EFFIVITY DATA PROCESSING AGREEMENT
Last
revision: 14 June
2020
This Effivity Data Processing Agreement, including its exhibits, (the �Agreement�)
governs the Processing of Personal Data by Effivity Technologies Pvt Ltd having a registered business
address at A-4, Narsinhdham Society, Near Mother School, Gotri Road, Vadodara,
390021, Gujarat, India
and any of its
subsidiaries (the �Processor�). The Processor owns and operates
business process automation software-as-a-service Effivity for productivity enhancement (�Effivity�). This Agreement governs
the Processing of Personal Data submitted by an individual user or a business entity accessing and using Effivity and
its authorised affiliates (the
�Client�). The Processor and the Client are hereby
collectively referred to as the �Parties�
and each individually a �Party�.
The
Agreement sets out rights and obligations of the Parties regarding the
Processing of Personal Data, where the Processor acts in the capacity of the
Data Processor and the Client acts in a capacity of the Data Controller. The
Agreement is drafted in accordance with EU Standard Contractual Clauses
attached as Exhibit I of the Agreement.
The
Agreement is incorporated by reference to Processor�s Terms of Use available at
https://www.effivity.com/Terms_of_Use.htm (the �Terms�) and is
concluded automatically by Client�s acceptance of the Terms. By concluding the
Agreement, the Client enters into this Agreement on behalf of itself and, to
the extent required under applicable Data Protection Law, in the name and on
behalf of its authorised affiliates, if and to the extent the Processor
processes the Personal Data for which such authorised affiliates qualify as the
Data Controller.
1.
Definitions
1.1.In
this Agreement, the following definitions shall apply:
�Client�s Data�shall mean the Personal Data of which the
Client is the Data Controller.
�Contract�
shall mean a
service agreement concluded between the Parties governing the provision of Effivity.
�Data
Controller� shall
mean a natural or legal person, public authority, agency or other body which, alone or jointly
with others, determines the purposes and means of the Processing of Personal
Data.
�Data Protection Law� means the statutory data privacy
and protection regulations applicable to the Client and the Processor protecting the fundamental rights and
freedoms of persons with regard to data privacy and the Processing of the Client�s Data by the Processor, including, if
applicable, the GDPR.
�Data
Subject� shall mean
an identified or
identifiable natural person who can be identified, directly or indirectly, in
particular by reference to an identifier,
such as a name, an identification number, location data, an online identifier
or to one or more factors specific to the physical, physiological, genetic,
mental, economic, cultural or social identity of that natural person.
�EU� shall mean European Union.
�GDPR� shall mean the Regulation (EU) 2016/679
(General Data Protection Regulation).
�Instruction� shall mean an instruction
issued by the Client to the Processor and directing the Processor to perform a
specific action with regard to the Processing of the Client�s Data in order to achieve
compliance with the Data Protection Law.
�Personal Data� shall mean any information
relating to an identified or identifiable natural person.
�Processor� and �Data Processor� shall mean a
natural or legal person, public authority, agency or other body which processes
Personal Data on behalf of the Data Controller;
�Processing�
shall mean any operation which is performed
on Personal Data, whether or not by automated means, such as collection,
recording, organization, structuring, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise
making available, alignment or combination, restriction, erasure or destruction.
�Sub-processor� shall mean an entity that Processes
Personal Data as a subcontractor of the Data Processor.
1.2.All capitalised terms not defined
in this section 1 shall have the meaning set forth in the Agreement.
2.
Subject
matter of Processing
2.1.The Client engages the Processor
to provide services
through Effivity to the Client in accordance with the Terms and
the Contract and
agrees that the Processor shall carry the Processing of the Client�s Data, the categories of which are
described in section 4 of this Agreement, pursuant to the terms stated herein.
2.2.This Agreement stipulates the
rights and obligations of the Parties with regard to
the Processing of the Client�s Data in connection with
Effivity. It shall apply to all
activities within the scope of Effivity and the Contract in the context of which the
Processor or any Sub-processor may come into contact with the Client�s Data.
2.3.To ensure the transparency of
the Processing, the Parties shall keep records of all Processing activities
regarding Personal Data (if
applicable, as
required by Art. 30 of the GDPR).
3.
Scope,
nature, and purpose of Processing
3.1.The Processor shall Process the Client�s Data on behalf of the Client as
Client�s Processor. The scope, extent, and nature of the Processing are the
sole purpose of facilitation of the provision of Effivity by the Processor to the Client.
