Data Processing Agreement

Clause 1Purpose and scope#

• (a)

  The purpose of these Standard Contractual Clauses (the Clauses) is to ensure compliance with [choose relevant option: OPTION 1: Article 28(3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data] / [OPTION 2: Article 29(3) and (4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data].

• (b)

  The controllers and processors listed in Annex I have agreed to these Clauses in order to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 and/or Article 29 (3) and (4) Regulation (EU) 2018/1725.

• (c)

  These Clauses apply to the processing of personal data as specified in Annex II.

• (d)

  Annexes I to IV are an integral part of the Clauses.

• (e)

  These Clauses are without prejudice to obligations to which the controller is subject by virtue of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

• (f)

  These Clauses do not by themselves ensure compliance with obligations related to international transfers in accordance with Chapter V of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

Clause 2Invariability of the Clauses#

• (a)

  The Parties undertake not to modify the Clauses, except for adding information to the Annexes or updating information in them.

• (b)

  This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a broader contract, or from adding other clauses or additional safeguards provided that they do not directly or indirectly contradict the Clauses or detract from the fundamental rights or freedoms of data subjects.

Clause 3Interpretation#

• (a)

  Where these Clauses use the terms defined in Regulation (EU) 2016/679 or Regulation (EU) 2018/1725 respectively, those terms shall have the same meaning as in that Regulation.

• (b)

  These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679 or Regulation (EU) 2018/1725 respectively.

• (c)

  These Clauses shall not be interpreted in a way that runs counter to the rights and obligations provided for in Regulation (EU) 2016/679 / Regulation (EU) 2018/1725 or in a way that prejudices the fundamental rights or freedoms of the data subjects.

Clause 4Hierarchy#

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties existing at the time when these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 5Docking clause (optional)#

• (a)

  Any entity that is not a Party to these Clauses may, with the agreement of all the Parties, accede to these Clauses at any time as a controller or a processor by completing the Annexes and signing Annex I.

• (b)

  Once the Annexes in (a) are completed and signed, the acceding entity shall be treated as a Party to these Clauses and have the rights and obligations of a controller or a processor, in accordance with its designation in Annex I.

• (c)

  The acceding entity shall have no rights or obligations resulting from these Clauses from the period prior to becoming a Party.

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 6Description of processing(s)#

The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Annex II.

Clause 7Obligations of the Parties#

Clause 8Assistance to the controller#

• (a)

  The processor shall promptly notify the controller of any request it has received from the data subject. It shall not respond to the request itself, unless authorised to do so by the controller.

• (b)

  The processor shall assist the controller in fulfilling its obligations to respond to data subjects’ requests to exercise their rights, taking into account the nature of the processing. In fulfilling its obligations in accordance with (a) and (b), the processor shall comply with the controller’s instructions

• (c)

  In addition to the processor’s obligation to assist the controller pursuant to Clause 8(b), the processor shall furthermore assist the controller in ensuring compliance with the following obligations, taking into account the nature of the data processing and the information available to the processor:

  • (1)

    the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a ‘data protection impact assessment’) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;

  • (2)

    the obligation to consult the competent supervisory authority/ies prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk;

  • (3)

    the obligation to ensure that personal data is accurate and up to date, by informing the controller without delay if the processor becomes aware that the personal data it is processing is inaccurate or has become outdated;

  • (4)

    the obligations in [OPTION 1] Article 32 Regulation (EU) 2016/679/ [OPTION 2] Articles 33, 36 to 38 Regulation (EU) 2018/1725.

• (d)

  The Parties shall set out in Annex III the appropriate technical and organisational measures by which the processor is required to assist the controller in the application of this Clause as well as the scope and the extent of the assistance required.

Clause 9Notification of personal data breach#

In the event of a personal data breach, the processor shall cooperate with and assist the controller for the controller to comply with its obligations under Articles 33 and 34 Regulation (EU) 2016/679 or under Articles 34 and 35 Regulation (EU) 2018/1725, where applicable, taking into account the nature of processing and the information available to the processor.

