Vendia Data Processing Addendum
Last Modified: January 13, 2023
This Data Processing Addendum (“DPA”) is entered into as of the Effective Date of the applicable SaaS Services Agreement (“Agreement”) between Vendia, Inc. (“Vendia”) and the party designated as (“CUSTOMER”) in said Agreement (each, a “Party”, and collectively, the “Parties”), and is made part of, and incorporated into, said Agreement between the Parties.
Recitals
Vendia has entered into one or more purchase orders, contracts and/or agreements with CUSTOMER and/or CUSTOMER Affiliates. In delivering Services under the Agreement, under Instruction by CUSTOMER Vendia will Process Personal Data controlled by CUSTOMER, a CUSTOMER Affiliate and/or their respective customers, contacts or partners. For the avoidance of doubt, “partners” shall mean any third-parties who are invited into the Vendia Offerings by CUSTOMER, to act in a capacity as Controller (as defined below) with respect to their specific Personal Data.
Agreement
1. Custody of Personal Data
For the avoidance of doubt, CUSTOMER acknowledges and agrees that CUSTOMER shall remain the custodian of Controller Data Processed under the Agreement and therefore, CUSTOMER (in their capacity as Controller) will explicitly provide Instruction (as defined below) to Vendia as to the requested location for the Processing and Data Location of Controller Data with respect to the Agreement.
2. Definitions
"Affiliate" means any entity which owns or controls, is owned or controlled by, or is under common ownership or control with respect to either Party.
"Applicable Privacy Law(s)" means all worldwide data protection and privacy laws and regulations applicable to the Personal Data in question, including, where applicable, EU Data Protection Law, European Union General Data Protection Regulation (EU GDPR) and the California Consumer Privacy Act of 2018 (CCPA).
"Authorized Person(s)" means any person who Processes Personal Data on Vendia’s behalf.
"California Personal Information" means Personal Data that is subject to the protection of the CCPA.
"CCPA" means California Civil Code Sec. 1798.100 et seq. (also known as the California Consumer Privacy Act of 2018).
"Consumer", “Business”, “Sell” and “Service Provider” each will have the meanings given to them in the CCPA.
“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. In the event of an Instruction that involves multiple Controllers, an originating Controller (“Sender or Sending Controller”) shall issue the Instruction to Vendia; any such Instruction shall necessitate the Processing of Personal Data on behalf of a single or multiple recipient Controllers (“Receiver or Receiving Controller(s)”). The Sending Controller and Receiving Controller are defined by Instruction and may or may not be CUSTOMER Affiliates.
“Controller Data” means any data owned and under CUSTOMER’s custodianship. CUSTOMER shall own all rights, title, interest and responsibility in and to Controller Data, as well as any and all intellectual property rights. Controller Data may or may not include Personal Data. The Services under Agreement may be used to Process Controller Data. For clarity, Controller Data does not include resource identifiers, attributes, or other data labels.
"Data Location" means the geographical location in which data resides at rest. Controllers Instruct Vendia on the region where the Services will store Controller Data. Unless Instructed, the Services do not limit the location from which Controller may access Controller Data.
“Data Protection Laws” means all applicable worldwide legislation relating to data protection and privacy which applies to the respective party in the role of Processing Personal Data in question under the Agreement and/or DPA, including without limitation European Data Protection Laws, the CCPA, and the data protection and privacy laws of Australia and Singapore; in each case as amended, repealed, consolidated or replaced from time to time.
“Data Subject” means the individual to whom Personal Data relates.
“Europe” means the European Union, the European Economic Area (EEA) and/or their member states, Switzerland, and the United Kingdom.
“European Data” means Personal Data that is subject to the protection of European Data Protection Laws.
"European Data Protection Laws" means data protection laws applicable in Europe, including: (i) Regulation 2016/679 (including all updated revisions of the same) of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) ("GDPR"); (ii) Directive 2002/58/EC concerning the Processing of Personal Data and the protection of privacy in the electronic communications sector; and (iii) applicable national implementations of (i) and (ii); or (iii) GDPR as it forms parts of the United Kingdom domestic law by virtue of Section 3 of the European Union (Withdrawal) Act 2018 ("UK GDPR"); and (iv) Swiss Federal Data Protection Act on 19 June 1992 and its Ordinance ("Swiss DPA"); in each case, as may be amended, superseded or replaced.
“Instruction” means a binding order issued by a Controller to a Processor and directing the same to perform a specific action with respect to the Processing of Personal Data and/or Controller Data. Example Instructions include, but are not limited to: (a) modelling and representation of data; (b) establishing Data Location (c) data anonymization and redaction; (d) data access controls, freezing, blocking or otherwise making data temporarily or permanently unavailable; (e) data modification or deletion; (f) transferring data from a Sending Controller to Receiving Controller(s). Instructions may be issued through Graphical User Interfaces (GUI), Application Programming Interfaces (API), Command Line Interfaces (CLI), Software Development Kits (SDK) and/or other tools provided by Vendia Agreement. The terms “Instruct”, “Instructions” and “Instructed” will be construed accordingly.
"Personal Data" means information relating to an identified or identifiable natural person ("Data Subject") where such information is contained within Controller Data. For the avoidance of doubt, Personal Data includes personally identifiable information under applicable Data Protection Laws.
"Personal Data Breach" means any unauthorized or unlawful breach of security leading to, or reasonably believed to have led to, the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed. Personal Data Breach will not include unsuccessful attempts or activities that do not compromise the security of Personal Data.
“Processing” means any operation or set of operations which is performed on Personal Data, encompassing the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or erasure of Personal Data. Processing an Instruction may result in Personal Data being transferred from a Sending Controller to a Receiving Controller. The terms “Process”, “Processing”, “Processes” and “Processed” will be construed accordingly.
