This Data Processing Agreement, including its annexes and the Standard Contractual Clauses, (“DPA”) forms a part of, and is hereby incorporated into your agreement with Leverege, Inc. (“Leverege”) that governs your access to the Software Products (the “Agreement”). All capitalized terms not defined in this DPA shall have the meaning set forth in the Agreement.

1. Definitions.

• “Affiliate” means an entity that directly or indirectly Controls, is Controlled by or is under common Control with an entity. “Control” means an ownership, voting or similar interest representing fifty percent (50%) or more of the total interests (as measured on a fully-diluted basis) then outstanding of the entity in question. The term “Controlled” will be construed accordingly.
• “Applicable Data Protection Laws” means data protection and privacy laws and regulations applicable to  Leverege's provision of the Software Products to its customers generally without regard to Customer’s particular use of the Software Products (except to the extent the obligation specified hereunder is Customer’s obligation, in which case such term shall include such laws specific to Customer’s particular uses), including, without limitation: (a) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (“EU GDPR”), (b) in respect of the UK, the EU GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (“UK GDPR”) and the Data Protection Act 2019 (together, “UK Data Protection Laws”), (c) the Swiss Federal Data Protection Act and its implementing regulations (“Swiss Data Protection Act”), and (d) the CCPA, in each case, as may be amended, superseded or replaced.
• “Authorized Affiliate” means a Customer Affiliate who is authorized under the Agreement to use the Software Products.
• “CCPA” means California Civil Code Sec. 1798.100 et seq. (also known as the California Consumer Privacy Act of 2018), as amended by the California Privacy Rights Act of 2020.
• “Customer Personal Data” means the personal data made available by Customer for processing by, or use within, the Software Products.
• “Europe” means for the purposes of this DPA the European Economic Area (“EEA”), United Kingdom (“UK”) and Switzerland.
• “GDPR” means, unless a specific version is indicated, all of the EU GDPR, the UK Data Protection Laws, and the Swiss Data Protection Act.
• “Security Breach” means a breach of Leverege’s obligation in Section 6.2 leading to any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data transmitted, stored or otherwise processed by Leverege. A Security Breach shall not include an unsuccessful Security Breach, which is one that results in no unauthorized access to Customer Personal Data or to any Leverege equipment or facilities storing the Customer Personal Data, and could include (without limitation) pings and other broadcast attacks of firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, packet sniffing (or other unauthorized access to traffic data that does not result in access beyond headers) or similar incidents.
• “Sensitive Data” means any unencrypted (i) bank, credit card or other financial account numbers or login credentials; (ii) social security, tax, driver’s license or other government-issued identification numbers; (iii) health information identifiable to a particular individual; (iv) information that could reasonably be used to determine the GPS location of a particular individual; or (v) any “special” or “sensitive” or other similar categories of data as those terms are defined according to the GDPR or any other Applicable Data Protection Laws. For the purposes of the prior sentence, “unencrypted” means a failure to utilize industry standard encryption methods to prevent Leverege, the Software Products, and Leverege’s personnel, including any subcontractors, from accessing the relevant data in unencrypted form.
• “Standard Contractual Clauses” or “SCCs” means: (i) where the EU GDPR applies, the standard contractual clauses annexed to the European Commission’s Implementing Decision 2021/914 of 4 June 2021 (“EU SCCs”); (ii) where the UK GDPR applies, the applicable standard data protection clauses for processors adopted pursuant to Article 46(2)(c) or (d) of the UK GDPR (“UK SCCs”); and (iii) where the Swiss Data Protection Act applies, the applicable standard data protection clauses issued, approved or recognized by the Swiss Federal Data Protection and Information Commissioner.
• “Subprocessor” means any third party engaged by Leverege (including any Leverege Affiliate but not including any Leverege employees, contractors or consultants) to process Customer Personal Data on behalf of Customer.
• “System” means any application, computing or storage device, or network.
• The terms “controller,” “data subject,” “supervisory authority”, “processor,” “process,” “processing,” and “personal data” have the meanings given to them in Applicable Data Protection Laws. The term controller includes ‘businesses’ (as defined in the CCPA), the term data subject includes ‘consumers’ (as defined in the CCPA), the term processor includes ‘service providers’ (as defined in the CCPA), and the term personal data includes ‘personal information’ (as defined in the CCPA) to the extent the rights and obligations in this DPA apply under the CCPA.

