Snapshot 154368
Normalized text
Scripts and page chrome removed; this is what change detection compares.
DPA
Last updated: January 21, 2022
Data Processing Addendum
This Data Processing Addendum (“DPA”), including its Attachments and Appendices, forms part of the SaaS Services Agreement, Apideck’s Terms of Service available at https://compliance.apideck.com/ or other written or electronic agreement (the “Agreement”), including any written or electronic service orders, purchase orders or other order forms (each a “Service Order”) entered into between Apideck and Customer, pursuant to which Apideck provides the “Services” as defined in the Agreement.
The purpose of this DPA is to reflect the parties’ agreement with regard to the processing of Customer Personal Data. The parties agree to comply with this DPA with respect to any Customer Personal Data that Apideck may process in the course of providing the Services pursuant to the Agreement. This DPA shall not replace or supersede any data processing addendum or agreement executed by the parties prior to the DPA Effective Date without the prior written consent of the parties (electronically submitted consent acceptable).
This DPA will take effect on the DPA Effective Date and, notwithstanding expiry of the Term, will remain in effect until, and automatically expire upon, deletion of all Customer Data by Apideck as described in this DPA.
If the Customer entity entering into or accepting this DPA is neither a party to a Service Order nor the Agreement, this DPA is not valid and is not legally binding. Such an entity should request that the Customer entity that is a party to the Agreement executes this DPA.
By signing or accepting the Agreement or this DPA, Customer enters into this DPA as of the DPA Effective Date on behalf of itself and in the name and on behalf of its Covered Affiliates if and to the extent Apideck processes personal data for which such Covered Affiliates qualify as the controller. For the purposes of this DPA only, and except where indicated otherwise, the term "Customer" shall include Customer and its Covered Affiliates.
1. Definitions
1.1 Capitalized terms used but not defined in this DPA shall have the meaning given to them in the Agreement or applicable Data Protection Laws
“Affiliates” of a party is any entity (a) that the party Controls; (b) that the party is Controlled by; or (c) with which the party is under common Control, where “Control” means direct or indirect control of fifty percent (50%) or more of an entity’s voting interests (including by ownership).
“Apideck” means Apideck bv, a company incorporated in Belgium, with place of business at Kammenstraat 43 bus 301, 2000 Antwerp Belgium.
“Covered Affiliate” means any of Customer's Affiliate(s) which (a) is subject to the Data Protection Laws; and (b) is permitted to use the Services pursuant to the Agreement between Customer and Apideck, but has not signed its own Service Order with Apideck and is not a "Customer" as defined under the Agreement.
“Data Incidents” means a breach of Apideck’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data transmitted, stored or otherwise processed by Apideck. “Data Incidents” will not include unsuccessful attempts or activities that do not compromise the security of Customer Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.
"Data Protection Laws" means all applicable data protection and privacy laws and regulations, including EU/UK Data Protection Laws.
“DPA Effective Date” means, as applicable, (a) July 16, 2020 if Customer clicked to accept or the parties otherwise agreed to this DPA prior to or on such date; or (b) the date on which Customer clicked to accept or the parties otherwise agreed to this DPA, if such date is after July 16, 2020.
“EEA” means the European Economic Area.
“EU/UK Data Protection Laws” means: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (the "EU GDPR"); (ii) the EU GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 (the "UK GDPR"); (iii) the EU e-Privacy Directive (Directive 2002/58/EC); and (iv) any and all applicable national data protection laws made under, pursuant to or that apply in conjunction with any of (i), (ii) or (iii); in each case as may be amended or superseded from time to time.
"Restricted Transfer" means (i) where the EU GDPR applies, a transfer of personal data from the European Economic Area to a country outside of the European Economic Area which is not subject to an adequacy determination by the European Commission; and (ii) where the UK GDPR applies, a transfer of personal data from the United Kingdom to any other country which is not based on adequacy regulations pursuant to Section 17A of the United Kingdom Data Protection Act 2018.
“Security Documentation” means all documents and information made available by Apideck to demonstrate compliance by Apideck with its obligations under this DPA, including the Security Measures, Additional Security Information and any third-party certifications or audit reports, as applicable.
“Security Measures” means the technical and organizational safeguards adopted by Apideck applicable to the Services subscribed by Customer as described and made available at https://compliance.apideck.com/security or as otherwise made available by Apideck. The most recent Security Measures are attached to this DPA as Attachment 2.