Clause 10Non-compliance with the Clauses and termination#

• (a)

  Without prejudice to any provisions of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725, in the event that the processor is in breach of its obligations under these Clauses, the controller may instruct the processor to suspend the processing of personal data until the latter complies with these Clauses or the contract is terminated. The processor shall promptly inform the controller in case it is unable to comply with these Clauses, for whatever reason.

• (b)

  The controller shall be entitled to terminate the contract insofar as it concerns processing of personal data in accordance with these Clauses if:

  • (1)

    the processing of personal data by the processor has been suspended by the controller pursuant to point (a) and if compliance with these Clauses is not restored within a reasonable time and in any event within one month following suspension;

  • (2)

    the processor is in substantial or persistent breach of these Clauses or its obligations under Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725;

  • (3)

    the processor fails to comply with a binding decision of a competent court or the competent supervisory authority/ies regarding its obligations pursuant to these Clauses or to Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

• (c)

  The processor shall be entitled to terminate the contract insofar as it concerns processing of personal data under these Clauses where, after having informed the controller that its instructions infringe applicable legal requirements in accordance with Clause 7.1 (b), the controller insists on compliance with the instructions.

• (d)

  Following termination of the contract, the processor shall, at the choice of the controller, delete all personal data processed on behalf of the controller and certify to the controller that it has done so, or, return all the personal data to the controller and delete existing copies unless Union or Member State law requires storage of the personal data. Until the data is deleted or returned, the processor shall continue to ensure compliance with these Clauses.

1Physical Access Control#

The following measures are implemented to protect against unauthorised physical access to premises, buildings or rooms where data processing systems are located which process and/or use Personal Data:

• a)

  Physical components of the data centre facilities, servers, networking equipment, and host software are housed in nondescript facilities.

• b)

  Physical barrier controls are used to prevent unauthorised entrance to these facilities both at the perimeter (e.g., fencing, walls) and at building access points.

• c)

  Physical access points to server locations are managed by electronic access control devices and are secured with intrusion detection devices that sound alarms if the door is forced open or held open.

• d)

  Establishing access authorizations for employees and third parties, including the respective documentation.

• e)

  All visitors are required to present identification and are signed in.

• f)

  Use of video cameras (CCTV) to monitor individual physical access to data centre facilities.

• g)

  Data centres utilise security guards 24x7, who are stationed in and around the building.

2System Access Control#

The following measures are implemented to protect against the unauthorised access to and use of data processing systems used to provide the digital services:

• a)

  User and administrator access to the data centre facilities, servers, networking equipment, and host software is based on a role based access rights model. A unique ID is assigned to ensure proper user-authentication management for users and administrators on all system components.

• b)

  The concept of least privilege is employed, allowing only the necessary access for users to accomplish their job function. When user accounts are created, user accounts are created to have minimal access. Access above these least privileges requires appropriate authorization.

• c)

  IT access privileges are reviewed on a regular basis by appropriate personnel.

• d)

  Access to systems is revoked within a reasonable timeframe of the employee record being terminated (deactivated).

• e)

  First time passwords/passphrases are set to a unique value and changed immediately after first use.

• f)

  User passwords/passphrases are changed periodically and only allow complex passwords.

• g)

  Time stamped logging of security relevant actions is in place.

• h)

  Automatic time-out of user terminal if left idle, with user identification and password required to reopen.

• i)

  Assets (e.g. laptops) are configured with anti-virus software that includes e-mail filtering and malware detection.

• j)

  Firewall devices are configured to restrict access to the computing environment and enforce boundaries of computing clusters.

• k)

  Firewall policies (configuration files) are pushed to firewall devices on a regular basis.

3Data Access Control#

The following measures are implemented to control that persons entitled to use data processing systems gain access only to the Personal Data when they have a right to access, and Personal Data is not read, copied, modified or removed without authorization in the course of processing, use and storage.

• a)

  User and administrator access to the data centre facilities, servers, networking equipment, and host software is based on a role based access rights model. A unique ID is assigned to ensure proper user-authentication management for users and administrators on all system components.