2. DATA PROCESSING.

2.1. Applicability.

This DPA, except as set forth in Section 2.5, applies only to the extent that Leverege processes Customer Personal Data on behalf of Customer as a processor or sub- processor in the course of providing access to the Software Products (including as described in Annex A of this DPA).

2.2. Party Roles.

As between the parties, Customer is either the controller or processor of Customer Personal Data and Leverege is the processor or sub-processor of Customer Personal Data.

2.3. Compliance with Laws.

Each party will comply with all laws, rules and regulations applicable to it in the exercise of its rights or performance of its obligations under the Agreement or this DPA, including Applicable Data Protection Laws. If Applicable Data Protection Laws and corresponding obligations related to the processing of personal data change, Leverege reserves the right to make any necessary amendments or modifications to the terms and conditions of this DPA, in good faith, in order to comply with any updated or superseded Applicable Data Protection Laws. Leverege will not ‘sell’ (as such term is defined in the CCPA) Customer Personal Data.

2.4. Instruction to Process.

• (a) Leverege shall process Customer Personal Data pursuant to Customer’s access to the Software Products in accordance with Customer’s documented lawful instructions as set forth in this DPA and the Agreement(s) and as otherwise necessary to provide the Software Products (together “Processing Instructions”). Additional instructions outside the scope of the Processing Instructions (if any) require prior written agreement between the parties. Customer shall ensure that its Processing Instructions comply with Applicable Data Protection Laws. Taking into account the nature of the processing, Customer agrees that it is unlikely Leverege can form an opinion on whether the Processing Instructions violate Applicable Data Protection Laws. If Leverege forms such an opinion, it shall, unless prohibited from doing so under applicable laws, inform Customer, in which case, Customer is entitled to withdraw or modify its Processing Instructions. Leverege may without penalty refuse further processing of personal data under this DPA that it believes to be in violation of any law or regulation, including any Applicable Data Protection Laws.
• (b) Where Customer is itself a processor of the Customer Personal Data acting on behalf of another third party controller (or on behalf of other intermediaries of the ultimate controller): (i) Customer represents and warrants to Leverege that the Processing Instructions and its actions with respect to Customer Personal Data, including its appointment of Leverege as a processor or sub-processor pursuant to this DPA, reflect and do not conflict with the instructions of such third parties; (ii) Customer agrees at Leverege’s request to serve as the sole point of contact for Leverege with regard to such third parties; (iii) Leverege need not interact directly with (including seeking authorizations directly from) any such third party (other than through the regular provision of the Software Products to the extent required by the Agreement); and (iv) where Leverege would (including for the purposes of the SCCs) otherwise be required to provide information, assistance, co-operation or anything else to such third party controller, Leverege may provide it solely to Customer as the sole point of contact. Notwithstanding the foregoing, Leverege shall be entitled to follow the instructions of such third party with respect to Customer Personal Data for which they are controller instead of Customer’s if Leverege reasonably believes this is legally required in the circumstances.
• (c) Taking into account the nature of the processing, Customer agrees that it is unlikely that Leverege would become aware that Customer Personal Data transferred under the Standard Contractual Clauses is inaccurate or outdated. Nonetheless, if Leverege becomes aware that Customer Personal Data transferred under the Standard Contractual Clauses is inaccurate or outdated, it will inform Customer without undue delay. Leverege provides certain controls and functionality within the Software Products to enable the Customer to correct Customer Personal Data that is inaccurate or outdated. It is Customer’s responsibility to make any necessary corrections.

2.5. Usage Data.

Leverege may collect Usage Data. Leverege shall process Usage Data in accordance with its obligations as a controller under Applicable Data Protection Laws. Notwithstanding the foregoing, Leverege will never share (other than with Subprocessors or third parties providing services to Leverege who agree to terms at least as restrictive regarding the processing of Usage Data as those set forth herein) or publicly make available any Usage Data that identifies Customer or its users, data subjects, or customers, nor use any Usage Data in a manner that derives its value from Customer Personal Data. Without limiting the foregoing, Leverege will not ‘sell’ (as such term is defined in the CCPA) any Usage Data that contains personal data subject to the CCPA.