“Standard Contractual Clauses” (i) where the EU GDPR applies, the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council ("EU SCCs"); and (ii) where the UK GDPR applies, standard data protection clauses adopted pursuant to or permitted under Article 46 of the UK GDPR ("UK SCCs").
“Sub-processor” means any third-party engaged by Apideck which processes Customer Data in order to provide parts of the Services as listed on https://compliance.apideck.com/subprocessors. Apideck bv acts as the data processor and other Affiliates of Apideck act as Sub-processors.
“Customer” means the Customer entity party to the Agreement.
“Customer Data” has the meaning given to it in the Agreement or, if no such meaning is given, means data submitted by or on behalf of Customer to the Services under the Customer’s Apideck account for Services.
“Customer Personal Data” means the personal data contained within Customer Data.
“Term” means the period from the DPA Effective Date until the end of Apideck’s provision of the Services, including, if applicable, any period during which provision of the Services may be suspended and any post-termination period during which Apideck may continue providing the Services for transitional purposes.
1.2. The terms “personal data”, “data subject”, “processing”, “controller”, “processor” and “supervisory authority” as used in this DPA have the meanings given in the EU/UK Data Protection Laws, and the terms “data importer” and “data exporter” have the meanings given in the Standard Contractual Clauses, in each case irrespective of whether other Data Protection Laws apply.
2. Personal Data Processing Terms
2.1. The parties agree that if the EU/UK Data Protection Laws apply to the processing of Customer Personal Data, the parties acknowledge and agree that:
2.1.1. With respect to Customer Personal Data, Customer is the controller (or, where Customer is instructing Apideck on behalf of a third party controller, a processor on behalf of that controller) and Apideck is either (i) the processor or, (ii) where Customer is a processor on behalf of a third party controller, Apideck shall be a sub-processor to Customer.
2.1.2. Apideck may engage Sub-processors pursuant to Section 7 (Sub-processors).
2.1.3. The subject-matter of the data processing covered by this DPA is the provision of the Services and the processing will be carried out for the duration of the Agreement or so long as Apideck is providing the Services. Attachment 1 of this DPA sets out the nature and purpose of the processing, the types of Customer Personal Data Apideck processes and the categories of data subjects whose Personal Data is processed.
2.1.4. Each party will comply with the obligations applicable to it under the EU/UK Data Protection Laws, including with respect to the processing of Customer Personal Data.
2.1.5. If Customer is a processor itself, Customer warrants to Apideck that Customer’s instructions and actions with respect to the Customer Personal Data, including its appointment of Apideck as a sub-processor, have been authorized by the relevant controller.
2.1.6. For the avoidance of doubt, Customer’s instructions to Apideck for the processing of Customer Personal Data shall comply with all applicable laws, including the EU/UK Data Protection Laws. As between Apideck and Customer, Customer shall be responsible for the Customer Data and the means by which Customer acquired Customer Data, and shall maintain such authorizations and all other approvals, consents and registrations as are required to carry out lawful personal data processing activities under Data Protection Laws.
2.1.7. For the purposes of this DPA, the following is deemed an instruction by Customer to process Customer Personal Data (a) to provide the Services; (b) as further specified via Customer’s use of the Services (including the Services’ user interface dashboard and other functionality of the Services); (c) as documented in the Agreement (including this DPA and any Service Order that requires processing of Customer Personal Data); and (d) as further documented in any other written instructions given by Customer (which may be specific instructions or instructions of a general nature as set out in this DPA, the Agreement or as otherwise notified by Customer to Apideck from time to time), where such instructions are consistent with the terms of the Agreement.
2.1.8. When Apideck processes Customer Personal Data in the course of providing the Services, Apideck will:
2.1.8.1. Process the Customer Personal Data only in accordance with (a) the Agreement and (b) Customer’s instructions as described in Section 2.1.7, unless Apideck is required to process Customer Personal Data for any other purpose by UK, European Union or member state law to which Apideck is subject. Apideck shall inform Customer of this requirement before processing unless prohibited by applicable laws on important grounds of public interest.
2.1.8.2. Notify Customer without undue delay if, in Apideck's opinion, an instruction for the processing of Customer Personal Data given by Customer infringes applicable EU/UK Data Protection Laws.
2.2. The parties acknowledge and agree that the parties will comply with all applicable laws with respect to the processing of Customer Personal Data.
