Data processing addendum

This DPA amends the Agreement and sets out the terms that apply when Zapflow under the Agreement processes Personal Data. The purpose of the DPA is to ensure such processing is conducted in accordance with applicable laws and with due respect for the rights and freedoms of individuals whose Personal Data are processed. Other capitalized terms used but not defined in this DPA have the same meanings as set out in the Agreement.

The term of this DPA shall follow the term of the Agreement. Terms not otherwise defined herein shall have the meaning as set forth in the Agreement.

This DPA includes:

Definitions

“Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.

“Data Subject” means the individual to whom Personal Data relates.

“GDPR” means the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data.

“Personal Data” means any information relating to an identified or identifiable natural person where such information is contained within Customer Data and is protected similarly as personal data or personally identifiable information under applicable Data Protection Law.

“Processing” means any operation or set of operations which is performed on Personal Data, encompassing the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, or erasure of Personal Data.

“Standard Contractual Clauses” means the clauses attached hereto as Appendix 1 pursuant to the European Commission’s decision (C(2010)593) of 5

“EEA” means the European Economic Area.

“Instruction” means the written, documented instruction, issued by Controller to Processor, and directing the same to perform a specific action regarding Personal Data (including, but not limited to, depersonalizing, blocking, deletion, making available).

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.

“Data Protection Law” means all applicable legislation relating to data protection and privacy including without limitation the EU Data Protection Directive 95/46/EC and all local laws and regulations which amend or replace any of them, including the GDPR, together with any national implementing laws in any Member State of the European Union or, to the extent applicable, in any other country, as amended, repealed, consolidated or replaced from time to time..

Details of the Processing

• Categories of Data Subjects

  Controller’s Contacts and other end users including Controller’s employees, contractors, collaborators, customers, prospects, suppliers, and subcontractors. Data Subjects also include individuals attempting to communicate with or transfer Personal Data to the Controller’s end users.

• Types of Personal Data

  Contact information such as name, address, email-address, phone numbers, the extent of which is determined and controlled by the Controller in its sole discretion, and other Personal Data such as navigational data (including website usage information), email data, system usage data, application integration data, and other electronic data submitted, stored, sent, or received by end users via the Subscription Service.

• Subject-Matter and Nature of the Processing

  The subject-matter of Processing of Personal Data by Processor is the provision of the services to the Controller that involves the Processing of Personal Data. Personal Data will be subject to those Processing activities as may be specified in the Agreement and an Order

• Purpose of the Processing

  Personal Data will be Processed for purposes of providing the services set out and otherwise agreed to in the Agreement.

• Duration of the Processing

  Personal Data will be Processed for the duration of the Agreement, subject to Section 4 of this DPA.

Details of the Processing

Obligations of processor

Compliance with Instructions. The parties acknowledge and agree that Customer is the Controller of Personal Data and Zapflow is the Processor of that data. Processor shall collect, process, and use Personal Data only within the scope of Controller’s Instructions. If Processor cannot process Personal Data in accordance with the Instructions due to a legal requirement under any applicable Data Protection Law, Processor will (i) promptly notify the Controller of that legal requirement before the relevant Processing to the extent permitted by the Data Protection Law; and (ii) cease all Processing (other than merely storing and maintaining the security of the affected Personal Data) until such time as the Controller issues new instructions with which Processor is able to comply. If this provision is invoked, Processor will not be liable to the Controller under the Agreement for any failure to perform the applicable services until the Controller issues new instructions regarding the Processing.

Personal Data Breaches. Processor will notify the Controller without undue delay after it becomes aware of any of any Personal Data Breach affecting any Personal Data. At the Controller’s request, Processor will promptly provide the Controller with all reasonable assistance necessary to enable the Controller to notify relevant Personal Data Breaches to competent authorities and/or affected Data Subjects, if Controller is required to do so under the Data Protection Law.

Data Subject Requests. Processor will provide reasonable assistance, including by appropriate technical and organizational measures and considering the nature of the Processing, to enable Controller to respond to any request from Data Subjects seeking to exercise their rights under the Data Protection Law with respect to Personal Data (including access, rectification, restriction, deletion or portability of Personal Data, as applicable), to the extent permitted by the law. If such request is made directly to Processor, Processor will promptly inform Controller and will advise Data Subjects to submit their request to the Controller. Controller shall be solely responsible for responding to any Data Subjects’ requests. Controller shall reimburse Processor for the costs arising from this assistance.