2.6. Authorized Affiliates.

Leverege obligations set forth in this DPA shall also extend to Authorized Affiliates, subject to the following conditions:

• (a) Customer must exclusively communicate any additional Processing Instructions requested pursuant to Section 2.4 directly to Leverege, including instructions from its Authorized Affiliates;
• (b) Customer shall be responsible for Authorized Affiliates’ compliance with this DPA and all acts and/or omissions by an Authorized Affiliate with respect to Customer’s obligations in this DPA shall be considered the acts and/or omissions of Customer; and
• (c) Authorized Affiliates shall not bring a claim directly against Leverege. If an Authorized Affiliate seeks to assert a legal demand, action, suit, claim, proceeding or otherwise against Leverege (“Authorized Affiliate Claim”): (i) Customer must bring such Authorized Affiliate Claim directly against Leverege on behalf of such Authorized Affiliate, unless Applicable Data Protection Laws require the Authorized Affiliate be a party to such claim; and (ii) all Authorized Affiliate Claims shall be considered claims made by Customer and shall be subject to any liability restrictions set forth in the Agreement, including any aggregate limitation of liability.

3. SOFTWARE PRODUCTS ARCHITECTURE.

3.1. Shared Responsibility Deployment.

Certain components of the Software Products are under Customer’s control as further described in the Agreement. Each party shall be responsible for implementing appropriate technical and organizational security measures in order to protect Customer Content under its control, which for Leverege shall be the implementation of the Security Measures set forth in Section 6.3. Without limiting the foregoing, Customer acknowledges and agrees that it is responsible for (a) protecting the security of credentials used to access the Software Products; and (b) any security or other issues resulting from any Customer Content, and Customer expressly assumes the risks associated with the foregoing responsibilities.

3.2. Data Agnostic.

Customer solely chooses what Customer Content (including any Customer Personal Data) it processes in the Software Products. Customer acknowledges that Leverege will be generally unaware of the types of or details regarding the Customer Content processed within the Software Products.

3.3. Sensitive Data.

Customer will not provide or process Sensitive Data in the Software Products without Leverege’s prior written approval.

3.4. No Data Backup.

Leverege does not provide backup services or disaster recovery for Customer Content. It is Customer’s obligation to backup any Customer Content if desired.

4. SUBPROCESSING.

4.1. Authorization.

Customer grants a general authorization to Leverege and its Affiliates to appoint sub-processors, and a specific authorization to Leverege and its affiliates to appoint as sub-processors the entities listed at https://leverege.com/subprocessors (“Subprocessor List”), and for the sub-processing activities described thereon, as it may be updated from time to time. 

4.2. Leverege Subprocessor Obligations.

Leverege (a) shall enter into a written agreement with its Subprocessors which includes data protection and security measures no less protective of Customer Personal Data than the Agreement and this DPA and (b) remains fully liable for any breach of this DPA or the Agreement that is caused by an act, error or omission of such Subprocessor to the extent Leverege would have been liable for such act, error or omission had it been caused by Leverege.

4.3. Subprocessor Changes.

Leverege reserves the right to update its Subprocessor List from time to time to add new Subprocessors and remove Subprocessor who no longer provide services. To the extent a Customer has subscribed to receive notices of any changes to Leverege’s Subprocessor List, Leverege shall use its commercially reasonable efforts to notify such Customer via electronic mail of such updated Subprocessor List.

4.4. Subprocessor Objections.

Customer may reasonably object on data protection grounds to Leverege’s use of a new Subprocessor by notifying Leverege in writing within 10 calendar days after notice has been provided by Leverege. In the event of Customer’s timely objection on such reasonable grounds relating to data protection, Leverege will either: (i) work with Customer to address Customer’s objections to its reasonable satisfaction; (b) instruct the Subprocessor to not process Customer Content (including any Customer Personal Data); provided that Customer acknowledges this may result in new or improved Software Prodcuts features not being available to Customer; or (c) notify Customer of its option to terminate this DPA and the Agreement. Customer shall have 14 calendar days in which to exercise its option to terminate this DPA and the Agreement after receiving notice of a right to terminate. If Customer timely exercises its right to terminate the Agreement, Leverege will provide Customer with a pro rata reimbursement of any prepaid, but unused, fees as of the date Customer notifies Leverege of its choice to exercise such right.

