Snapshot 149220
Normalized text
Scripts and page chrome removed; this is what change detection compares.
CARTO Personal Data Processing Agreement v. 20220228.pdf
DownloadCtrl+D
DetailsD
PrintCtrl+P
Show
Comments
Zoom
FindCtrl+F
Send feedback to Google
Report abuse
Keyboard shortcutsCtrl+/
Page
/2
Approve
Reject
View Details
Request a review
Learn more
Signature pending
Sign
Reject
View details
Review
Not Spam
Remove forever
Not Spam
{"id": "1r2KUG6goW2eIG8W6_llryYWB_MRxN26G", "title": "CARTO Personal Data Processing Agreement v. 20220228.pdf", "mimeType": "application\/pdf"}
Page 1 of 2
Last updated: February 28, 2022
CARTO Personal Data Processing Agreement
This CARTO Personal Data Processing Agreement (“PDPA”) supplements the CARTO Platform Terms and Conditions (“Agreement”) set forth in
the applicable Order Form between CartoDB Inc. (“CARTO” or “Processor”) and the customer identified on the applicable Order Form (“Customer”
or “Controller”), (together, the “Parties”).
The PDPA reflects Customer’s agreement with respect to CARTO’s Processing of Personal Data provided by Customer in accordance with the
requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016 (the “GDPR”). To the extent that the
terms of this PDPA are inconsistent with the Agreement or applicable Order Form, this PDPA shall control as it pertains to the Processing of
Personal Data. Any references to the Agreement will be construed as including this PDPA. All capitalized terms not defined in this PDPA will have
the meanings set forth in the Agreement.
Personal Data Processing Terms
“Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one
who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an
online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural
person.
“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by
automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure
by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“Controller” means the natural or legal person, which, alone or jointly with others, determines the purposes and means of the processing of
personal data.
“Processor” means a natural or legal person which processes personal data on behalf of the Controller.
“Subprocessor” means a processor engaged by the Processor to Process Personal Data controlled by the Controller.
The Parties
1. Customer is the Controller of any Personal Data in Customer Content.
2. CARTO is the Processor of such Personal Data, Processing it only on documented instructions from the Controller, including with
regard to transfers of Personal Data to countries outside the European Economic Area (“EEA”) or to international organizations, unless
required to do so by Union or Member State law to which the processor is subject, in which case it is obliged to inform the Controller.
3. Customer and CARTO agree to the terms and conditions contained in this PDPA in order to comply with the provisions of the GDPR.
Terms and Conditions
A. Processing
1. In its performance of the Agreement CARTO may have access to Personal Data of which Customer is the Controller.
2. CARTO’s purpose for processing any Personal Data of which Customer is the Controller is the provision of Services as
defined in the Agreement.
3. The Personal Data of which Customer is the Controller and that CARTO may process as a Processor is varied and may
include geolocation, among other types of Personal Data.
4. The categories of data subjects whose personal data is transferred are the employees, consultants, contractors, and agents
(i) who are authorized by data exporter to access and use the Services under the rights granted to data exporter pursuant to
the Master Services Agreement and (ii) for whom access to the Services has been purchased thereunder (each such
employee, consultant, contractor, or agent, an “Authorized User”).
5. CARTO has adopted technical and organizational measures appropriate to the type of Personal Data to be processed and to
the purposes and risks of the Processing, and has implemented measures by design and default to ensure the protection of
the rights of the Data Subject.
6. CARTO will not use any Personal Data Customer controls and which CARTO processes on Customer’s behalf for purposes
other than those described in this PDPA, nor will it share the Personal Data with third parties, unless Customer has
authorized such transmission. In the event CARTO uses the data for different purposes, it will be considered a controller in
accordance with the provisions of applicable regulations.
7. CARTO will, insofar as possible, assist Customer with its obligation to respond to requests for exercising Data Subject’s
rights.
8. Taking into account the nature of the Processing and the information available to CARTO, CARTO will assist Customer with
ensuring compliance with the obligations laid out in GDPR Articles 32 to 36.
B. Duty of Confidentiality
1. CARTO is committed to protecting the confidentiality of Customer’s Personal Data subject to Processing under the
Agreement, and to maintaining the absolute confidentiality of any Personal Data that may be known to CARTO at the time the
Services are provided. CARTO commits to extending these obligations to all personnel who have authorization to process the
Personal Data of which Customer is the Controller.
C. Data Transfers
1. This Section C shall apply to processing by CARTO or its subprocessors of any Personal Data subject to the GDPR.
2. If Customer transfers any Personal Data outside the EEA—other than to a territory recognized under applicable data
protection laws as providing adequate protection for personal data—for processing by CARTO, the Parties agree that the
Standard Contractual Clauses, available at https://carto.com/legal/scc-c2p and incorporated into and made subject to this
Page 2 of 2
PDPA by this reference, will apply with respect to that processing. CARTO will comply with the obligations of the “data
importer,” and Customer will comply with the obligations of the “data exporter.”
3. The contract that regulates the relationship between CARTO and existing or future Subprocessors shall provide sufficient
guarantees regarding the application of appropriate technical and organizational measures, and shall impose the same data
protection obligations as set out in this PDPA and in the Agreement between Customer and CARTO.
4. CARTO shall be fully liable for any acts or omissions of its Subprocessors with respect to their Personal Data protection
obligations to the same extent it would be liable if directly performing the services of each Subprocessor under the terms of
this PDPA, except as otherwise set forth in the Agreement.
D. Audits
1. CARTO shall allow for and contribute to audits or inspections conducted by Customer—or which are conducted by an
authorized auditor of Customer’s choice—as reasonably required by Customer to ensure that CARTO is complying with its
obligations under this PDPA or the GDPR.
2. Prior to any audit or inspection Customer or the authorized auditor of Customer’s choice will sign a nondisclosure agreement
acceptable to CARTO in order to respect the confidentiality of CARTO’s business and commercial interests, and to respect
the confidentiality of third-party data and information of which Customer or the authorized auditor of its choice may become
aware in the course of undertaking any audit or inspection.
3. CARTO shall make available to Customer all information necessary to demonstrate compliance with the obligations laid down
in this PDPA or the GDPR.
4. In the event Customer requests or conducts an audit or inspection, Customer will bear its own costs in relation to it. Customer
agrees to reimburse CARTO for any services rendered at its then-current, reasonable professional services rates.
5. CARTO agrees to come to a mutual understanding with Customer on the timing, scope, security controls, confidentiality
requirements, and duration of any audit or inspection.
E. Elimination of Personal Data
1. Once the existing contractual relationship between the Parties has concluded, Personal Data will be deleted or returned to
Customer at its discretion, eliminating as many copies of the same as exist.
2. The above applies unless any European Union or Member State law requires the storage of the Personal Data.
F. Duration
1. The duration of the processing of Personal Data to be carried out by CARTO is determined by the Service Term.
Displaying CARTO Personal Data Processing Agreement v. 20220228.pdf.