3.2.The Processor shall ensure that
any of its officers, directors, employees, consultants, representatives and
other natural persons that participate in the Processing of the Client�s Data agree to the same
restrictions and conditions as those listed in this Agreement.
3.3.The Client as the Data
Controller shall be responsible for complying with the applicable Data
Protection Law, including, but not limited to, the lawfulness of the Processing
and the lawfulness of the transmission (if any) of the Client�s Data to the Processor.
3.4.The Processor shall Process the Client�s Data only to the extent required
and with the purpose of fulfilling Processor�s obligations under the Contract, to the extent necessary for the provision
of Effivity, and in accordance with Client�s
Instructions.
3.5.Should the Processor wish to use the Client�s Data for the purposes that are
not specified in this section 3, the Processor shall request the Client to
provide prior consent in writing.
4.
Categories
of Personal Data
4.1.The
Processor shall Process all Client�s Data submitted by the Client through Effivity. To the extent the Client�s Data contains Personal Data, it
may consist of the
following types of Data
Subjects� identifying information:
4.2.In individual cases, special categories of Personal
Data as defined in Art. 9(1) of the GDPR are processed according to this
Agreement, if
submitted by the Client through Effivity.
5.
Categories
of Data Subjects
5.1.The affected Data Subjects shall
include natural persons whose personal data is supplied by the Client to the Processor through Effivity.
5.2.The Processor does not interact
with the Data Subjects directly in any manner without Client�s prior approval.
6.
Duration
of Processing
6.1.Except where this Agreement
expressly stipulates any surviving obligation, this Agreement shall follow the
term of the Contract.
6.2.The Processor shall Process the Client�s Data for as long as the Client�s Data is necessary for the purpose
described in section 3 of this Agreement.
6.3.The Processor shall return to
the Client or securely erase Client�s Data from its storage systems as soon as the Client�s Data is no longer necessary for
the purpose described in section 3 of this Agreement or
the Client requests the Processor to do so. Upon request of the Client, the
Processor shall provide the Client with a proof of erasure of the Client�s Data.
7.
Security
of Processing
7.1.The Processor shall exercise a
reasonable degree of care to protect the
Client�s Data from any misuse, unauthorised access, disclosure, and
transfer to any third parties unauthorised by the Client. Such measures
shall include, without limitation:
a) Maintaining adequate access
control mechanisms (e.g., two-factor authentication, password protection, and
limited access) covering any systems, servers, or files in which the Client�s Data is stored;
b) DDOS mitigation;
c) Using SSL encryption for any
transmission of the Client�s Data electronically;
d) Limiting access to the Client�s Data by Processor�s officers,
directors, employees, consultants, and representatives only to the purpose
stated in section 3 of this Agreement; and
e) Obtaining information security
certificates signifying Processor�s adherence to the highest information
security standards (the Processor is certified under ISO 27001:2013) and
conducting regular information security audits.
7.2.The Processor hereby declares that it has taken appropriate
technical and organisational measures (if applicable, in accordance with Art. 32 GDPR) to keep the Client�s Data secure and protected against unauthorised or unlawful processing and
accidental loss, destruction or damage, and undertakes to continue doing so
during the term of this Agreement.
7.3.If, under applicable laws, the
Processor is compelled to disclose
the Client�s Data,
the Processor shall inform the Client before any such mandatory disclosure
within 24 hours after such a disclosure is requested.
7.4.Any significant changes to the
security measures listed in section 7.1 of the Agreement
shall be documented by the Processor and reported to the Client.
7.5.The Processor shall
appropriately document the technical and organisational
measures actually implemented (including each update) for the Processing of the Client�s Data and will hand out the then
current version of such documentation to the Client, upon Client�s request
(e.g., for audit purposes).
7.6.For the purpose of
documentation, the Processor shall be entitled to provide evidence for the
implementation of the security measures by providing up-to-date attestations,
reports or extracts from independent bodies that scrutinise and confirm the Processing of the Client�s Data is in accordance with the
agreed to measures herein.
8.
Correction
and deletion of Personal Data
8.1.The Processor may be required to
correct, erase and/or block
the Client�s Data
if and to the extent the functionality of Effivity does not allow the Client to do so.
However, the Processor shall not correct, erase or block the Client�s Data, unless instructed by the
Client.
8.2.Unless the Data Protection Law provides otherwise,
there shall not be any direct communication between the Data Subjects and the
Processor. In the event that a Data Subject does apply directly to the
Processor in writing
with a request to exercise Data Subject�s legitimate rights, e.g., to request the
correction or deletion of his/her Personal Data, the Processor shall forward
this request to the Client without undue delay and shall not respond directly
to the Data Subject.