4.5. Non-Leverege Services.

Customer acknowledges that any third party services (other than Subprocessors) that may be linked to or used within the Software Products and that Customer may choose to use at its option (“Non-Leverege Services”) are governed solely by the terms and conditions and privacy policies of such Non-Leverege Services. Leverege does not endorse, is not responsible or liable for, and makes no representations as to any aspect of such Non-Leverege Services, including, without limitation, their content or the manner in which they handle Customer Content (including Customer Personal Data) or any interaction between Customer and the provider of such Non-Leverege Services. Leverege is not liable for any damage or loss caused or alleged to be caused by or in connection with Customer’s enablement, access or use of any such Non-Leverege Services, or Customer’s reliance on the privacy practices, data security processes or other policies of such Non-Leverege Services. The providers of Non-Leverege Services shall not be deemed Subprocessors for any purpose under this DPA.

5. COOPERATION.

5.1. Data Subject Requests.

If Leverege receives a request from a data subject seeking to exercise their rights under Applicable Data Protection Laws that identifies Customer and relates to Customer Personal Data (“DSR”), Leverege shall promptly pass on such communication to Customer. Customer is responsible for responding to and complying with any DSR. The Software Products includes controls that Customer may use to assist it to respond to a DSR. If Customer is unable to access any relevant Customer Personal Data that is under  Leverege's control using such controls, Leverege shall, taking into account the nature of the processing, reasonably cooperate with Customer to enable Customer to respond to the DSR.

5.2. Government Inquiries.

If Leverege receives a subpoena, court order, warrant or other legal demand from law enforcement or public or judicial authorities seeking the disclosure of Customer Content, Leverege shall, to the extent permitted by applicable laws, promptly notify Customer in writing of such request and reasonably cooperate with Customer to limit, challenge or protect against such disclosure.

5.3. Assistance.

Leverege will (i) at Customer’s request and expense assist Customer to conduct a data protection impact assessment and, where legally required, consult with applicable data protection authorities; and (ii) respond to reasonable requests for additional information if necessary for Customer to demonstrate its compliance with Applicable Data Protection Laws.

6. DATA ACCESS.

6.1. Confidentiality.

Leverege shall ensure that any person it authorizes (including  Leverege's employees, contractors and Subprocessors) to process Customer Content is subject to a duty of confidentiality substantially as protective of Customer Content as this DPA and the Agreement.

6.2. Rights in Customer Personal Data.

Customer represents and warrants on behalf of itself and its employees that the Customer Personal Data provided to Leverege for processing under the Agreement and this DPA is collected and/or validly obtained and utilized by Customer and its employees in compliance with all Applicable Data Protection Laws, including without limitation the disclosure, informed affirmative consent and targeted advertising provisions of the CCPA, the EU GDPR, the UK GDPR and Swiss Data Protection Act, and Customer shall defend, indemnify and hold harmless Leverege from and against all loss, expense (including reasonable out-of-pocket attorneys’ fees and court costs), damage, or liability arising out of any claim arising out of a breach of this Section 6.2.

6.3. Security Measures.

Leverege will utilize commercially reasonable efforts to protect the security, confidentiality, and integrity of the Customer Personal Data transferred to the Software Products using reasonable administrative, physical, and technical safeguards. Notwithstanding the generality of the foregoing, Leverege shall: (a) not use or disclose Customer Personal Data for any purpose other than those purposes instructed or permitted by Customer; (b) only use and disclose Customer Personal Data in a manner and to the extent permitted in the Agreement and this DPA or as otherwise agreed between the Parties and observe all limitations as to such use or disclosure as Customer may notify to Leverege; (c) employ reasonable administrative, physical, and technical safeguards (including commercially reasonable safeguards against worms, Trojan horses, and other disabling or damaging codes) to afford protection of the Customer Personal Data in accordance with Applicable Data Protection Laws as would be appropriate based on the nature of the Customer Personal Data; (d) utilize commercially reasonable efforts to keep the Customer Personal Data reasonably secure and in an encrypted form, and use industry standard security practices and systems applicable to the use of Customer Personal Data to prevent, and take prompt and proper remedial action against unauthorized access, copying, modification, storage, reproduction, display, or distribution of Customer Personal Data; (e) cease to retain documents containing Customer Personal Data, or remove the means by which Customer Personal Data can be associated with particular individuals reasonably promptly after it is reasonable to assume that (i) the specified purposes are no longer being served by Leverege’s retention of Customer Personal Data, and (ii) retention is no longer necessary for legal or business purposes; and (iii) upon receiving a request from Customer to correct an error or omission in the Customer Personal Data about the individual that is in the possession or under the control of Leverege, correct the Customer Personal Data as soon as reasonably practicable.