Sub-Processors. Processor shall be entitled to engage sub-Processors to fulfill Processor’s obligations defined in the Agreement only with Controller’s written consent. For these purposes, Controller consents to the engagement as sub-Processors of Processor’s affiliated companies and the third parties listed in Appendix 2. For the avoidance of doubt, the above authorization constitutes Controller’s prior written consent to the sub-Processing by Processor for purposes of Clause 11 of the Standard Contractual Clauses.

If the Processor intends to instruct sub-Processors other than the companies listed in Appendix 2, the Processor will notify the Controller thereof in writing (email to the email address(es) on record in Processor’s account information for Controller is sufficient) and will give the Controller the opportunity to object to the engagement of the new sub-Processors within 30 days after being notified. The objection must be based on reasonable grounds (e.g. if the Controller proves that significant risks for the protection of its Personal Data exist at the sub-Processor). If the Processor and Controller are unable to resolve such objection, either party may terminate the Agreement by providing written notice to the other party. Controller shall receive a refund of any prepaid but unused fees for the period following the effective date of termination.

Where Processor engages sub-Processors, Processor will enter into a contract with the sub-Processor that imposes on the sub-Processor the same obligations that apply to Processor under this DPA. Where the sub-Processor fails to fulfil its data protection obligations, Processor will remain liable to the Controller for the performance of such sub-Processors obligations.

Where a sub-Processor is engaged, the Controller must be granted the right to monitor and inspect the sub-Processor’s activities in accordance with this DPA and the Data Protection Law, including to obtain information from the Processor, upon written request, on the substance of the contract and the implementation of the data protection obligations under the sub-Processing contract, where necessary by inspecting the relevant contract documents.

The provisions of this Section 4 f shall mutually apply if the Processor engages a sub-Processor in a country outside the European Economic Area (“EEA”) not recognized by the European Commission as providing an adequate level of protection for personal data. If, in the performance of this DPA, Zapflow transfers any Personal Data to a sub-processor located outside of the EEA, Zapflow shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in place.

1. Data Transfers. Controller acknowledges and agrees that, relating to the performance of the services under the Agreement, Personal Data will be transferred to Zapflow Ltd in Finland and to sub-processors within the EEA.
2. Deletion or Retrieval of Personal Data. Other than to the extent required to comply with Data Protection Law, following termination or expiry of the Agreement or written request from the Controller, Processor will delete all Personal Data (including copies thereof) processed pursuant to this DPA. If Processor is unable to delete Personal Data for technical or other reasons, Processor will apply measures to ensure that Personal Data is blocked from any further Processing.

Controller shall, upon termination or expiration of the Agreement and by way of issuing an Instruction, stipulate, within a period set by Processor, the reasonable measures to return data or to delete stored data. Any additional cost arising relating to the return or deletion of Personal Data after the termination or expiration of the Agreement shall be borne by Controller.

Audits

Controller may, prior to the commencement of Processing, and at regular intervals thereafter, audit the technical and organizational measures taken by Processor. For such purpose, Controller may, e.g., a) obtain information from the Processor and b) upon reasonable and timely advance agreement, during regular business hours and without interrupting Processor’s business operations, conduct an on-site inspection of Processor’s business operations or have the same conducted by a qualified third party which shall not be a competitor of Processor.

Processor shall, upon Controller’s written request and within a reasonable period of time, provide Controller with information necessary for such audit, to the extent that such information is not a Processors trade secret, is within Processor’s control and Processor is not precluded from disclosing it by applicable law, a duty of confidentiality, or any other obligation owed to a third party. Processor shall have the right to limit access to certain business and security critical information and instead give a summary overview of such information. Any auditor conducting the audit shall executive a non-disclosure agreement binding all auditors as well as the companies they represent.

General provisions

The terms and conditions of Agreement shall apply to this DPA. In case of any conflict, this DPA shall take precedence over the regulations of the Agreement. Where individual provisions of this DPA are invalid or unenforceable, the validity and enforceability of the other provisions of this DPA shall not be affected. Effective 25 May 2018 Zapflow will process Personal Data in accordance with the GDPR requirements contained herein which are directly applicable to Zapflow's provision of the Subscription Services.