“Processor” means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.
“Standard Contractual Clauses (SCCs)” means European Commission pre-approved contractual clauses ensuring compliance with the General Data Protection Regulation (GDPR).
“Services” means the services made available by Vendia, including those services described in the Service Terms of the Agreement, including associated APIs and Vendia Content (as defined in the Agreement).
"Sub-Processor" means any third party (including any Vendia affiliates) engaged directly or indirectly by Vendia to Process any Personal Data. This definition shall also include any third party appointed by a Sub-Processor to Process any Personal Data.
3. CUSTOMER Obligations
3.1. Compliance with Laws. Within the scope of the Agreement and the DPA and in their use of Services, CUSTOMER will be responsible for complying with all requirements that apply to it under applicable Data Protection Laws with respect to its Processing of Personal Data and the Instructions it issues to Vendia.
CUSTOMER agrees and acknowledges that under Instruction, Vendia will Process (e.g. transfer) data between a Sending Controller and a Receiving Controller(s). Such transferred data is now subject to the Agreement, DPA and other contracted relationship between Vendia and the Receiving Controller(s). Furthermore, the Receiving Controller(s) may be subject to different Data Protection Laws, and may not be in the same geographic region or use the same Sub-Processors as the Sending Controller and that the Agreement and any applicable laws governing Sending Controller may or may not apply to the Receiving Controller. It is the sole responsibility of the Sending Controller to determine whether such sharing is permitted under any applicable laws governing the Sending and Receiving Controller(s).
In particular but without prejudice to the generality of the foregoing, CUSTOMER acknowledges and agrees that it will be solely responsible for: (a) the accuracy, quality, and legality of Controller Data and the means by which it acquired Personal Data; (b) complying with all necessary transparency and lawfulness requirements under applicable Data Protection Laws for the collection and use of the Personal Data, including obtaining any necessary consents and authorizations (particularly for use by CUSTOMER for marketing purposes); (c) ensuring it has the right to transfer, or provide access to, the Personal Data to Vendia for Processing in accordance with the terms of the Agreement (including this DPA); (d) ensuring that its Instructions to Vendia regarding the Processing of Personal Data comply with applicable laws, including Data Protection Laws; and (e) complying with all laws (including Data Protection Laws) applicable to any emails or other content created, sent or managed through Services, including those related to obtaining consent (where required) to send emails or other forms of data transmission, the content of the emails and transmissions, and its email and data transmission deployment practices. CUSTOMER will inform Vendia without undue delay if it is not able to comply with its responsibilities under this Section 3 - CUSTOMER Obligations or applicable Data Protection Laws.
3.2. Instructions. The Parties agree that the Agreement (including this DPA), together with CUSTOMER’s use of Services in accordance with the Agreement, constitute Controller’s complete Instructions to Vendia in relation to the Processing of Personal Data; Controller shall provide additional Instructions that are consistent with the Agreement (including this DPA), the nature and lawful use of services provided by Vendia.
In particular but without prejudice to the generality of the foregoing, CUSTOMER acknowledges and agrees that it will be solely responsible for following the currently documented best practices and procedures provided by Services regarding the controls and Instructions under Agreement, including: (a) agreeing to prerequisites that Personal Data be modelled appropriately; (b) agreeing to specify the Data Location of Controller Data; (c) agreeing that certain Instructions shall result in the Processing (e.g. transfer) of Data from a Sending Controller to a Receiving Controller(s); and (d) agreeing to utilize Instructions to modify or restrict the Processing of Personal Data to comply with the terms of the Agreement and the DPA.
3.3. Security. CUSTOMER is responsible for independently determining whether the data security provided for Services adequately meets CUSTOMER’s and CUSTOMER Affiliate(s) obligations under Data Protection Laws. For more information on how Vendia protects Controller Data, please see Annex III to this DPA (“Security Measures”). CUSTOMER is also responsible for its secure use of Services, including protecting the security of Controller Data and Personal Data in transit to and from Services.
4. Vendia Obligations
4.1. Compliance with Instructions. Vendia will only Process Controller Data and Personal Data subject to the Agreement for the purposes described in this DPA.
CUSTOMER agrees and acknowledges that under Instruction, Vendia will Process Personal Data between a Sending Controller and a Receiving Controller(s). Vendia’s sole responsibility shall be Processing Personal Data as Instructed by the Sending Controller and not to independently confirm whether such sharing is permitted under either the Sending Controller or Receiving Controller(s) applicable Data Protection Laws.
4.2. Conflict of Laws. If Vendia becomes aware that it cannot Process Personal Data in accordance with Controller’s Instructions due to a legal requirement under any applicable law, Vendia will: (a) promptly notify Controller of that legal requirement to the extent permitted by the applicable law; and (b) where necessary, cease all Processing (other than merely storing and maintaining the security of the affected Personal Data) until such time as Controller issues new Instructions with which Vendia is able to comply. In any such event , Vendia will not be liable to Controller under the Agreement for any failure to perform the Services until such time as Controller issues new lawful Instructions to Vendia with respect to the Processing of Personal Data.
4.3. Security. Vendia will implement and maintain appropriate technical and organizational measures to protect Personal Data from Personal Data Breaches, as described under Annex III. Notwithstanding any provision to the contrary, Vendia may modify or update the Security Measures at its discretion provided that such modification or update does not result in a material degradation in the protection offered by the Security Measures.
4.4. Confidentiality. Vendia will ensure that any personnel whom Vendia authorizes to Process Personal Data on its behalf is subject to appropriate confidentiality obligations (whether a contractual or statutory duty) with respect to that Personal Data.