7. SECURITY BREACH.

7.1. Breach Notifications.

In the event of a Security Breach, Leverege shall provide written notice to Customer without undue delay and in no event later than seventy-two (72) hours after becoming aware of the Security Breach and will provide updates to Customer, including the type of data affected and the identity of affected person(s) as soon as such information becomes known to Leverege. Leverege will reasonably cooperate with Customer as required to fulfill Customer’s obligations under Applicable Data Protection Laws. Leverege shall take measures and actions appropriate and reasonable to remedy or mitigate the effects of the Security Breach.

7.2. Communications.

The decision whether to provide notification, public/regulatory communication or a press release (each, a “Notification”) concerning the Security Breach shall be solely at Customer’s discretion, but the content of any Notification that names Leverege or from which  Leverege's identity could reasonably be determined shall be, except as otherwise required by applicable laws, subject to the prior approval of Leverege, which approval shall not be unreasonably withheld, conditioned or delayed, and provided that conditioning of the Notification on Leverege's approval shall not prevent Customer from complying with Applicable Data Protection Laws.

8. AUDITS.

Within thirty (30) days of Customer’s written request, and no more than once annually and subject to the confidentiality obligations set forth in the Agreement (unless such information is reasonably required to be disclosed as a response to a data subject’s inquiries under Applicable Data Protection Laws), Leverege shall make available to Customer (or a mutually agreed upon third-party auditor) information regarding Leverege’s compliance with the obligations set forth in this DPA, including reasonable documentation. An NDA may be required to receive this information.

9. TRANSFER MECHANISM.

9.1. Transfers of EU Personal Data.

Customer acknowledges and agrees that Leverege is located in the United States and that Customer’s provision of Customer Personal Data from the European Economic Area, Switzerland, and/or the United Kingdom (“EU”) to Leverege for processing is a transfer of Personal Data to the United States. All transfers of Customer Personal Data out of the EU (“EU Personal Data”) to the United States shall be governed by the Standard Contractual Clauses. The terms of the Standard Contractual Clauses, together with Appendices 1 and 2 set out in Annex C to this DPA, are incorporated in this DPA by this reference solely as required with respect to EU Personal Data for the services provided by Leverege for Customer under the Agreement.

9.2. Alternative Transfer Mechanism.

To the extent that Leverege adopts an alternative data export mechanism (including any new version of or successor to the Standard Contractual Clauses adopted pursuant to Applicable Data Protection Laws (“Alternative Transfer Mechanism”)), the Alternative Transfer Mechanism shall automatically apply instead of any applicable transfer mechanism described in this DPA (but only to the extent such Alternative Transfer Mechanism complies with Applicable Data Protection Laws applicable to Europe and extends to territories to which Customer Personal Data is transferred).

10. DELETION & RETURN.

Subject to the terms of the Agreement, Leverege will delete Customer Content from the Software Products when Customer sends an instruction to delete. Additionally, upon Customer’s written request upon termination or expiration of the Agreement, Leverege will delete or assist Customer in deleting any Customer Content contained therein within 30 days. Leverege may retain Customer Content where permitted by applicable law. In such event, Leverege will (a) to the extent practical, isolate such data; and (b) protect such data from any further processing, except to the extent permitted by applicable law.

11. GENERAL.

11.1. Replace Existing Agreements.

The parties agree that this DPA shall replace any existing data processing agreement, attachment, exhibit or standard contractual clauses that the parties may have previously entered into in connection with the Software Products.

11.2. Third Parties.

In no event shall this DPA benefit or create any right or cause of action on behalf of a third party (including a third party controller), but without prejudice to the rights or remedies available to data subjects under Applicable Data Protection Laws or this DPA (including the SCCs).

11.3. Validity.

If any part of this DPA is held unenforceable, the validity of all remaining parts will not be affected.

11.4. Conflicts.

In the event of any conflict between this DPA and any data privacy provisions set out in any agreements between the parties relating to the Software Products, the parties agree that the terms of this DPA shall prevail, provided that if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA, the Standard Contractual Clauses control and take precedence. 

11.5. Limitation of Liability.

Notwithstanding anything to the contrary in the Agreement or this DPA and to the maximum extent permitted by law, each party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to this DPA (including all exhibits and annexes hereto), the SCCs or any data protection agreements in connection with the Agreement (if any), whether in contract, tort or under any other theory of liability, shall remain subject to the limitation of liability section of the Agreement and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and this DPA, including all exhibits and annexes hereto. Customer agrees that any regulatory penalties incurred by Leverege that arise in connection with Customer’s failure to comply with its obligations under this DPA or any laws or regulations including Applicable Data Protection Laws shall reduce  Leverege's liability under the Agreement as if such penalties were liabilities to Customer under the Agreement.