3. Data Security
3.1. Security Measures
3.1.1. Apideck will implement and maintain appropriate technical and organizational measures designed to protect or secure (i) Customer Data, including Customer Personal Data, against unauthorized or unlawful processing and against accidental or unlawful loss, destruction or alteration or damage, unauthorized disclosure of, or access to, Customer Data, and (ii) the confidentiality and integrity of Customer Data, as set forth in the Security Measures. Apideck may update or modify the Security Measures from time to time provided that such updates and modifications will not materially decrease the overall security of the Services. The most up to date Security Measures will be made available at https://compliance.apideck.com/security.
3.1.2. In addition to the Security Measures, Apideck will, from time to time, make additional security guidelines available that provide Customer with information about, in Apideck’s opinion, best practices for securing, accessing and using Customer Data including best practices for password and credentials protection (“Additional Security Information”).
3.1.3. Apideck will take reasonable steps to ensure the reliability and competence of Apideck personnel engaged in the processing of Customer Personal Data.
3.1.4. Apideck will take appropriate steps to ensure that all Apideck personnel engaged in the processing of Customer Personal Data (i) comply with the Security Measures to the extent applicable to their scope of performance, (ii) are informed of the confidential nature of the Customer Personal Data, (iii) have received appropriate training on their responsibilities, and (iv) have executed written confidentiality agreements. Apideck shall ensure that such confidentiality obligations survive the termination of the personnel engagement.
3.2. Data Incidents
3.2.1. If Apideck becomes aware of a Data Incident, Apideck will: (a) notify Customer of the Data Incident without undue delay after becoming aware of the Data Incident; and (b) promptly take reasonable steps to minimize harm and secure Customer Data.
3.2.2. Notifications made pursuant to this section will describe, to the extent possible, details of the Data Incident, including steps taken to mitigate the potential risks and, as applicable, steps Apideck recommends Customer to take to address the Data Incident.
3.2.3. Notification(s) of any Data Incident(s) will be delivered to Customer at Apideck’s discretion, by direct communication (for example, by email, phone call or an in-person meeting). Customer is solely responsible for ensuring that any contact information, including notification email address, provided to Apideck is current and valid.
3.2.4. Apideck will not assess the contents of Customer Data in order to identify information subject to any specific legal requirements. Customer is solely responsible for complying with incident notification laws applicable to Customer and fulfilling any third-party notification obligations related to any Data Incident(s).
3.2.5. Apideck’s notification of or response to a Data Incident under this Section 3.2 (Data Incidents) will not be construed as an acknowledgement by Apideck of any fault or liability with respect to the Data Incident.
3.3. Customer’s Security Responsibilities and Assessment of Apideck
3.3.1. Customer agrees that, without prejudice to Apideck’s obligations under Section 3.1 (Security Measures) and Section 3.2 (Data Incidents):
3.3.1.1. Customer is solely responsible for its use of the Services, including: (i) making appropriate use of the Services and any Additional Security Information to ensure a level of security appropriate to the risk in respect of the Customer Data; (ii) securing the account authentication credentials, systems and devices Customer uses to access the Services; and (iii) backing up the Customer Data; and
3.3.1.2. Apideck has no obligation to protect Customer Data that Customer elects to store or transfer outside of Apideck’s and its Sub-processors’ systems (for example, offline or on- premises storage).
3.3.2. Customer is solely responsible for reviewing the Security Measures and evaluating for itself whether the Services, the Security Measures, the Additional Security Information and Apideck’s commitments under this Section 3 (Data Security) will meet Customer’s needs, including with respect to any security obligations of Customer under the Data Protection Laws. Customer acknowledges and agrees that the Security Measures implemented and maintained by Apideck as set out in Section 3.1 (Security Measures) provide a level of security appropriate to the risk in respect of the Customer Data.
3.4. Customer Assessment and Audit of Apideck Compliance
Upon Customer’s written request, at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, Apideck will make available to Customer that is not a competitor of Apideck (or Customer’s independent, third-party auditor that is not a competitor of Apideck) information regarding Apideck’s compliance with the obligations set forth in this DPA including in the form of independent audit results and/or third-party certifications, as applicable, to the extent Apideck makes them generally available to its Customers. The most recent independent third-party certifications or audits obtained by Apideck are set forth in the Security Measures.
3.5. Customer’s Audit Rights
3.5.1. No more than once per year, Customer may contact Apideck to request an on-site audit of the procedures relevant to the protection of Customer Data. Customer shall reimburse Apideck for any time expended for any such on-site audit. Before the commencement of any such on-site audit, Customer and Apideck shall mutually agree upon the scope, timing, and duration of the audit, that reasonably does not interfere with normal business operations, in addition to the reimbursement rate for which Customer shall be responsible. All reimbursement rates shall be reasonable, taking into account the resources expended by Apideck. Customer shall promptly notify Apideck with information regarding any non-compliance discovered during the course of an audit.