9.
Processor�s
obligations
9.1.In addition to any other
obligations set out in this Agreement, the Processor shall:
a) Comply with all laws and
regulations applicable to the Processor�s business activities;
b) Process the Client�s Data only
on documented instructions from the Client;
c) Ensure that persons authorised to Process the Client�s Data have committed themselves to
confidentiality or are under an appropriate statutory obligation of
confidentiality. The Processor shall regularly train those persons to whom it
grants access to the Client�s Data on IT security and
privacy law compliance. The undertaking to data secrecy shall continue after
the termination of this Agreement;
d) Implement
appropriate technical and organisational security measures to ensure a level of
security appropriate to the Client�s Data;
e) Ensure that any natural person
acting under the authority of the Processor who has access to the Personal Data
does not process them except on instructions from the Client;
f) Assist the Client in compliance
with Client�s obligations under the
applicable Data Protection Law (if applicable, Art. 32 to 36 of the GDPR);
g) Make available to the Client all
information necessary to demonstrate compliance with Processor�s obligations
under the Agreement, the Data Protection Law, and allow for and contribute to
audits, including inspections, conducted by the Client or another auditor
mandated by the Client;
h) Appoint a data protection
officer if it is legally obliged to do so or, if it is not obliged to do so, a
contact person for data protection issues;
i) Provide the Client, upon request
in writing, with the name and contact details of its data protection officer or
the contact person for data protection issues;
j) Monitor the Processing by way of
regular reviews concerning the performance of and compliance with this
Agreement, the Contract, and the applicable Data
Protection Law;
k) At Client�s written request,
reasonably support the Client in dealing with requests from individual Data
Subjects and/or a supervisory authority with respect to the Processing of the Personal Data hereunder;
l) Assist the Client with the
implementation of appropriate technical and organisational measures in order to respond to
applications by the Data Subjects for the exercise of their rights (if applicable, in particular, Art. 13 to 23 of
the GDPR);
m) Provide at minimum the
information set out in the
applicable Data Protection Law (if applicable, Art. 33(3) of the GDPR) in the case of a Personal Data breach;
n) Communicate the necessary information to the Data Subjects
after a Personal Data breach
(if applicable, pursuant
to Art. 34 of the GDPR); and
o) Conduct prior (i.e. before the
start of the processing) data protection impact assessments (if applicable, pursuant to Art. 35 of the GDPR) and, if necessary, consult with a
supervisory authority (if
applicable, pursuant
to Art. 36 of the GDPR).
9.2.The Processor commits to observe
any and all other duties that are imposed to the Processor by the Data Protection Law (if
applicable, Art. 28
of the GDPR).
9.3.The Processor shall collaborate
with Client�s data protection officer to generate the records of processing
activities, (if
applicable, pursuant
to Art. 30 of the GDPR), and provide all the necessary
details to the Client.
10. Sub-processors
10.1.The Client hereby authorises the Processor to engage Sub-processors as further specified in this section 10, provided that the Processor
remains responsible for any acts or omissions of its Sub-processors in the same manner as for its own acts and
omissions hereunder.
10.2.The Processor may remove or
appoint suitable and reliable other Sub-processor(s)
at its own discretion in accordance with the following conditions:
a) The Processor shall inform the Client
15 days in advance of any envisaged material changes
to the list of Sub-processors;
b) If the Client has a legitimate
data protection related reason to object to Processor�s use of Sub-processor(s), the Client shall notify the
Processor within fourteen (14) days after receipt of the Processor�s notice;
c) If the Client does not object
during this time period, the new Sub-processor(s)
shall be deemed accepted;
d) If the Client objects to the use
of the Sub-processor(s) concerned, the
Processor shall have the right to cure the objection through one of the
following options (to be selected at Processor�s sole discretion):
i.
The
Processor will abort its plans to use the Sub-processor(s) with regard to the Client�s Data; or
ii.
The
Processor will take corrective steps and proceed to use the Sub-processor(s) with regard to the Client�s Data.
e) If the Processor decides not to
implement option 10.2.d.i or 10.2.d.ii above, the Processor shall notify the Client without undue
delay. In this case, the Client shall be entitled within further fourteen (14)
days to notify in writing the Processor about its termination of the Agreement
and any such termination would become effective upon the expiry of the second
(2nd) calendar month after Processor�s receipt of the termination
notice.