11.6. Governing Jurisdiction.

This DPA will be governed by and construed in accordance with the governing law and jurisdiction provisions in the Agreement, unless required otherwise by Applicable Data Protection Laws.

11.7. Survival.

The obligations placed upon each party under this DPA and the Standard Contractual Clauses shall survive so long as Leverege processes Customer Personal Data on behalf of Customer.

‍

ANNEX A: DESCRIPTION OF THE PROCESSING / TRANSFER

• Data exporter: The entity identified as the “Customer” in the Agreement and this DPA.
• Data importer: The data importer is Leverege, LLC (“Leverege”).
• Categories of Data Subjects whose personal data is transferred: Data exporter may submit Customer Personal Data to Leverege, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to Customer Personal Data relating to the following categories of data subjects: the data exporter’s representatives and end-users including employees, contractors, business partners, collaborators, and customers of the data exporter. Data subjects may also include individuals attempting to communicate or transfer Customer Personal Data to users of the Software Products.
• Categories of personal data transferred: Data exporter may submit Customer Personal Data to Leverege, the extent of which is determined and controlled by the data exporter in its sole discretion, and which may include, but is not limited to the following categories of Customer Personal Data: (a) First and last name; (b) Title; (c) Position; (d) Employer; (e) Contact information (company, email, phone, physical business address); (f) Connection data; and (g) other data in an electronic form used by Customer in the context of the Software Products.
• Special categories of data (if appropriate): None
• Processing operations: The objective of the processing of Customer Personal Data by data importer is the performance of the contractual services related to the Agreement with the data exporter. The processes may include collection, storage, retrieval, consultation, use, erasure or destruction, disclosure by transmission, dissemination, or otherwise making available data exporter’s data as necessary to provide access to the Software Products in accordance with the data exporter’s instructions, including related internal purposes (such as quality control, troubleshooting, product development, etc.)

ANNEX B: STANDARD CONTRACTUAL CLAUSES

SECTION I

Clause 1: Purpose and scope

• (a) The purpose of these Standard Contractual Clauses (the Clauses) is to ensure compliance with Article 29(3) and (4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.
• (b) The controllers and processors listed in Annex I have agreed to these Clauses in order to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 and/or Article 29 (3) and (4) Regulation (EU) 2018/1725.
• (c) These Clauses apply to the processing of personal data as specified in Annex II.
• (d) Annexes I to IV are an integral part of the Clauses.
• (e) These Clauses are without prejudice to obligations to which the controller is subject by virtue of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.
• (f) These Clauses do not by themselves ensure compliance with obligations related to international transfers in accordance with Chapter V of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

Clause 2: Invariability of the Clauses

• (a) The Parties undertake not to modify the Clauses, except for adding information to the Annexes or updating information in them.
• (b) This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a broader contract, or from adding other clauses or additional safeguards provided that they do not directly or indirectly contradict  the Clauses or detract from the fundamental rights or freedoms of data subjects.

Clause 3: Interpretation

• (a) Where these Clauses use the terms defined in Regulation (EU) 2016/679 or Regulation (EU) 2018/1725 respectively, those terms shall have the same meaning as in that Regulation.
• (b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679 or Regulation (EU) 2018/1725 respectively.
• (c) These Clauses shall not be interpreted in a way that runs counter to the rights and obligations provided for in Regulation (EU) 2016/679 / Regulation (EU) 2018/1725 or in a way that prejudices the fundamental rights or freedoms of the data subjects.

Clause 4: Hierarchy

In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties existing at the time when these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 5: Docking clause

• (a) Any entity that is not a Party to these Clauses may, with the agreement of all the Parties, accede to these Clauses at any time as a controller or a processor by completing the Annexes and signing Annex I.
• (b) Once the Annexes in (a) are completed and signed, the acceding entity shall be treated as a Party to these Clauses and have the rights and obligations of a controller or a processor, in accordance with its designation in Annex I.
• (c) The acceding entity shall have no rights or obligations resulting from these Clauses from the period prior to becoming a Party.