4.5. Personal Data Breaches. Vendia will notify CUSTOMER without undue delay after Vendia becomes aware of any Personal Data Breach and will provide timely information relating to the Personal Data Breach as it becomes known or as reasonably requested by CUSTOMER. At CUSTOMER’s request, Vendia will promptly provide CUSTOMER with such reasonable assistance as necessary to enable CUSTOMER to notify competent authorities and affected Data Subjects of relevant Personal Data Breaches, if CUSTOMER is required to do so under Data Protection Laws.
4.6. Deletion or Return of Personal Data. Upon CUSTOMER's Instruction, or upon termination or expiration of this DPA and/or Agreement, Vendia shall in a timely fashion destroy or return to CUSTOMER all Controller Data (including copies) in its possession or control (including any Personal Data Processed by its Sub-Processors). This requirement shall not apply to the extent that Vendia is required by any applicable law to retain some or all of the Personal Data, in which event Vendia shall isolate and protect the Personal Data from any further Processing except to the extent required by such law. This provision shall not apply to data transferred (copied) to Receiving Controller(s) that are no longer subject to the Sending Controller’s Agreement.
5. Data Subject Requests
5.1. Services provide CUSTOMER with a number of controls that it can use to issue Instructions to Vendia to Process Personal Data (including but not limited to, retrieval, correction, deletion or restriction). CUSTOMER agrees to the use of Services for issuing Instructions to meet their obligations under Data Protection Laws, including CUSTOMER’s obligations relating to responding to requests from Data Subjects to exercise their rights under applicable Data Protection Laws (“Data Subject Requests”).
5.2. To the extent that CUSTOMER is unable to independently address a Data Subject Request through Services, then upon CUSTOMER’s written request Vendia will provide reasonable assistance to CUSTOMER to respond to any Data Subject Requests or requests from data protection authorities relating to the Processing of Personal Data under the Agreement. CUSTOMER agrees to reimburse Vendia for any commercially reasonable costs arising from such assistance.
5.3. If a Data Subject Request or other communication regarding the Processing of Personal Data under the Agreement is made directly to Vendia, Vendia will promptly inform CUSTOMER and will advise the Data Subject to submit their request to CUSTOMER. CUSTOMER will be solely responsible for responding substantively to any such Data Subject Requests or communications involving Personal Data.
6. Sub-Processing
6.1. CUSTOMER acknowledges and agrees to Vendia’s use of Sub-Processors to Process Personal Data under this Agreement as outlined in Annex IV (“Sub-Processors”).
6.2. Vendia shall not delegate any Processing of Personal Data to additional Sub-Processor without the prior written consent of CUSTOMER. Notwithstanding this, CUSTOMER consents to Vendia engaging Sub-Processors to Process the Personal Data provided that:
a. Vendia provides at least 14 days prior written notice to CUSTOMER of the engagement of any new Sub-Processors (including details of the Processing and location) and Vendia shall update the list of all Sub-Processors engaged to Process Personal Data under this Agreement at Annex IV and send such updated version to CUSTOMER prior to the engagement of the Sub-Processor;
b. Vendia imposes the same protection terms on any Sub-Processor it engages as contained in this DPA (including, where appropriate, the Standard Contractual Clauses) and other data transfer provisions, where applicable; and
c. Vendia remains fully liable for any breach of this DPA or the Agreement that is caused by an act, error, or omission of such Sub-Processor.
6.3. If CUSTOMER objects to the engagement of additional Sub-Processor as defined in Section 6.2 on data protection grounds, then either Vendia will not engage the Sub-Processor to Process the Personal Data or CUSTOMER shall elect to suspend or terminate the affected Services in accordance with the termination provisions of the Agreement without liability to either party (but without prejudice to any fees incurred by CUSTOMER prior to suspension or termination). The Parties agree that by complying with this subsection, Vendia fulfils its obligations under Section 9 of the SCCs.
7. Cooperation
7.1. Vendia, through Services under Agreement, provides CUSTOMER with self-service controls to respond to any requests, complaints or other communications from Data Subjects and regulatory or judicial bodies relating to the Processing of Personal Data under the Agreement, including requests from Data Subjects seeking to exercise their rights under Applicable Privacy Laws. To the extent CUSTOMER is unable to independently address a Data Subject Request, Vendia will provide reasonable assistance in exchange for reasonable costs arising from this assistance. In the event that any such request, complaint or communication is made directly to Vendia, Vendia shall promptly pass this onto CUSTOMER; CUSTOMER shall be solely responsible for responding to any such request.
7.2. If Vendia receives a subpoena, court order, warrant or other legal demand from a third party (including law enforcement or other public or judicial authorities) seeking the disclosure of Personal Data, Vendia shall not disclose any information but shall immediately notify CUSTOMER in writing of such request, and reasonably cooperate with CUSTOMER if it wishes to limit, challenge or protect against such disclosure, to the extent permitted by applicable laws, or as directed by a court or official with appropriate jurisdiction.
7.3. To the extent Vendia is required under Applicable Privacy Laws, Vendia will assist CUSTOMER to conduct a data protection impact assessment and, where legally required, consult with applicable data protection authorities in respect of any proposed Processing activity that present a high risk to Data Subjects.
7.4. Nothing in this Section shall be construed to limit or contravene Section 5.1.
8. Data Access & Security Measures
8.1. Vendia shall ensure that any Authorized Person is subject to a strict duty of confidentiality (whether a contractual or statutory duty) and that they Process the Personal Data only for the purpose of delivering Services under the Agreement to CUSTOMER.
8.2. Vendia will implement and maintain all appropriate technical and organizational security measures to protect from Security Incidents and to preserve the security, integrity and confidentiality of Personal Data ("Security Measures"). Such measures shall have regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. At a minimum, Vendia agrees to the Security Measures identified at Annex III.