10.3.The Processor shall pass on to
its subcontractors acting as the Sub-processors
Processor�s obligations under this Agreement.
10.4.The list of the Sub-processors used by the Processor includes
the following third-party
contractors of the Processor:
i.
Hosting and cloud storage service provider Microsoft Azure
(https://azure.microsoft.com) datacenter located in the Ireland,Singapore and Oracle
(https://www.oracle.com/in/cloud/) datacenter located in Saudi arabia;
ii.
Database
service providers Microsoft Azure (https://azure.microsoft.com) and MongoDB
Atlas (https://www.mongodb.com/cloud/atlas) located in the
United States;
iii.
Marketing
and newsletter service provider Agile CRM (https://www.agilecrm.com) located in the
United States;
iv.
Analytics
service provider Google Analytics (https://analytics.google.com/) located in the
United States;
v.
Payment
service providers PayPal (https://www.paypal.com) and Stripe (https://stripe.com) located in the
United States;
vi.
Survey
service provider SurveyMonkey (https://www.surveymonkey.com) located in the
United States;
vii.
Email
service provider SendGrid (https://sendgrid.com) located in the
United States;
viii.
Mobile
authentication service provider Twilio Authy (https://www.twilio.com/authy)� located in the
United States;
ix.
Video
conference service provider Microsoft Teams, located in the United States; and
x.
Independent
contractors that provide us with support and consulting services.
10.5. The Processor
shall ensure that, where the Client�s Data is transferred from the territory
where the Client is located, appropriate safeguards, including the transfer
mechanisms listed in section 14, are applied by the Processor to ensure that
the Client�s Data is further processed in a secure manner compliant with this
Agreement and the Data Protection Law.
11. Personal
Data breaches
11.1.Within 24 hours
after the Processor becomes aware of any unauthorised use or
disclosure of the Client�s Data, the Processor
shall promptly report the unauthorised use or disclosure of the
Client�s Data to the Client.
11.2.The Processor
shall cooperate with any remediation that the Client, in its discretion,
determines is necessary to (i) address any applicable reporting requirements
and (ii) mitigate any effects of unauthorised use or disclosure of the
Client�s Data.
11.3.In consultation
with the Client, the Processor must take appropriate measures to secure the Client�s Data
and limit any possible detrimental effect on the Data Subjects. Where
obligations are placed on the Client under the Data Protection Law, the
Processor shall provide commercially reasonable assistance in meeting them.
12. Notifications
12.1.If the
Processor receives a request, subpoena or court order (including through an
obligation due to legal provisions or official injunctions from state
authorities) requesting to provide any Client�s Data to an authority, the
Processor shall attempt to redirect the relevant authority to request that data
directly from the Data Controller, and notify the Client without undue delay.
12.2.Where the Client�s Data
becomes subject to search and seizure, an attachment order, confiscation during
bankruptcy or insolvency proceedings, or similar events or measures by third
parties while in Processor�s control, the Processor shall notify the Client of
such action without undue delay.
13. Instructions
13.1.The
Instructions to the Processor are initially laid out in this Agreement.
However, the Client shall be entitled to issuing modifications to Instructions
and to issue new Instructions, subject to feasibility.
13.2.The Client
shall designate a person competent to issue the Instructions. Modifications or
new Instructions shall be issued in writing and shall need to be agreed between
the Parties as a contract modification/change request under this Agreement.
13.3.The Processor
shall notify the Client if the Processor considers any Instruction to be in
violation of the Data Protection Law. The Processor shall not be obligated to
perform a comprehensive legal examination and shall in no event render any
legal services to the Client.
13.4.The Processor
shall not be responsible for any consequences of the Instructions issued by the
Client and the Client shall indemnify and hold the Processor harmless against
any damages and third-party claims resulting from the Instruction.
13.5.Unless
otherwise agreed, the Processor shall be entitled to charge any efforts
incurred in connection with the Instructions on time and material basis.
14. Transfer mechanisms
14.1. The Processor makes available
the transfer mechanisms listed below which shall apply to any
transfers of the Personal Data under this Agreement from the EU, the European
Economic Area and/or their member states, Switzerland, and the United
Kingdom to countries which do not ensure an adequate level of data protection
within the meaning of the GDPR:
a) The Processor
shall conclude data processing agreements based on the the EU Standard
Contractual Clauses; and
b) The Processor will
primarily choose the Sub-processors that have self-certified under the EU-U.S. and
Swiss-U.S. Privacy Shield Framework.