3.5.2. Customer may conduct such on-site audit (a) itself, (b) through an Affiliate that is not a competitor of Apideck or (c) through an independent, third-party auditor that is not a competitor of Apideck.
3.5.3. Customer may also conduct an audit to verify Apideck’s compliance with its obligations under this DPA by reviewing the Security Documentation.
4. Return or Deletion of Customer Data
4.1. Apideck will enable Customer to delete during the Term Customer Data in a manner consistent with the functionality of the Services. If Customer uses the Services to delete any Customer Data during the Term and that Customer Data cannot be recovered by Customer, this use will constitute an instruction to Apideck to delete the relevant Customer Data from Apideck’s systems in accordance with applicable law. Apideck will comply with this instruction as soon as reasonably practicable within a maximum of 90 days, unless UK, European Union or member state law requires storage.
4.2. Upon expiry of the Term or upon Customer’s written request, subject to the terms of the Agreement, Apideck shall either (a) return (to the extent such data has not been deleted by Customer from the Services) or (b) securely delete Customer Data, to the extent allowed by applicable law, in accordance with the timeframes specified in Section 4.3, as applicable.
4.3. Apideck will, after a recovery period of up to 30 days following expiry of the Term, comply with this instruction as soon as reasonably practicable and within a maximum period of 90 days, unless UK, European Union or member state law requires storage. Without prejudice to Section 5 (Data Subject Rights; Data Export), Customer acknowledges and agrees that Customer will be responsible for exporting, before the Term expires, any Customer Data it wishes to retain afterwards.
5. Data Subject Rights; Data Export
5.1. As of the DPA Effective Date for the duration of the period Apideck provides the Services:
5.1.1. Apideck will, in a manner consistent with the functionality of the Services, enable Customer to access, rectify and restrict processing of Customer Data, including via the deletion functionality provided by Apideck as described in Section 4 (Return or Deletion of Customer Data), and to export Customer Data;
5.1.2. Apideck will, without undue delay, notify Customer, to the extent legally permitted, if Apideck receives a request from a data subject to exercise the data subject's right of access, right to rectification, restriction of processing, erasure, data portability, objection to the processing, or its right not to be subject to an automated individual decision making (“Data Subject Request”); and
5.1.3. if Apideck receives any request from a data subject in relation to Customer Personal Data, Apideck will advise the data subject to submit his or her request to Customer and Customer will be responsible for responding to any such request including, where necessary, by using the functionality of the Services.
5.1.4. Taking into account the nature of the processing, Apideck will assist Customer by appropriate technical and organizational measures, insofar as it is possible, for the fulfilment of Customer’s obligation to respond to a Data Subject Request under EU/UK Data Protection Laws. In addition, to the extent Customer, in its use of the Services, does not have the ability to address a Data Subject Request, Apideck shall, upon Customer’s written request, provide Customer with reasonable cooperation and assistance to facilitate Customer’s response to such Data Subject Request, to the extent Apideck is legally permitted to do so and the response to such Data Subject Request is required under EU/UK Data Protection Laws. To the extent legally permitted, Customer shall be responsible for any costs arising from Apideck’s provision of such assistance.
6. Data Protection Impact Assessment
Upon Customer's written request, Apideck will provide Customer with reasonable cooperation and assistance needed to fulfill Customer's obligation under the GDPR to carry out a data protection impact assessment related to Customer's use of the Services, to the extent Customer does not otherwise have access to the relevant information, and to the extent such information is available to Apideck. Apideck will provide reasonable assistance to Customer in the cooperation or prior consultation with the applicable data protection authority in the performance of its tasks relating to this Section 6 (Data Protection Impact Assessment) to the extent required under EU/UK Data Protection Laws.
7. Sub-processors
7.1. Customer specifically authorizes the engagement of Apideck’s Affiliates as Sub-processors. In addition, Customer acknowledges and agrees that Apideck and Apideck’s Affiliates respectively may engage third-party Sub-processors in connection with the provision of the Services. Apideck or an Apideck Affiliate has entered into a written agreement with each Sub-processor containing data protection obligations not less protective than those in this Agreement with respect to the protection of Customer Data to the extent applicable to the nature of the Services provided by such Sub-processor.