9. Personal Data Breaches
9.1. In the event of a Personal Data Breach, without undue delay, Vendia shall inform CUSTOMER and provide written details of the Security Incident, including the type of data affected and the identity of affected person(s) as soon as such information becomes known or available to Vendia.
9.2. Furthermore, in the event of a Security Incident, Vendia shall:
(a) Provide timely information and cooperation as CUSTOMER may require to fulfil CUSTOMER's data breach reporting obligations under Applicable Privacy Laws; and
(b) Take such measures and actions as are appropriate to remedy or mitigate the effects of the Security Incident and shall keep CUSTOMER up-to-date about all developments in connection with the Security Incident.
9.3. The content and provision of any notification, public/regulatory communication or press release concerning the Security Incident with respect to CUSTOMER’s data shall be solely at CUSTOMER’s discretion, except as otherwise required by applicable laws.
10. Data Transfers
CUSTOMER acknowledges and agrees that CUSTOMER will Instruct Vendia on the Data Location of Controller Data and jurisdiction for Processing mechanisms as outlined in Section 3. Vendia will only store Controller Data at rest in the Instructed Data Location.
Notwithstanding the foregoing, CUSTOMER acknowledges and agrees that Vendia may Process Controller Data in any country in which Vendia or its Affiliates have operations only as necessary to provide Services in accordance with the Agreement. In particular, Vendia may temporarily transfer and Process Controller Data when such measures are required for the continuance of Vendia Offerings; such measures (without limitation) may be required in the event of: (i) emergency efforts to restore Services in the event of a Service disruption; (ii) the implementation of remedies of Section 9 - Personal Data Breach; (iii) vital operational or technical support; (iv) written Instruction by CUSTOMER. Wherever Controller Data is transferred outside its country of origin, each Party will ensure such transfers are made in compliance with the requirements of Data Protection Laws and Vendia will promptly destroy or remove such data once normal operations have been restored.
11. Additional Provisions for European Data
11.1. Scope. This Section in its entirety will apply only with respect to European Data.
11.2. Roles of the Parties. When Processing European Data in accordance with Controller’s Instructions, the Parties acknowledge and agree that CUSTOMER is the Controller of European Data and Vendia is the Processor.
11.3. Sub-Processor Agreements. For the purposes of Clause 9(c) of the SCCs, CUSTOMER acknowledges that Vendia may be restricted from disclosing Sub-Processor agreements, but will use reasonable efforts to require any Sub-Processor that Vendia appoints to permit such Sub-Processor to disclose the Sub-Processor agreement to CUSTOMER and will provide (on a confidential basis) all information that Vendia reasonably can.
11.4. Data Protection Impact Assessments and Consultation with Supervisory Authorities. To the extent that the required information is reasonably available to Vendia, and CUSTOMER does not otherwise have access to the required information, Vendia will provide reasonable assistance to CUSTOMER with any data protection impact assessments, and prior consultations with supervisory authorities or other competent data privacy authorities to the extent required by European Data Protection Laws.
11.5. Transfer Mechanisms for Data Transfers.
(A) The Parties agree that Vendia will Process European Data as a Service Provider strictly for the purpose of performing Services under the Agreement or as otherwise permitted by GDPR, including as described in Vendia’s Privacy Policy, which resides at www.vendia.com/legal/privacy-policy.
(B) CUSTOMER acknowledges that in connection with the performance of Services, Vendia may be a recipient of European Data in the United States. Subject to (C) under this Section, the Parties agree that the SCCs will be incorporated by reference and form part of the Agreement as follows:
(a) EEA Transfers. In relation to European Data that is subject to the GDPR: (i) CUSTOMER is the "data exporter" and Vendia, Inc. is the "data importer"; (ii) the Module Two and Module Four terms apply to the extent the CUSTOMER is a Controller of European Data and Vendia is a Processor of European Data; (iii) in Clause 7, the optional docking clause applies; (iv) in Clause 9, Option 2 applies and changes to Sub-Processors will be notified in accordance with the ‘Sub-Processing’ Section of this DPA; (v) in Clause 11, the optional language is deleted; (vi) in Clauses 17 and 18, the Parties agree that the governing law and forum for disputes for the SCCs will be determined in accordance with the Agreement or, if such Agreement do not specify an EU Member State, the Republic of Ireland (without reference to conflicts of law principles); (vii) the Annexes of the SCCs will be deemed completed with the information set out in the Annexes of this DPA; and (viii) if and to the extent the SCCs conflict with any provision of this DPA the SCCs will prevail to the extent of such conflict.
(b) UK Transfers. In relation to European Data that is subject to the UK GDPR, the SCCs will apply in accordance with subsection (ii) and the following modifications: (i) the SCCs will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part of the Agreement; (ii) Tables 1, 2 and 3 of the UK Addendum will be deemed completed with the information set out in the Annexes of this DPA and Table 4 will be deemed completed by selecting “neither Party”; and (iii) any conflict between the terms of the SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum.
(c) Swiss Transfers. In relation to European Data that is subject to the Swiss DPA, the SCCs will apply in accordance with subsection (a) and the following modifications (i) references to "Regulation (EU) 2016/679" will be interpreted as references to the Swiss DPA; (ii) references to "EU", "Union" and "Member State law" will be interpreted as references to Swiss law; and (iii) references to the "competent supervisory authority" and "competent courts" will be replaced with the "the Swiss Federal Data Protection and Information Commissioner " and the "relevant courts in Switzerland"1
12. Additional Provisions for California Personal Information
12.1. Scope. This Section of the DPA in its entirety will apply only with respect to California Personal Information.
12.2. Roles of the Parties. When Processing California Personal Information in accordance with Controller’s Instructions, the Parties acknowledge and agree that CUSTOMER is a Business and Vendia is a Service Provider for the purposes of the CCPA.