14.2.For any other
cross-body transfers of Personal Data (e.g., transfers from the countries
belonging to the Asia-Pacific Economic Cooperation), the Processor
shall take steps necessary to ensure the compliance with the applicable data
protection rules and regulations.
15. Miscellaneous
15.1.No modification
of this Agreement shall be valid and binding unless made in writing and then
only if such modification expressly states that such modification applies to
the regulations of this Agreement. The foregoing shall also apply to any waiver
or modification of this mandatory written form.
15.2.This Agreement
shall take precedence over any conflicting provisions of the Contract.
15.3.This Agreement
will commence on the date the Client accepts the Terms and continue
until terminated earlier by either Party.
15.4.Either Party
may terminate this Agreement for any reason upon thirty (30) calendar days�
notice to the other Party.
15.5.Each Party may
terminate this Agreement with immediate effect by delivering a notice of the
termination to the other Party if:
a) The other Party
fails to perform, has made or makes any inaccuracy in, or otherwise materially
breaches, any of its obligations, covenants, or representations; and
b) The failure,
inaccuracy, or breach continues for a period of thirty (30) calendar days�
after the injured Party delivers notice to the breaching Party reasonably
detailing the breach.
15.6.If either Party becomes
insolvent, bankrupt, or enters receivership, dissolution, or liquidation, the
other Party may terminate this Agreement with immediate effect.
15.7.Upon expiration
or termination of this Agreement or on Client�s request, the Processor shall:
a) Promptly
securely delete or return any Client�s Data available to the Processor and any
other information and documents, provided by the Client; and
b) Deliver to the
Client a certificate confirming Processor�s compliance with the destruction
obligation under this section 15.7.
15.8.Neither Party
may assign this Agreement or any of their rights or obligations under
this Agreement without the other Party�s prior consent.
15.9.The Parties
shall attempt to resolve any dispute arising out of or relating to this
Agreement in a good faith through negotiations between senior executives of the
Parties, who have authority to settle the same. If the matter is not resolved
by negotiation within thirty (30) days of receipt of a written invitation to
negotiate, the dispute shall be resolved by using binding arbitration services.
15.10.The headings
used in this Agreement and its division into sections, schedules, exhibits,
appendices, and other subdivisions do not affect its interpretation.
15.11.If there is any
inconsistency between the terms of this Agreement and those in any document
entered into under this Agreement, the terms of this Agreement shall prevail.
The Parties shall take all necessary steps to conform the inconsistent terms to
the terms of this Agreement.
The
Parties have executed this Agreement
on the date the Client accepts the Terms. �
Attached
Exhibit I: Commission
Decision C(2010)593 Standard Contractual Clauses (processors)
EXHIBIT I
|
|
EUROPEAN COMMISSION
DIRECTORATE-GENERAL JUSTICE
Directorate C: Fundamental rights and Union
citizenship
Unit C.3: Data protection
|
Commission Decision C(2010)593
Standard Contractual Clauses (processors)
For the
purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal
data to processors established in third countries which do not ensure an
adequate level of data protection
Name of the data exporting
Organization: the name of the entity
using Effivity
Address:
the address of the entity using Effivity
Tel.: the
phone number of the entity using Effivity
E-mail: the
email address of the entity using Effivity
(the data exporter)
And
Name of the data importing
Organization: Effivity
Technologies Pvt Ltd
Address: A-4,
Narsinhdham Society, Near Mother School, Gotri Road, Vadodara, 390021, Gujrat,
India
Tel.: 1-800-233-1425
E-mail:
privacy[at]effivity.com
Other
information needed to identify the Organization: the
company registration number [U72200GJ2015PTC083444.]
(the
data importer)
each a �party�; together �the
parties�,
HAVE
AGREED on the following Contractual Clauses (the Clauses) in order to adduce adequate
safeguards with respect to the protection of privacy and fundamental rights and
freedoms of individuals for the transfer by the data exporter to the data
importer of the personal data specified in Appendix 1.