SECTION II – OBLIGATIONS OF THE PARTIES

Clause 6: Description of processing(s)

The details of the processing operations, in particular the categories of personal data and the purposes of processing for which the personal data is processed on behalf of the controller, are specified in Annex II.

Clause 7: Obligations of the Parties

7.1. Instructions

• (a) The processor shall process personal data only on documented instructions from the controller, unless required to do so by Union or Member State law to which the processor is subject. In this case, the processor shall inform the controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. Subsequent instructions may also be given by the controller throughout the duration of the processing of personal data. These instructions shall always be documented.
• (b) The processor shall immediately inform the controller if, in the processor’s opinion, instructions given by the controller infringe Regulation (EU) 2016/679 / Regulation (EU) 2018/1725 or the applicable Union or Member State data protection provisions.

7.2. Purpose limitation

The processor shall process the personal data only for the specific purpose(s) of the processing, as set out in Annex II, unless it receives further instructions from the controller.

7.3. Duration of the processing of personal data

Processing by the processor shall only take place for the duration specified in Annex II.

7.4. Security of processing

• (a) The processor shall at least implement the technical and organisational measures specified in Annex III to ensure the security of the personal data. This includes protecting the data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to the data (personal data breach). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks involved for the data subjects.
• (b) The processor shall grant access to the personal data undergoing processing to members of its personnel only to the extent strictly necessary for implementing, managing and monitoring of the contract. The processor shall ensure that persons authorised to process the personal data received have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

7.5. Sensitive data

If the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (“sensitive data”), the processor shall apply specific restrictions and/or additional safeguards.

7.6 Documentation and compliance

• (a) The Parties shall be able to demonstrate compliance with these Clauses.
• (b) The processor shall deal promptly and adequately with inquiries from the controller about the processing of data in accordance with these Clauses. 
• (c) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations that are set out in these Clauses and stem directly from Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725. At the controller’s request, the processor shall also permit and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. In deciding on a review or an audit, the controller may take into account relevant certifications held by the processor.
• (d) The controller may choose to conduct the audit by itself or mandate an independent auditor. Audits may also include inspections at the premises or physical facilities of the processor and shall, where appropriate, be carried out with reasonable notice.
• (e) The Parties shall make the information referred to in this Clause, including the results of any audits, available to the competent supervisory authority/ies on request.

7.7. Use of sub-processors

• (a) The processor has the controller’s general authorisation for the engagement of sub-processors from an agreed list. The processor shall specifically inform in writing the controller of any intended changes of that list through the addition or replacement of sub-processors, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned sub-processor(s). The processor shall provide the controller with the information necessary to enable the controller to exercise the right to object.
• (b) Where the processor engages a sub-processor for carrying out specific processing activities (on behalf of the controller), it shall do so by way of a contract which imposes on the sub-processor, in substance, the same data protection obligations as the ones imposed on the data processor in accordance with these Clauses. The processor shall ensure that the sub-processor complies with the obligations to which the processor is subject pursuant to these Clauses and to Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.
• (c) At the controller’s request, the processor shall provide a copy of such a sub-processor agreement and any subsequent amendments to the controller. To the extent necessary to protect business secret or other confidential information, including personal data, the processor may redact the text of the agreement prior to sharing the copy.
• (d) The processor shall remain fully responsible to the controller for the performance of the sub-processor’s obligations in accordance with its contract with the processor. The processor shall notify the controller of any failure by the sub-processor to fulfill its contractual obligations.
• (e) The processor shall agree a third party beneficiary clause with the sub-processor whereby - in the event the processor has factually disappeared, ceased to exist in law or has become insolvent - the controller shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.

7.8. International transfers

• (a) Any transfer of data to a third country or an international organisation by the processor shall be done only on the basis of documented instructions from the controller or in order to fulfil a specific requirement under Union or Member State law to which the processor is subject and shall take place in compliance with Chapter V of Regulation (EU) 2016/679 or Regulation (EU) 2018/1725.
• (b) The controller agrees that where the processor engages a sub-processor in accordance with Clause 7.7. for carrying out specific processing activities (on behalf of the controller) and those processing activities involve a transfer of personal data within the meaning of Chapter V of Regulation (EU) 2016/679, the processor and the sub-processor can ensure compliance with Chapter V of Regulation (EU) 2016/679 by using standard contractual clauses adopted by the Commission in accordance with of Article 46(2) of Regulation (EU) 2016/679, provided the conditions for the use of those standard contractual clauses are met.