12.3. Responsibilities. The Parties agree that Vendia will Process California Personal Information as a Service Provider strictly for the purpose of performing Services under the Agreement (the “Business Purpose”) or as otherwise permitted by the CCPA, including as described in Vendia’s Privacy Policy, which resides at www.vendia.com/legal/privacy-policy.
13. General
13.1. Amendments. Notwithstanding anything else to the contrary in the Agreement and without prejudice to Section 3.1 – Compliance with Instructions and Section(s) 2.3 / 3.3 – Security of this DPA, Vendia reserves the right to make any updates and changes to this DPA. This DPA will be updated periodically, to ensure compliance with Applicable Privacy Laws. Vendia will ensure the updated copy of DPA will reside at www.vendia.com/legal/dpa.
13.2. Severability. If any individual provisions of this DPA are determined to be invalid or unenforceable, the validity and enforceability of the other provisions of this DPA will not be affected.
13.3. Limitation of Liability. Each Party and each of their Affiliates' liability, taken in aggregate, arising out of or related to this DPA (and any other DPAs between the Parties) and the SCCs (where applicable), whether in contract, tort or under any other theory of liability, will be subject to the limitations and exclusions of liability set out in the _Limitation and Liability _section of the Agreement, and any reference in such section to the liability of a Party means aggregate liability of that Party and all of its Affiliates under the Agreement (including this DPA). In no event will either Party's liability be limited with respect to any individual's data protection rights under this DPA (including the SCCs) or otherwise.
13.4. Governing Law. This DPA will be governed by and construed in accordance with the laws of the State of California, unless required otherwise by Data Protection Laws.
13.5. Authorization. The legal entity agreeing to this DPA as CUSTOMER represents that it is authorized to agree and enter into this DPA for and on behalf of itself, and as applicable, each of its Affiliates.
13.6. Remedies. The Parties agree that: (a) CUSTOMER will exercise any right or seek any remedy any Affiliate may have under this DPA on behalf of its Affiliates, and (b) CUSTOMER will exercise any such rights under this DPA not separately for each Affiliate individually but in a combined manner for itself and all of its Affiliates together. The CUSTOMER shall remain responsible for coordinating all Instructions, authorizations, and communications with Vendia under this DPA and will be entitled to make and receive any communications related to this DPA on behalf of its Affiliates.
13.7. Demonstration of Compliance. Vendia will make all information reasonably necessary to demonstrate compliance with this DPA available to CUSTOMER and allow for and contribute to audits, including inspections conducted by CUSTOMER or its auditor in order to assess compliance with this DPA. CUSTOMER acknowledges and agrees that it will exercise its audit rights under this DPA and Clause 8.9 of the SCCs by instructing Vendia to comply with the audit measures described in this 'Demonstration of Compliance' section. CUSTOMER acknowledges that Services are hosted by Vendia’s hosting Sub-Processors who maintain independently validated security programs (including SOC 2) and that Vendia’s systems are audited annually as part of SOC 2 compliance and regularly tested by independent third party penetration testing firms. Upon request, Vendia will supply (on a confidential basis) its SOC 2 report and summary copies of its penetration testing report(s) to CUSTOMER so that CUSTOMER can verify Vendia’s compliance with such DPA. Further, at CUSTOMER’s written request, Vendia will provide written responses (on a confidential basis) to all reasonable requests for information made by CUSTOMER necessary to confirm Vendia’s compliance with this DPA, provided that CUSTOMER will not exercise this right more than once per calendar year unless it has reasonable evidence to suspect non-compliance with the DPA.
13.8. Audit Measures. The Parties agree that CUSTOMER will, when reviewing Vendia’s compliance with this DPA pursuant to Section 13.7 – Demonstration of Compliance, take all reasonable measures to limit any impact to Vendia by combining several audit requests carried out by CUSTOMER into one single audit. CUSTOMER acknowledges and agrees that any and all audits requested by CUSTOMER shall take place no more than once per calendar year, unless otherwise required by applicable law or by request of law enforcement.
13.9. Except as modified herein, the Agreement remain unchanged and in full force and effect. If there is any conflict between any section in this DPA and any provision in the Agreement, this DPA controls and takes precedence. With effect from the effective date, this DPA is part of, and incorporated into the Agreement.
13.10. The obligations placed upon Vendia under this DPA shall survive so long as Vendia and/or its Sub-Processors, Processes Personal Data on behalf of a CUSTOMER.
13.11. Notwithstanding anything else to the contrary in the Agreement Vendia acknowledges and agrees that it shall be liable for any loss of data (including Personal Data) arising under or in connection with the Agreement and this DPA to the extent such loss results from any failure of Vendia (or its Sub-Processors) to comply with its obligations under this DPA and/or Applicable Privacy Laws.
13.12. No Modification of SCCs. Nothing in this Addendum is intended to modify or contradict any SCCs or prejudice the fundamental rights or freedoms of data subjects under European Data Protection Law.
APPENDIX I - Vendia Service: EU Standard Contractual Clauses
(Module 2: Controller-to- Processor; Module 4: Transfer processor to controller)
Capitalized terms used but not defined in these Clauses have the meanings given to them in the agreement into which these Clauses are incorporated (the "Agreement").
SECTION I
Clause 1
Purpose and scope
(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)[1] for the transfer of personal data to a third country.
(b) The Parties:
(i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A. (hereinafter each “data exporter”), and
(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A. (hereinafter each “data importer”)
have agreed to these standard contractual clauses (hereinafter: “Clauses”).