Clause
1
Definitions
For the purposes
of the Clauses:
(a)������� 'personal
data', 'special categories of data', 'process/processing', 'controller',
'processor', 'data subject' and 'supervisory
authority' shall have the same meaning as in Directive 95/46/EC of the
European Parliament and of the Council of 24 October 1995 on the protection of
individuals with regard to the processing of personal data and on the free
movement of such data[1];
(b)������� 'the data exporter' means the
controller who transfers the personal data;
(c)������� 'the data
importer' means the processor who agrees to
receive from the data exporter personal data intended for processing on his
behalf after the transfer in accordance with his instructions and the terms of
the Clauses and who is not subject to a third country's system ensuring
adequate protection within the meaning of Article 25(1) of
Directive 95/46/EC;
(d)������� 'the
subprocessor' means any
processor engaged by the data importer or by any other subprocessor of the data
importer who agrees to receive from the data importer or from any other
subprocessor of the data importer personal data exclusively intended for
processing activities to be carried out on behalf of the data exporter after
the transfer in accordance with his instructions, the terms of the Clauses and
the terms of the written subcontract;
(e)������� 'the applicable data protection law'
means the legislation protecting the fundamental rights and freedoms of
individuals and, in particular, their right to privacy with respect to the
processing of personal data applicable to a data controller in the Member State
in which the data exporter is established;
(f)������� 'technical
and Organizational security measures' means
those measures aimed at protecting personal data against accidental or unlawful
destruction or accidental loss, alteration, unauthorised disclosure or access,
in particular where the processing involves the transmission of data over a
network, and against all other unlawful forms of processing.
Clause 2
Details of the
transfer
The details of
the transfer and in particular the special categories of personal data where
applicable are specified in Appendix 1 which forms an integral part of the
Clauses.
Clause 3
Third-party
beneficiary clause
1.�������� The
data subject can enforce against the data exporter this Clause, Clause 4(b) to
(i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause
8(2), and Clauses 9 to 12 as third-party beneficiary.
2.�������� The
data subject can enforce against the data importer this Clause, Clause 5(a) to
(e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases
where the data exporter has factually disappeared or has ceased to exist in law
unless any successor entity has assumed the entire legal obligations of the
data exporter by contract or by operation of law, as a result of which it takes
on the rights and obligations of the data exporter, in which case the data
subject can enforce them against such entity.
3.�������� The
data subject can enforce against the subprocessor this Clause, Clause 5(a) to
(e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases
where both the data exporter and the data importer have factually disappeared
or ceased to exist in law or have become insolvent, unless any successor entity
has assumed the entire legal obligations of the data exporter by contract or by
operation of law as a result of which it takes on the rights and obligations of
the data exporter, in which case the data subject can enforce them against such
entity. Such third-party liability of the subprocessor shall be limited to its
own processing operations under the Clauses.
4.�������� The
parties do not object to a data subject being represented by an association or
other body if the data subject so expressly wishes and if permitted by national
law.
Clause 4
Obligations of the
data exporter
The data exporter agrees
and warrants:
(a)������� that the processing, including the transfer
itself, of the personal data has been and will continue to be carried out in
accordance with the relevant provisions of the applicable data protection law
(and, where applicable, has been notified to the relevant authorities of the
Member State where the data exporter is established) and does not violate the
relevant provisions of that State;
(b)������� that it has instructed and throughout the
duration of the personal data processing services will instruct the data
importer to process the personal data transferred only on the data exporter's
behalf and in accordance with the applicable data protection law and the
Clauses;
(c)������� that the data importer will provide
sufficient guarantees in respect of the technical and organisational
security measures specified in Appendix 2 to this contract;
(d)������� that after assessment of the requirements
of the applicable data protection law, the security measures are appropriate to
protect personal data against accidental or unlawful destruction or accidental
loss, alteration, unauthorised disclosure or access, in particular where the
processing involves the transmission of data over a network, and against all
other unlawful forms of processing, and that these measures ensure a level of
security appropriate to the risks presented by the processing and the nature of
the data to be protected having regard to the state of the art and the cost of
their implementation;
(e)������� that it will ensure compliance with the
security measures;
(f)������� that, if the transfer involves special
categories of data, the data subject has been informed or will be informed
before, or as soon as possible after, the transfer that its data could be
transmitted to a third country not providing adequate protection within the
meaning of Directive 95/46/EC;
(g)������� to forward any notification received from
the data importer or any subprocessor pursuant to Clause 5(b) and Clause 8(3)
to the data protection supervisory authority if the data exporter decides to
continue the transfer or to lift the suspension;
(h)������� to make available to the data subjects upon
request a copy of the Clauses, with the exception of Appendix 2, and a summary
description of the security measures, as well as a copy of any contract for
subprocessing services which has to be made in accordance with the Clauses,
unless the Clauses or the contract contain commercial information, in which
case it may remove such commercial information;
(i)�������� that, in the event of subprocessing, the
processing activity is carried out in accordance with Clause 11 by a
subprocessor providing at least the same level of protection for the personal
data and the rights of data subject as the data importer under the Clauses; and
(j)�������� that it will ensure compliance with Clause
4(a) to (i).