7.2. Apideck will make available to Customer the current list of Sub-processors for the Services at https://compliance.apideck.com/subprocessors (“Infrastructure and Sub-processor List”). Apideck shall provide notification of a new Sub-processor(s) before authorizing any new Sub-processor(s) to process Customer Personal Data in connection with the provision of the Services either by sending an email or via the user interface dashboard of the Services.
7.3. Customer may object to Apideck’s use of a new Sub-processor by notifying Apideck promptly in writing within ten (10) business days after receipt of Apideck’s notice. In the event Customer objects to a new Sub-processor, as permitted in the preceding sentence, Apideck will use reasonable efforts to make available to Customer a change in the Services or recommend a commercially reasonable change to Customer’s configuration or use of the Services to avoid processing of Customer Personal Data by the objected-to new Sub-processor without unreasonably burdening the Customer. If Apideck is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may terminate the applicable Service Order(s) with respect to only those Services which cannot be provided by Apideck without the use of the objected-to new Sub-processor by providing written notice to Apideck. Apideck will refund Customer any prepaid but unused fees covering the remainder of the term of such Service Order following the effective date of termination with respect to such terminated Services, without imposing a penalty for such termination on Customer.
7.4. Apideck shall be liable for the acts and omissions of its Sub-processors to the same extent Apideck would be liable if performing the services of each Sub-processor directly under the terms of this DPA subject to the limitations set forth in Section 10 (Limitation of Liability) and the Agreement.
8. Covered Affiliates
8.1. The parties acknowledge and agree that, by executing the Agreement, the Customer enters into the DPA on behalf of itself and, as applicable, in the name and on behalf of its Covered Affiliates, thereby establishing a separate DPA between Apideck and each such Covered Affiliate subject to the provisions of the Agreement, this Section 8 (Covered Affiliates) and Section 10 (Limitation of Liability). Each Covered Affiliate agrees to be bound by the obligations under this DPA and, to the extent applicable, the Agreement. For the avoidance of doubt, a Covered Affiliate is not and does not become a party to the Agreement, and is only a party to the DPA. All access to and use of the Services by Covered Affiliates must comply with the terms and conditions of the Agreement and any violation of the terms and conditions of the Agreement by a Covered Affiliate shall be deemed a violation by Customer.
8.2. Customer that is the contracting party to the Agreement shall remain responsible for coordinating all communication with Apideck under this DPA and be entitled to make and receive any communication in relation to this DPA on behalf of its Covered Affiliates.
8.3. Where a Covered Affiliate becomes a party to the DPA with Apideck, it shall, to the extent required under applicable Data Protection Laws, be entitled to exercise the rights and seek remedies under this DPA, subject to the following:
8.3.1. Except where applicable Data Protection Laws require the Covered Affiliate to exercise a right or seek any remedy under this DPA against Apideck directly by itself, the parties agree that (a) solely Customer that is the contracting party to the Agreement shall exercise any such right or seek any such remedy on behalf of the Covered Affiliate, and (b) Customer that is the contracting party to the Agreement shall exercise any such rights under this DPA not separately for each Covered Affiliate individually but in a combined manner for all of its Covered Affiliates together (as set forth, for example, in Section 8.3.2 below).
8.3.2. The parties agree that Customer that is the contracting party to the Agreement shall, when carrying out an on-site audit of the procedures relevant to the protection of Customer Personal Data, take all reasonable measures to limit any impact on Apideck and its Sub-processors by combining, to the extent reasonably possible, several audit requests carried out on behalf of different Covered Affiliates in one single audit.
9. Restricted Transfers
9.1. The parties agree that when the transfer of Customer Personal Data from Customer to Apideck is a Restricted Transfer, it shall be subject to the appropriate Standard Contractual Clauses, as follows:
9.1.1. In relation to Customer Personal Data that is protected by the EU GDPR, the EU SCCs will apply as follows:
9.1.1.1. Module Two will apply to the extent that Customer is a controller of the Customer Personal Data, and Module Three will apply to the extent that Customer is a processor of the Customer Personal Data on behalf of a third party controller;
9.1.1.2. In Clause 7, the optional docking clause will apply;
9.1.1.3. In Clause 9, Option 2 will apply, and the time period for prior notice of Sub- processor changes shall be as set out in Clause 7 of this DPA;
9.1.1.4. In Clause 11, the optional language will not apply;
9.1.1.5. In Clause 17, Option 1 will apply, and the EU SCCs will be governed by Belgian law;
9.1.1.6. In Clause 18(b), disputes shall be resolved before the courts of Belgium;
9.1.1.7. Annex I of the EU SCCs shall be deemed completed with (as to Part A) information set out in the Agreement with Customer as controller (or processor) and Apideck as processor (or sub-processor), (as to Part B) with the information set out in Attachment 1 to this DPA and (as to Part C) with the supervisory authority set out in Attachment 1 to this DPA;