• b)

  The concept of least privilege is employed, allowing only the necessary access for users to accomplish their job function. When user accounts are created, user accounts are created to have minimal access. Access above these least privileges requires appropriate authorization.

• c)

  IT access privileges are reviewed on a regular basis by appropriate personnel.

• d)

  Time stamped logging of access to and modification of Personal Data is in place.

• e)

  An incident response plan is in place to address the following at time of incident:

  • •

    Roles, responsibilities, and communication and contact strategies in the event of a compromise.

  • •

    Specific incident response procedures.

  • •

    Coverage and responses of all critical system components

4Data Transmission Control#

The following measures are implemented to control that Personal Data is not read, copied, modified or removed without authorization during transfer:

• a)

  Prevention of unauthorised copying: The measures taken to prevent unauthorised copying of the physical storage infrastructure as such (e.g. copying your data by transferring them to an external storage medium as a hard drive) are included in the measures described above.

• b)

  Use of role based access rights model: described above.

• c)

  Firewall policies: described above

• d)

  Implement an incident response plan: described above.

• e)

  Storage Device Decommissioning: When a storage device has reached the end of its useful life, procedures implemented include a decommissioning process that is designed to prevent customer data from being exposed to unauthorised individuals. All decommissioned magnetic storage devices are degaussed and physically destroyed in accordance with industry-standard practices and applicable data protection law.

• f)

  Secure Access Points: there are only a limited number of secure access points to the cloud, which allow you to establish a secure communication session with your storage or compute instances within the Services.

• g)

  Connections to the network by personnel: personnel connect to the network using secure authentication that restricts access to network devices and other cloud components.

5Data Input Control#

The following measures are implemented to retrospectively examine and establish whether and by whom Personal Data have been entered, modified or removed from data processing systems used to provide the digital services:

Logging User Activity: developers and administrators who need access to our systems in order to maintain them must explicitly request access. Approved personnel connect to the network using secure authentication that restricts access to network devices and other cloud components, logging all relevant activity for security review.

6Order Control#

The following measures are implemented in order to ensure that Personal Data which are processed on your behalf can only be processed in compliance with your instructions:

• a)

  Internal communication: various methods of internal communication are implemented at a global level to help employees understand their individual roles and responsibilities and to communicate significant events in a timely manner. These methods include orientation and training programs for newly hired employees and regular management meetings for updates on business performance and other matters.

• b)

  Corporate Segregation: Logically, the production network is segregated from the corporate network by means of a complex set of network security / segregation devices. Developers and administrators on the corporate network who need to access in order to maintain them must explicitly request access. Approved personnel then connect to the network through secure means.

• c)

  Robust Compliance Program: The IT infrastructure is designed and managed in alignment with security best practices and certain IT security standards, such as ISO 27001.

• d)

  Policies and Security Awareness Training: We and our Subprocessors maintain and provide periodic security awareness training to all information system users. Policies and procedures have been established based upon data security and data protection requirements.

7Availability Control#

The following measures are implemented to protect Personal Data against accidental or unauthorised destruction or loss.

• a)

  Fire Detection and Suppression: Automatic fire detection and suppression equipment has been installed with our data centres. The fire detection system utilises smoke detection sensors in all data centre environments, mechanical and electrical infrastructure spaces, chiller rooms and generator equipment rooms.

• b)

  Redundant Power Systems: The data centre electrical power systems are designed to be fully redundant and maintainable without impact to operations, 24 hours a day, and seven days a week. Uninterruptible Power Supply (UPS) units provide back-up power in the event of an electrical failure for critical and essential loads in the facility. Data centres use generators to provide back-up power for the entire facility.

• c)

  Climate and Temperature Control: Personnel and systems monitor and control temperature and humidity at appropriate levels at data centres.

• d)

  Preventative maintenance: Preventative maintenance is performed to maintain the continued operability of the data centre equipment.

8Data Separation Control#

The following measures are implemented to control that Personal Data collected for different purposes can be processed separately:

Multi-tenant environment: The Platform is a virtualized, multi-tenant environment. Security management processes and security controls designed to isolate each customer from other customers are implemented. Systems are designed to prevent customers from accessing physical hosts or instances not assigned to them by filtering through the virtualization software. Corporate Segregation: described above.

