Joint Controller Addendum

Definitions and interpretation

In this Joint Controller Addendum, the following capitalised terms shall have the following meanings:

“GDPR” means: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (the "EU GDPR"); and (ii) the EU GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 (the "UK GDPR").

“Visitor” means an individual user who accesses, interacts with and/or views your Canvasite.

The terms "personal data", "processing", "controller", "processor", "supervisory authority" and "data subject" in these Canva Business JC Terms have the meanings given to them in the GDPR.

Application of this Joint Controller Addendum

This Joint Controller Addendum applies only where and to the extent that the GDPR applies to processing of personal data undertaken in connection with your Canvasite.

Joint controllership responsibilities

You acknowledge and agree that you and Canva are joint controllers in accordance with Article 26 GDPR for the processing of personal data in connection with your Canvasite. The scope of processing for which you and Canva are joint controllers, and the responsibilities that you and Canva each have for compliance with the GDPR in respect of such joint processing, in particular as regards the exercising of the rights of the data subject and to provide transparency information, are set out below.

The joint controllership described in Clause 3.1 applies only to: (i) the initial collection and transmission of personal data through a Canvasite to Canva's systems for processing; (ii) the subsequent processing of such personal data on Canva's (or its data processors') systems as necessary in order to provide Canvasite functionality to you and to your Visitors; and (iii) the processing of personal data as necessary for the purpose of fulfilling the rights of data subjects in accordance with the GDPR (the "Joint Processing").

Where Canva or you engage in any other processing of personal data that is not Joint Processing (for example, processing of personal data that is unrelated to your Canvasite, or personal data processing you undertake on systems that are not operated by Canva or its data processors), then Canva and you shall remain separate and independent controllers provided that there is no joint determination of the purposes and means of such processing.

Canva and your responsibilities for compliance with the obligations under the GDPR with regard to Joint Processing shall be as follows:

Art 6 (Legal basis):

Canva’s responsibility: Canva will have a legal basis for the processing of personal data it processes in connection with your Canvasite as set out in Canva's Privacy Policy (under the heading "Legal bases for processing information (for users in Europe)".

Your responsibility: You must ensure that you also have a legal basis for the processing of personal data you process in connection with the Canvasite.

Arts 12, 13 and 14 (Transparency):

Canva’s responsibility: Canva will include a link to its Privacy Policy, which describes its processing of personal data, in the footer of each page of your Canvasite.

Your responsibility: You must post a publicly-available privacy notice to your Canvasite that complies with the transparency requirements of the GDPR, using the privacy policy posting functionality offered by the Canvasites platform.

Arts 15 – 21 (Data subject rights):

Canva’s responsibility: If Canva is contacted by data subjects wishing to exercise their rights in respect of their personal data collected through the Canvasite, Canva will either fulfil those rights directly (where it is able to do so) or, where this is not possible, promptly notify you and coordinate with you as necessary to ensure fulfilment of their rights in accordance with the GDPR.

Your responsibility: If you are contacted by data subjects wishing to exercise their rights in respect of their personal data collected through the Canvasite, you will either fulfil those rights directly (where you are able to do so using functionality offered by the Canvasites platform) or, where this is not possible, promptly notify Canva and coordinate with Canva as necessary to ensure fulfilment of their rights in accordance with the GDPR.

In particular, if you process data subjects' personal data collected through your Canvasite for the purpose of sending any direct marketing communications to them (e.g. promotional emails, newsletter or similar) and any data subject objects, you must no longer process their personal data for this purpose. You acknowledge and agree that this is your sole responsibility and that Canva cannot determine or control your processing of data subjects' personal data for your direct marketing purposes.

Art 26 (Making available Joint Controller Addendum):

Canva’s responsibility: Canva will make the essence of this Joint Controller Addendum available to data subjects. This will be done through appropriate disclosures within Canva's Privacy Policy.

Your responsibility: Not applicable

Art 32 (Security):

Canva's responsibility: Canva will implement appropriate technical and organisational security measures to protect personal data collected through your Canvasite where this data is processed on Canva's (or its data processors') systems.

All employees of Canva involved in the processing of personal data are bound by appropriate obligations to maintain the confidentiality of such personal data.

Your responsibility: Not applicable

Arts 33, 34 (Personal Data Breaches):

Canva’s responsibility: Canva will comply with reporting obligations arising under the GDPR in respect of any personal data breach affecting personal data it processes in connection with Canvasites.

Your responsibility: Not applicable

You will publish a contact point on your Canvasite through which data subjects may contact you to exercise their data protection rights under the GDPR. You further acknowledge and agree that Canva makes available the following contact points for data subjects who wish to exercise their data protection rights under the GDPR:

Data subjects can email Canva at privacy@canva.com or otherwise contact Canva as set out under the heading "How to contact us" in Canva's Privacy Policy;

• where the EU GDPR applies, data subjects may contact Canva's EEA representative under Article 27 of the EU GDPR at the following address: European Data Protection Office (EDPO), Regus Block 1, Blanchardstown Corporate Park, Ballycoolen Road, Blanchardstown, Dublin, D15 AKK1, Ireland; and
• where the UK GDPR applies, data subjects may contact Canva's UK representative under Article 27 of the UK GDPR at the following address: European Data Protection Office UK (EDPO UK), 8 Northumberland Avenue, London WC2N 5BY, United Kingdom.

If you are contacted by a supervisory authority with regard to the processing of personal data in connection with your Canvasite (a "Request"), you will forward all relevant information regarding the Request to us promptly (and within a maximum of seven (7) calendar days) to privacy@canva.com. You agree to take all reasonable endeavours in a timely manner to cooperate with us in answering any such Request. You are not authorised to act or answer on Canva's behalf.

Updates to this Joint Controller Addendum

We may need to update this Joint Controller Addendum from time to time. By continuing to use Canvasites after any update to this Joint Controller Addendum, you agree to be bound by it. If you do not agree to the updated Joint Controller Addendum, please stop all use of your Canvasite.

Miscellaneous

If any portion of this Joint Controller Addendum is found to be unenforceable, the remaining portion will remain in full force and effect. If we fail to enforce any portion of this Joint Controller Addendum, it will not be considered a waiver. Any amendment to or waiver of these terms requested by you must be made in writing and signed by us.

This Joint Controller Addendum supplements and applies in addition to the Canva Terms. Any dispute or liability arising out of, or in connection with, this Joint Controller Addendum shall be subject to the Canva Terms (including, with limitation, any provisions in the Canva Terms concerning limitations of liability and governing law and jurisdiction).

Updated 12 November 2021