Clause 5
Obligations of the
data importer[2]
The data importer agrees
and warrants:
(a)������� to process the personal data only on behalf
of the data exporter and in compliance with its instructions and the Clauses;
if it cannot provide such compliance for whatever reasons, it agrees to inform
promptly the data exporter of its inability to comply, in which case the data
exporter is entitled to suspend the transfer of data and/or terminate the
contract;
(b)������� that it has no reason to believe that the
legislation applicable to it prevents it from fulfilling the instructions
received from the data exporter and its obligations under the contract and that
in the event of a change in this legislation which is likely to have a
substantial adverse effect on the warranties and obligations provided by the
Clauses, it will promptly notify the change to the data exporter as soon as it
is aware, in which case the data exporter is entitled to suspend the transfer
of data and/or terminate the contract;
(c)������� that it has implemented the technical and organisational
security measures specified in Appendix 2 before processing the personal data
transferred;
(d)������� that it will promptly notify the data
exporter about:
(i)�������� any legally binding request for disclosure
of the personal data by a law enforcement authority unless otherwise
prohibited, such as a prohibition under criminal law to preserve the confidentiality
of a law enforcement investigation,
(ii)������� any accidental or unauthorised access, and
(iii)������ any request received directly from the
data subjects without responding to that request, unless it has been otherwise
authorised to do so;
(e)������� to deal promptly and properly with all
inquiries from the data exporter relating to its processing of the personal
data subject to the transfer and to abide by the advice of the supervisory
authority with regard to the processing of the data transferred;
(f)������� at the request of the data exporter to
submit its data processing facilities for audit of the processing activities
covered by the Clauses which shall be carried out by the data exporter or an
inspection body composed of independent members and in possession of the
required professional qualifications bound by a duty of confidentiality,
selected by the data exporter, where applicable, in agreement with the
supervisory authority;
(g)������� to make available to the data subject upon
request a copy of the Clauses, or any existing contract for subprocessing,
unless the Clauses or contract contain commercial information, in which case it
may remove such commercial information, with the exception of Appendix 2 which
shall be replaced by a summary description of the security measures in those
cases where the data subject is unable to obtain a copy from the data exporter;
(h)������� that, in the event of subprocessing, it has
previously informed the data exporter and obtained its prior written consent;
(i)�������� that the processing services by the
subprocessor will be carried out in accordance with Clause 11;
(j)�������� to send promptly a copy of any
subprocessor agreement it concludes under the Clauses to the data exporter.
Clause 6
Liability
1.�������� The
parties agree that any data subject, who has suffered damage as a result of any
breach of the obligations referred to in Clause 3 or in Clause 11 by any party
or subprocessor is entitled to receive compensation from the data exporter for
the damage suffered.
2.�������� If
a data subject is not able to bring a claim for compensation in accordance with
paragraph 1 against the data exporter, arising out of a breach by the data
importer or his subprocessor of any of their obligations referred to in Clause
3 or in Clause 11, because the data exporter has factually disappeared or
ceased to exist in law or has become insolvent, the data importer agrees that
the data subject may issue a claim against the data importer as if it were the
data exporter, unless any successor entity has assumed the entire legal obligations
of the data exporter by contract of by operation of law, in which case the data
subject can enforce its rights against such entity. The data importer may not
rely on a breach by a subprocessor of its obligations in order to avoid its own
liabilities.
3.�������� If
a data subject is not able to bring a claim against the data exporter or the
data importer referred to in paragraphs 1 and 2, arising out of a breach by the
subprocessor of any of their obligations referred to in Clause 3 or in Clause
11 because both the data exporter and the data importer have factually
disappeared or ceased to exist in law or have become insolvent, the
subprocessor agrees that the data subject may issue a claim against the data
subprocessor with regard to its own processing operations under the Clauses as
if it were the data exporter or the data importer, unless any successor entity
has assumed the entire legal obligations of the data exporter or data importer
by contract or by operation of law, in which case the data subject can enforce
its rights against such entity. The liability of the subprocessor shall be
limited to its own processing operations under the Clauses.