(c) These Clauses apply with respect to the transfer of personal data as specified in Annex II.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46 (2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
Clause 3
Third-party beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
(ii) Clause 8 - Module Two: Clause 8.1(b), 8.9(a), (c), (d) and (e); Module Four: Clause 8.1 (b) and Clause 8.3(b);
(iii) Clause 9 - Module Two: Clause 9(a), (c), (d) and (e)
(iv) Clause 12 - Modules Two: Clause 12(a), (d) and (f);
(v) Clause 13;
(vi) Clause 15.1(c), (d) and (e);
(vii) Clause 16(e);
(viii) Clause 18 - Module Two: Clause 18(a) and (b); Module Four: Clause 18.
(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
Clause 4
Interpretation
(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex II.
Clause 7
Docking clause
(a) An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.
(b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.
(c) The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party.
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
MODULE TWO: Transfer controller to processor
8.1 Instructions
(a) The data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract.
(b) The data importer shall immediately inform the data exporter if it is unable to follow those instructions.
8.2 Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex II, unless on further instructions from the data exporter.
8.3 Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex III and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.
8.4 Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.
8.5 Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex II. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
8.6 Security of processing
(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter “personal data breach”). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex III. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the personal data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify the data exporter without undue delay after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.
8.7 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter “sensitive data”), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex II.
8.8 Onward transfers
The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union[4] (in the same country as the data importer or in another third country, hereinafter “onward transfer”) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
(i) the onward transfer is to a country benefiting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer;
(ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 Regulation of (EU) 2016/679 with respect to the processing in question;
(iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or
(iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
8.9 Documentation and compliance
(a) The data importer shall promptly and adequately deal with enquiries from the data exporter that relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the data exporter.
(c) The data importer shall make available to the data exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and at the data exporter’s request, allow for and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or audit, the data exporter may take into account relevant certifications held by the data importer.
(d) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.
(e) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.
MODULE FOUR: Transfer processor to controller
8.1 Instructions
(a) The data exporter shall process the personal data only on documented instructions from the data importer acting as its controller.
(b) The data exporter shall immediately inform the data importer if it is unable to follow those instructions, including if such instructions infringe Regulation (EU) 2016/679 or other Union or Member State data protection law.
(c) The data importer shall refrain from any action that would prevent the data exporter from fulfilling its obligations under Regulation (EU) 2016/679, including in the context of sub-processing or as regards cooperation with competent supervisory authorities.
(d) After the end of the provision of the processing services, the data exporter shall, at the choice of the data importer, delete all personal data processed on behalf of the data importer and certify to the data importer that it has done so, or return to the data importer all personal data processed on its behalf and delete existing copies.
8.2 Security of processing
(a) The Parties shall implement appropriate technical and organisational measures to ensure the security of the data, including during transmission, and protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access (hereinafter “personal data breach”). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature of the personal data[7], the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects, and in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner.
(b) The data exporter shall assist the data importer in ensuring appropriate security of the data in accordance with paragraph (a). In case of a personal data breach concerning the personal data processed by the data exporter under these Clauses, the data exporter shall notify the data importer without undue delay after becoming aware of it and assist the data importer in addressing the breach.
(c) The data exporter shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
8.3 Documentation and compliance
(a) The Parties shall be able to demonstrate compliance with these Clauses.
(b) The data exporter shall make available to the data importer all information necessary to demonstrate compliance with its obligations under these Clauses and allow for and contribute to audits.
Clause 9
Use of sub-processors
MODULE TWO: Transfer controller to processor
(a) SPECIFIC PRIOR AUTHORISATION The data importer shall not sub-contract any of its processing activities performed on behalf of the data exporter under these Clauses to a sub-processor without the data exporter’s prior specific written authorisation. The data importer shall submit the request for specific authorisation at least 14 days prior to the engagement of the sub-processor, together with the information necessary to enable the data exporter to decide on the authorisation. The list of sub-processors already authorised by the data exporter can be found in Annex IV. The Parties shall keep Annex IV up to date.
(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects.[8] The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
(c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.
(d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.
(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby - in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent - the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.
Clause 10
Data subject rights
MODULE TWO: Transfer controller to processor
(a) The data importer shall promptly notify the data exporter of any request it has received from a data subject. It shall not respond to that request itself unless it has been authorised to do so by the data exporter.
(b) The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679. In this regard, the Parties shall set out in Annex III the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the data exporter.
MODULE FOUR: Transfer processor to controller
The Parties shall assist each other in responding to enquiries and requests made by data subjects under the local law applicable to the data importer or, for data processing by the data exporter in the EU, under Regulation (EU) 2016/679.
Clause 11
Redress
(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
[OPTION: The data importer agrees that data subjects may also lodge a complaint with an independent dispute resolution body[11] at no cost to the data subject. It shall inform the data subjects, in the manner set out in paragraph (a), of such redress mechanism and that they are not required to use it, or follow a particular sequence in seeking redress.]
MODULE TWO: Transfer controller to processor
(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:
(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13;
(ii) refer the dispute to the competent courts within the meaning of Clause 18.
(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.
Clause 12
Liability
MODULE FOUR: Transfer processor to controller
(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
(b) Each Party shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages that the Party causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter under Regulation (EU) 2016/679.
(c) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
(d) The Parties agree that if one Party is held liable under paragraph (c), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its / their responsibility for the damage.
(e) The data importer may not invoke the conduct of a processor or sub-processor to avoid its own liability.
MODULE TWO: Transfer controller to processor
(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.
(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub-processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.
(e) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its / their responsibility for the damage.
(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.