9Technical and organisational measures of sub processors#

Supplier uses sub processors for rendering its services (see Annex IV). All sub processors implement appropriate technical and organisational measures. Please find more information under:

Amazon Web Services: https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf

Twilio (Sendgrid): https://www.twilio.com/legal/security-overview

Zendesk: https://www.zendesk.co.uk/trust-center/

Clause 1Purpose and scope#

• (a)

  The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)[1] for the transfer of personal data to a third country.

• (b)

  The Parties:

  • (i)

    the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A. (hereinafter each “data exporter”), and

  • (ii)

    the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A. (hereinafter each “data importer”)

  • have agreed to these standard contractual clauses (hereinafter: “Clauses”).

• (c)

  These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.

• (d)

  The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.

Clause 2Effect and invariability of the Clauses#

• (a)

  These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46 (2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.

• (b)

  These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.

Clause 3Third-party beneficiaries#

• (a)

  Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:

  • (i)

    Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;

  • (ii)

    Clause 8 - Module One: Clause 8.5 (e) and Clause 8.9(b); Module Two: Clause 8.1(b), 8.9(a), (c), (d) and (e); Module Three: Clause 8.1(a), (c) and (d) and Clause 8.9(a), (c), (d), (e), (f) and (g); Module Four: Clause 8.1 (b) and Clause 8.3(b);

  • (iii)

    Clause 9 - Module Two: Clause 9(a), (c), (d) and (e); Module Three: Clause 9(a), (c), (d) and (e);

  • (iv)

    Clause 12 - Module One: Clause 12(a) and (d); Modules Two and Three: Clause 12(a), (d) and (f);

  • (v)

    Clause 13;

  • (vi)

    Clause 15.1(c), (d) and (e);

  • (vii)

    Clause 16(e);

  • (viii)

    Clause 18 - Modules One, Two and Three: Clause 18(a) and (b); Module Four: Clause 18.

• (b)

  Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.

Clause 4Interpretation#

• (a)

  Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.

• (b)

  These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.

• (c)

  These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.

Clause 5Hierarchy#

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6Description of the transfer(s)#

The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

Clause 7Docking clause (optional)#

• (a)

  An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.

• (b)

  Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.

• (c)

  The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party.

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 8Data protection safeguards#

The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.

Clause 9Use of sub-processors (not applicable)#

Clause 10Data subject rights#

The Parties shall assist each other in responding to enquiries and requests made by data subjects under the local law applicable to the data importer or, for data processing by the data exporter in the EU, under Regulation (EU) 2016/679.

Clause 11Redress#

• (a)

  The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.

Clause 12Liability#

• (a)

  Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.

• (b)

  Each Party shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages that the Party causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter under Regulation (EU) 2016/679.

• (c)

  Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.

• (d)

  The Parties agree that if one Party is held liable under paragraph (c), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its / their responsibility for the damage.

• (e)

  The data importer may not invoke the conduct of a processor or sub-processor to avoid its own liability.

Clause 13Supervision (not applicable)#

SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES

Clause 14Not applicable#

Clause 15Not applicable#

SECTION IV – FINAL PROVISIONS

Clause 16Non-compliance with the Clauses and termination#

• (a)

  The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.

• (b)

  In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).

• (c)

  The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:

  • (i)

    the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension;

  • (ii)

    the data importer is in substantial or persistent breach of these Clauses; or

  • (iii)

    the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.

  • In these cases, it shall inform the competent supervisory authority of such non-compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.

• (d)

  Personal data collected by the data exporter in the EU that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall immediately be deleted in its entirety, including any copy thereof. The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.

• (e)

  Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.

Clause 17Governing law#

These Clauses shall be governed by the law of a country allowing for third-party beneficiary rights. The Parties agree that this shall be the law of Germany (specify country).

Clause 18Choice of forum and jurisdiction#

Any dispute arising from these Clauses shall be resolved by the courts of Germany (specify country).