Clause 7
Mediation and
jurisdiction
1.�������� The
data importer agrees that if the data subject invokes against it third-party
beneficiary rights and/or claims compensation for damages under the Clauses,
the data importer will accept the decision of the data subject:
(a)������ to refer the dispute to mediation, by an
independent person or, where applicable, by the supervisory authority;
(b)������ to refer the dispute to the courts in the
Member State in which the data exporter is established.
2.�������� The
parties agree that the choice made by the data subject will not prejudice its
substantive or procedural rights to seek remedies in accordance with other
provisions of national or international law.
Clause 8
Cooperation with
supervisory authorities
1.�������� The
data exporter agrees to deposit a copy of this contract with the supervisory
authority if it so requests or if such deposit is required under the applicable
data protection law.
2.�������� The
parties agree that the supervisory authority has the right to conduct an audit
of the data importer, and of any subprocessor, which has the same scope and is
subject to the same conditions as would apply to an audit of the data exporter
under the applicable data protection law.
3.�������� The
data importer shall promptly inform the data exporter about the existence of
legislation applicable to it or any subprocessor preventing the conduct of an
audit of the data importer, or any subprocessor, pursuant to paragraph 2. In
such a case the data exporter shall be entitled to take the measures foreseen
in Clause 5 (b).
Clause 9
Governing Law
The Clauses shall be
governed by the law of the Member State in which the data exporter is
established.
Clause 10
Variation of the
contract
The parties undertake not to vary or modify the
Clauses. This does not preclude the parties from adding clauses on business
related issues where required as long as they do not contradict the Clause.
Clause
11
Subprocessing
1.�������� The
data importer shall not subcontract any of its processing operations performed
on behalf of the data exporter under the Clauses without the prior written
consent of the data exporter. Where the data importer subcontracts its
obligations under the Clauses, with the consent of the data exporter, it shall
do so only by way of a written agreement with the subprocessor which imposes
the same obligations on the subprocessor as are imposed on the data importer
under the Clauses[3]. Where the subprocessor
fails to fulfil its data protection obligations under such written agreement
the data importer shall remain fully liable to the data exporter for the
performance of the subprocessor's obligations under such agreement.
2.�������� The
prior written contract between the data importer and the subprocessor shall
also provide for a third-party beneficiary clause as laid down in Clause 3 for
cases where the data subject is not able to bring the claim for compensation
referred to in paragraph 1 of Clause 6 against the data exporter or the data
importer because they have factually disappeared or have ceased to exist in law
or have become insolvent and no successor entity has assumed the entire legal
obligations of the data exporter or data importer by contract or by operation
of law. Such third-party liability of the subprocessor shall be limited to its
own processing operations under the Clauses.
3.�������� The
provisions relating to data protection aspects for subprocessing of the
contract referred to in paragraph 1 shall be governed by the law of the Member
State in which the data exporter is established.
4.�������� The
data exporter shall keep a list of subprocessing agreements concluded under the
Clauses and notified by the data importer pursuant to Clause 5 (j), which shall
be updated at least once a year. The list shall be available to the data
exporter's data protection supervisory authority.
Clause 12
Obligation after
the termination of personal data processing services
1.�������� The
parties agree that on the termination of the provision of data processing
services, the data importer and the subprocessor shall, at the choice of the
data exporter, return all the personal data transferred and the copies thereof
to the data exporter or shall destroy all the personal data and certify to the
data exporter that it has done so, unless legislation imposed upon the data
importer prevents it from returning or destroying all or part of the personal
data transferred. In that case, the data importer warrants that it will guarantee
the confidentiality of the personal data transferred and will not actively
process the personal data transferred anymore.
2.�������� The
data importer and the subprocessor warrant that upon request of the data
exporter and/or of the supervisory authority, it will submit its data
processing facilities for an audit of the measures referred to in paragraph 1.
Appendix 1 to the Standard Contractual Clauses
Data
exporter
The
data exporter is (please specify briefly your activities relevant to the
transfer): a business entity using the
business process automation software-as-a-service Effivity for productivity
enhancement provided by the data importer.
Data
importer
The
data importer is (please specify briefly activities relevant to the transfer): the
owner and operator of the business
process automation software-as-a-service Effivity for productivity enhancement
(https://www.effivity.com).
Data
subjects
The
personal data transferred concern the following categories of data subjects
(please specify): the affected data subjects
include natural persons whose personal data is submitted
by the data exporter to the data importer through the business
process automation software-as-a-service Effivity for productivity enhancement provided
by the data importer to the data exporter.
Categories
of data
The
personal data transferred concern the following categories of data (please
specify):