Clause 8: Assistance to the controller

• (a) The processor shall promptly notify the controller of any request it has received from the data subject. It shall not respond to the request itself, unless authorised to do so by the controller.
• (b) The processor shall assist the controller in fulfilling its obligations to respond to data subjects’ requests to exercise their rights, taking into account the nature of the processing. In fulfilling its obligations in accordance with (a) and (b), the processor shall comply with the controller’s instructions
• (c) In addition to the processor’s obligation to assist the controller pursuant to Clause 8(b), the processor shall furthermore assist the controller in ensuring compliance with the following obligations, taking into account the nature of the data processing and the information available to the processor:

• (i) the obligation to carry out an assessment of the impact of the envisaged processing operations on the protection of personal data (a ‘data protection impact assessment’) where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons;
• (ii) the obligation to consult the competent supervisory authority/ies prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk;
• (iii) the obligation to ensure that personal data is accurate and up to date, by informing the controller without delay if the processor becomes aware that the personal data it is processing is inaccurate or has become outdated;
• (iv) the obligations in Articles 33, 36 to 38 Regulation (EU) 2018/1725.

• (d) The Parties shall set out in Annex III the appropriate technical and organisational measures by which the processor is required to assist the controller in the application of this Clause as well as the scope and the extent of the assistance required.

Clause 9: Notification of personal data breach

In the event of a personal data breach, the processor shall cooperate with and assist the controller for the controller to comply with its obligations under Articles 33 and 34 Regulation (EU) 2016/679 or under Articles 34 and 35 Regulation (EU) 2018/1725, where applicable, taking into account the nature of processing and the information available to the processor.

9.1 Data breach concerning data processed by the controller

In the event of a personal data breach concerning data processed by the controller, the processor shall assist the controller:

• (a) in notifying the personal data breach to the competent supervisory authority/ies, without undue delay after the controller has become aware of it, where relevant/(unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons);
• (b) in obtaining the following information which, pursuant toArticle 34(3) Regulation (EU) 2018/1725, shall be stated in the controller’s notification, and must at least include:  

• (i) the nature of the personal data including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
• (ii) the likely consequences of the personal data breach; 
• (iii) the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
  
  Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

• (c) in complying, pursuant to Article 35 Regulation (EU) 2018/1725, with the obligation to communicate without undue delay the personal data breach to the data subject, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.

9.2 Data breach concerning data processed by the processor

In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller without undue delay after the processor having become aware of the breach. Such notification shall contain, at least:

• (a) a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned);
• (b) the details of a contact point where more information concerning the personal data breach can be obtained;
• (c) its likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate its possible adverse effects.

Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.

The Parties shall set out in Annex III all other elements to be provided by the processor when assisting the controller in the compliance with the controller’s obligations under Articles 34 and 35 of Regulation (EU) 2018/1725.

SECTION III – FINAL PROVISIONS

Clause 10: Non-compliance with the Clauses and termination

• (a) Without prejudice to any provisions of Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725, in the event that the processor is in breach of its obligations under these Clauses, the controller may instruct the processor to suspend the processing of personal data until the latter complies with these Clauses or the contract is terminated. The processor shall promptly inform the controller in case it is unable to comply with these Clauses, for whatever reason.
• (b) The controller shall be entitled to terminate the contract insofar as it concerns processing of personal data in accordance with these Clauses if:

• (i) the processing of personal data by the processor has been  suspended by the controller pursuant to point (a) and if compliance with these Clauses is not restored within a reasonable time and in any event within one month following suspension;
• (ii) the processor is in substantial or persistent breach of these Clauses or its obligations under Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725;
• (iii) the processor fails to comply with a binding decision of a competent court or the competent supervisory authority/ies regarding its obligations pursuant to these Clauses or to Regulation (EU) 2016/679 and/or Regulation (EU) 2018/1725.

• (c) The processor shall be entitled to terminate the  contract insofar as it concerns processing of personal data under these Clauses where, after having informed the controller that its instructions infringe applicable legal requirements in accordance with Clause 7.1 (b), the controller insists on compliance with the instructions.
• (d) Following termination of the contract, the processor shall, at the choice of the controller, delete all personal data processed on behalf of the controller and certify to the controller that it has done so, or, return all the personal data to the controller and delete existing copies unless Union or Member State law requires storage of the personal data. Until the data is deleted or returned, the processor shall continue to ensure compliance with these Clauses.

‍