Clause 13
Supervision
MODULE TWO: Transfer controller to processor
(a) [Where the data exporter is established in an EU Member State:] The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.B, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.B, shall act as competent supervisory authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14
Local laws and practices affecting compliance with the Clauses
MODULE TWO: Transfer controller to processor
MODULE FOUR: Transfer processor to controller (where the EU processor combines the personal data received from the third country-controller with personal data collected by the processor in the EU)
(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:
(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred;
(ii) the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards[12];
(iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.
(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a).
(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation. The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities
MODULE TWO: Transfer controller to processor
MODULE FOUR: Transfer processor to controller (where the EU processor combines the personal data received from the third country-controller with personal data collected by the processor in the EU)
15.1 Notification
(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:
(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or
(ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.
(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.
(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.).
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.
15.2 Review of legality and data minimisation
(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request.
(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.
SECTION IV – FINAL PROVISIONS
Clause 16
Non-compliance with the Clauses and termination
(a) The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
(b) In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
(i) the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;
(ii) the data importer is in substantial or persistent breach of these Clauses; or
(iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
(d) [For Module Two: Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data.] [For Module Four: Personal data collected by the data exporter in the EU that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall immediately be deleted in its entirety, including any copy thereof.] The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
(e) Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law
MODULE TWO: Transfer controller to processor
These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of the EU Member State specified in the Agreement.
MODULE FOUR: Transfer processor to controller
These Clauses shall be governed by the law of a country allowing for third-party beneficiary rights. The Parties agree that this shall be the law of the EU Member State specified in the Agreement).
Clause 18
Choice of forum and jurisdiction
MODULE TWO: Transfer controller to processor
(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
(b) The Parties agree that those shall be the courts of the EU Member State specified in the Agreement).
(c) A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.
(d) The Parties agree to submit themselves to the jurisdiction of such courts.
MODULE FOUR: Transfer processor to controller
Any dispute arising from these Clauses shall be resolved by the courts of the EU Member State specified in the Agreement.
[1] Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295 of 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision […].
[2] This requires rendering the data anonymous in such a way that the individual is no longer identifiable by anyone, in line with recital 26 of Regulation (EU) 2016/679, and that this process is irreversible.
[3] The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union's internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses.
[4] The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union's internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses.
[5] See Article 28(4) of Regulation (EU) 2016/679 and, where the controller is an EU institution or body, Article 29(4) of Regulation (EU) 2018/1725.
[6] The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union's internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purposes of these Clauses.
[7] This includes whether the transfer and further processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions or offences.
[8] This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7.
[9] This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7.
[10] That period may be extended by a maximum of two more months, to the extent necessary taking into account the complexity and number of requests. The data importer shall duly and promptly inform the data subject of any such extension.
[11] The data importer may offer independent dispute resolution through an arbitration body only if it is established in a country that has ratified the New York Convention on Enforcement of Arbitration Awards.
[12] As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.
Annex I - Party Information
A. LIST OF PARTIES
Data exporter(s):
Name: CUSTOMER, as specified in the Agreement.
Address: As specified in the Agreement.
Contact person’s name, position and contact details: Contact details for the data exporter are specified in the Agreement.
Activities relevant to the data transferred under these Clauses: The data importer provides the Services, including any applicable Implementation Services, to the data exporter in accordance with the Agreement. Those Services may include advisory, consulting or implementation services if ordered by the data exporter.
Signature and date: The parties agree that execution of the Agreement and certification by the data exporter shall constitute execution of these Clauses by both parties.
Role (controller/processor): Processor
Data importer(s):
- Name: Vendia
Address: As specified in the Agreement.
Contact person’s name, position and contact details: Contact details for the data importer are specified in the Agreement.
Activities relevant to the data transferred under these Clauses: The data importer provides the Services, including any applicable Implementation Services, to the data exporter in accordance with the Agreement.
Signature and date: The parties agree that execution of the Agreement and certification by the data exporter shall constitute execution of these Clauses by both parties.
Role (controller/processor): processor.
B. COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with Clause 13.
The authority identified by the data exporter as its competent supervisory via the Agreement.
Annex II – Details of the Processing
Description of Controller:
CUSTOMER shall be the data controller of certain Personal Data provided to Vendia to provide Services as agreed upon in the Agreement.
Nature of Services provided by Vendia:
Vendia will offer its Software-as-a-Service (SaaS) platform which helps companies rapidly build real-time transaction services that connect data across applications, data stores and other silos. Vendia will host, manage, operate and maintain the software for remote electronic access and will incorporate mutually agreeable modifications into the software based on feedback from CUSTOMER.
Type(s) of Personal Data Processed:
CUSTOMER acknowledges and agrees that it will be solely responsible for defining, as appropriate, any and all Personal Data to be Processed by Vendia. All Personal Data must be identified as such, using Instructions provided by Vendia, prior to transfer to Vendia for Processing.
Special categories of data (if applicable):
CUSTOMER acknowledges and agrees that it will be solely responsible for defining, as appropriate, any and all special categories of Personal Data to be Processed by Vendia. All special categories of Personal Data must be identified as such, using Instructions provided by Vendia, prior to transfer to Vendia for Processing.
Categories of Data Subjects:
CUSTOMER acknowledges and agrees that it will be solely responsible for defining, as appropriate, any and all categories of Data Subjects.
Categories of Recipients:
CUSTOMER acknowledges and agrees that it will be solely responsible for defining and maintaining, as appropriate, any and all data recipients of Personal Data by Instruction to Vendia. Data recipients may include, but are not limited too: (i) Vendia Service accounts consumed by natural persons or CUSTOMER services, created by CUSTOMER by Instruction, with sufficient privileges to access Personal Data; (ii) Receiving Controllers which CUSTOMER (i.e., Sending Controller) Instructs Vendia to Process (e.g. transmit) Personal Data; (iii) CUSTOMER as a Receiving Controller may also be a recipient of Personal Data by the nature of Vendia Processing Instructions issued by a Sending Controller.
