROVISIONS

Clause 16

Non-compliance with the Clauses and termination

(a) The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.

(b) In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).

(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:

(i) the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;

(ii) the data importer is in substantial or persistent breach of these Clauses; or

(iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.

In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.

(d) Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.

(e) Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.

Clause 17

Governing law

These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Germany.

Clause 18

Choice of forum and jurisdiction

(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.

(b) The Parties agree that those shall be the courts of Germany.

(c) A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.

(d) The Parties agree to submit themselves to the jurisdiction of such courts.

APPENDIX

ANNEX I

A. LIST OF PARTIES

Data exporter(s):

Name: As detailed in Customer’s Pro Profile.
Address: As detailed in Customer’s Pro Profile.
Contact person’s name, position and contact details: As detailed in Customer’s Pro Profile.
Activities relevant to the data transferred under these Clauses: Providing the personal data necessary to execute the Houzz Pro Services Agreement.
Signature and date: At the same time as the Data Exporter is entering into the Houzz Pro Services Agreement, also the SCCs, which forms an integral part of the Houzz Pro Services Agreement, are concluded.
Role (controller/processor): Controller

Data importer(s):

Name: Houzz Inc.
Address: 285 Hamilton Avenue, Palo Alto, CA, USA 94301
Contact person’s name, position and contact details: EUprivacy@houzz.com
Activities relevant to the data transferred under these Clauses: Processing the personal data necessary to execute the Houzz Pro Services Agreement.
Signature and date: At the same time as the Data Exporter is entering into the Houzz Pro Services Agreement, also the SCCs, which forms an integral part of the Houzz Pro Services Agreement, are concluded.

Role (controller/processor): Controller

В. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred: The employees, representatives, suppliers, service providers, subcontractors, customers and prospective customers of Data Exporter.
Categories of personal data transferred: Identification data including, without limitation, first and last name, email address, telephone number, address (business or personal); online usage data; communications data; electronic identification data including location data; financial data (if provided); affiliations, education and training (if provided); and profession and job data.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: N/A
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): Continuous basis.
Nature of the processing: Collection, recording, organisation, storage, use, disclosure by transmission, dissemination or otherwise making available.
Purpose(s) of the data transfer and further processing: For Data Importer to perform the Services, improve and customize the Services and Houzz Platform, and for any other purposes described in Section 2(b) and Section 10(b) of the Agreement.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: For the duration of the Houzz account.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: N/A

C. COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13: The competent supervisory authority depends on the location of the data exporter as detailed in Customer’s Pro Profile.

ANNEX II – TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services: A periodic business continuity review is conducted between business, product, legal, and engineering stakeholders. Security and data privacy for all third-party data processing is reviewed as part of the vendor risk assessment process. Various technical controls are implemented to ensure the security of processing systems and services, including (but not limited to): endpoint detection and response (EDR) agents on production hosts, anti-virus agents on corporate endpoints, mobile device management (MDM) on corporate endpoints, production access via software-defined-perimeter (SDP), separate development and production environments, and centralized system event logging and aggregation.
Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident: Engineering has implemented regular exports of platform and user data from runtime databases. These exports are securely backed up into archival data storage to allow for access and restoration when needed.
Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing: Systems, applications, and procedures are subject to periodic internal and external audits. Examples include vulnerability scanning of the platform web application.
Measures for user identification and authorisation: Authentication for systems is handled via centralized single-sign-on with defined policies for credential strength and multi-factor-authentication. Authorization to sensitive platform functionality is limited via defined roles to personnel with authority and access under documented procedures.
Measures for the protection of data during transmission: Platform access (e.g. websites and native applications) is only allowed via encrypted client connections (HTTPS protocol). Only secure encryption schemes are supported (for example, TLS v1.1 and below and SSL are not supported due to known vulnerabilities).
Measures for the protection of data during storage: Sensitive data is protected in systems using cryptographically strong encryption. Access to production systems is done via software-defined-perimeter (SDP) and centralized single-sign-on account management. IaaS account access enforces best practices for authentication, including multi-factor-authentication and key rotation.
Measures for ensuring physical security of locations at which personal data are processed: Individual key fob access is required for physical entry.
Measures for ensuring events logging: Continuous monitoring, review, and remediation of event processing and data quality is performed by data analysts and Head of Data Governance.
Measures for internal IT and IT security governance and management: Policies and procedures are implemented and reviewed regularly by engineering leadership, Head of IT, and Head of Security.
Measures for ensuring data minimisation: Regular product reviews and consultation sessions are held between legal, product and engineering teams.
Measures for ensuring limited data retention: The defined data retention policy is reviewed regularly by legal, Head of IT, Head of Security, and engineering leadership.
Measures for allowing data portability and ensuring erasure: Data privacy program policies and procedures are regularly reviewed by Privacy Program Manager and Engineering leadership.

For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter: Not Applicable

Footnotes:

1 Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295 of 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision […].

2 This requires rendering the data anonymous in such a way that the individual is no longer identifiable by anyone, in line with recital 26 of Regulation (EU) 2016/679, and that this process is irreversible

3 The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses.

4 That period may be extended by a maximum of two more months, to the extent necessary taking into account the complexity and number of requests. The data importer shall duly and promptly inform the data subject of any such extension.

5 As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.