Nature of Processing Operations:
The Personal Data Processed by Vendia and/or its Sub-Processors will be subject to the Processing activities described in the Agreement or purchase orders for Services subject to this DPA. Personal Data shall be Processed only to comply with CUSTOMER's Instructions issued in accordance with the DPA.
Such Processing activities include but are not limited too, providing storage of data, support and maintenance to CUSTOMER, CUSTOMER Affiliates, and/or their respective customers.
Duration of Processing:
CUSTOMER agrees that Vendia will Process data on behalf of CUSTOMER until CUSTOMER provides Instruction to delete Personal Data, or upon termination of Agreement and/or this DPA.
Annex III – Security Measures
Access Control
Vendia hosts its production Services with outsourced public cloud infrastructure providers. The physical and environmental of these infrastructure providers' security controls are audited for SOC 2 Type II compliance among other certifications. Data Processing systems must be prevented from being used without authorization. Vendia has (without limitation) implemented the following controls:
System Access Control
- Ensured that all systems Processing Personal Data (to include remote access) are password protected after booth sequences or when left idle for a short duration in order to prevent unauthorized persons from accessing any Personal Data
- Provided dedicated user IDs for authentication against systems user management for every individual
- Assigned individual user passwords for authentication
- Ensured that access control is supported by an authentication system
- Controls to grant access only to authorized personnel and to assign only the minimum permissions necessary for those personnel to access Personal Data in the performance of their role
- Implemented a password policy that prohibits the sharing of passwords, outlines processes after disclosure of a password and requires the changing of passwords at a regular interval
- Ensured that passwords are always stored in encrypted form
- Implemented a proper procedure to deactivate user account when a user leaves the company or assigned role
- Implemented a process to log all access to systems and review those logs for security incidents
Data Access Control
Persons entitled to use a data Processing system shall gain access only to the data to which they have a right of access, and Personal Data must not be read, copied, modified or removed without authorization in the course of Processing. Vendia has (without limitation) implemented the following controls:
- Restricted access to files and programs based on a “need-to-know” basis
- Established rules for the safe and permanent destruction of data that are no longer required
- Controls to grant access only to authorized personnel and to assign only the minimum permissions necessary for those personnel to access Personal Data in the performance of their role
Data Transmission Control
Personal Data must not be read, copied, modified or removed without authorization during transfer or storage and it shall be possible to establish to whom Personal Data was transferred. All Personal Data is encrypted during any transmission.
Data Entry Control
Vendia shall be able retrospectively to examine and establish whether and by whom Personal Data have been entered into data Processing systems, modified, or removed. Vendia has (without limitation) implemented the following controls:
- Controls to log administrators’ and users’ activities
- Controls to permit only authorized personnel to modify any Personal Data within the scope of their function
Job Control
Personal Data being Processed in the performance of a service for CUSTOMER shall be Processed solely in accordance with the Agreement in place between CUSTOMER and Vendia and in accordance with the Instructions of CUSTOMER. Vendia has (without limitation) implemented the following controls:
- Ensured that data is always physically or logically separated so that, in each step of the Processing, the Controller from whom Personal Data originates can be identified
- Established controls to ensure Processing of Personal Data only for contractual performance
- Controls to ensure staff members and contractors comply with written instructions or agreement.
Availability Control
Personal Data shall be protected against disclosure, accidental or unauthorized destruction or loss. Vendia has (without limitation) implemented the following controls:
- Arrangements to create backup copies stored in specially protected environments
- Arrangements to perform regular restore tests from those backups
- Contingency plans or business recovery strategies
- Controls to ensure that Personal Data is not used for any purpose other than for the purposes it has been contracted to perform
- Controls to use only authorized business equipment to perform Services
- Implemented a process for secure disposal of documents
- Implemented safeguards to protect against unauthorized access to system networks and services
- Ensured that each system used to Process Personal Data runs an up-to-date antivirus solution
Organizational Requirements
The internal organization of the data importer shall meet the specific requirements of data protection. In particular, the data importer shall take technical and organizational measures to avoid the accidental mixing of Personal Data. Vendia has (without limitation) implemented the following controls:
- Designated a Data Protection Officer (or a responsible person if a data protection officer is not required by law) - Vendia’s current Data Protection Officer is Mr. Kevin Durdle, Director of Information Security
- Obtained the written commitment of all employees to maintain confidentiality
- Trained staff on data privacy and data security
- Implemented a formal security incident response process that is consistently followed for the management of security incidents
- Trained staff assigned to security incident responder roles on the security incident process
Annex IV – Sub-Processors
| Name | Nature of Processing | Territory(ies) |
Amazon Web Services (AWS), Inc | Hosting & Infrastructure. Used as an on-demand cloud computing and data hosting platform | As Instructed by the Controller for the provisioning of Services in Agreement. |
Google, Inc. | Domain name server services | United States; Local (traffic will be automatically routed to the nearest data centre) |
Google Cloud Platform (GCP) | Hosting & Infrastructure. Used as an on-demand cloud computing and data hosting platform | As Instructed by the Controller for the provisioning of Services in Agreement. |
Microsoft Azure | Hosting & Infrastructure. Used as an on-demand cloud computing and data hosting platform. | As Instructed by the Controller for the provisioning of Services in Agreement. |
HubSpot | Customer Relationship Management system (CRM), containing all client information collected, governed, transformed, reported and shared across Vendia’s organisation. No Controller Data is stored here. | United States |