9.1.1.8. Annex II of the EU SCCs shall be deemed completed with the information set out in Attachment 2 to this DPA;
9.1.1.9. Annex III of the EU SCCs shall not apply (Clause 9(a), Option 2).
9.1.2. In relation to Customer Personal Data that is protected by the UK GDPR, the UK SCCs will apply completed as follows:
9.1.2.1. For as long as it is lawfully permitted to rely on standard contractual clauses for the transfer of personal data to processors set out in the European Decision 2010/87/EU of 5 February 2010 (“Prior C2P SCCs”) for transfers of personal data from the United Kingdom, the Prior C2P SCCs shall apply between the Customer which, where Customer is a processor on behalf of a third party controller, it enters into on behalf of that controller and Apideck, on the following basis:
(A) Appendix 1 shall be completed with the relevant information set out in Attachment 1 to this DPA;
(B) Appendix 2 shall be completed with the relevant information set out in Attachment 2 to this DPA; and
(C) the optional illustrative indemnification Clause will not apply.
9.1.2.2. Where subsection 9.1.2.1 above does not apply, but the Customer and Apideck are lawfully permitted to rely on the EU SCCs for transfers of personal data from the United Kingdom subject to completion of a "UK Addendum to the EU Standard Contractual Clauses" ("UK Addendum") issued by the Information Commissioner's Office under s.119A(1) of the Data Protection Act 2018, then:
(A) The EU SCCs, completed as set out above in Section 9.1.1 of this DPA shall also apply to transfers of such Customer Personal Data, subject to sub- section (B) below;
(B) The UK Addendum shall be deemed executed between the transferring Customer and Apideck, and the EU SCCs shall be deemed amended as specified by the UK Addendum in respect of the transfer of such Customer Personal Data.
9.1.2.3. If neither subsection 9.1.2.1 or subsection 9.1.2.2 applies, then the Customer and Apideck shall cooperate in good faith to implement appropriate safeguards for transfers of such Customer Personal Data as required or permitted by the UK GDPR without undue delay.
9.1.3. If any provision of this DPA contradicts, directly or indirectly, the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.
9.2. With respect to onward transfers, Apideck shall not participate in (nor permit any Sub-processor to participate in) any other Restricted Transfers of Customer Personal Data (whether as an exporter or an importer of the Customer Personal Data) unless the Restricted Transfer is made in full compliance with applicable Data Protection Laws and pursuant to Standard Contractual Clauses implemented between the relevant exporter and importer of the Customer Personal Data.
10. Limitation of Liability
10.1. Each party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to this DPA (including the Standard Contractual Clauses, if the Standard Contractual Clauses have been entered into in accordance with the Agreement or a DPA), and all DPAs (including the Standard Contractual Clauses, if the Standard Contractual Clauses have been entered into in accordance with the Agreement or a DPA) between Covered Affiliates and Apideck, whether in contract, tort or under any other theory of liability, is subject to the “Limitation of Liability” section of the Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and all DPAs together.
10.2. For the avoidance of doubt, Apideck's and its Affiliates’ total liability for all claims from the Customer and all of its Covered Affiliates arising out of or related to the Agreement and each DPA (including the Standard Contractual Clauses, if the Standard Contractual Clauses have been entered into in accordance with the Agreement or a DPA) shall apply in the aggregate for all claims under both the Agreement and all DPAs (including the Standard Contractual Clauses, if the Standard Contractual Clauses have been entered into in accordance with the Agreement or a DPA) established under this Agreement, including by Customer and all Covered Affiliates, and, in particular, shall not be understood to apply individually and severally to Customer and/or to any Covered Affiliate that is a contractual party to any such DPA.
10.3. For the avoidance of doubt, each reference to the DPA in this DPA means this DPA including its Attachments and Appendices (including the Standard Contractual Clauses, if the Standard Contractual Clauses have been entered into in accordance with the Agreement or this DPA).
11. Effect of this DPA
Notwithstanding anything to the contrary in the Agreement, to the extent of any conflict or inconsistency between this DPA and the remaining terms of the Agreement, this DPA will govern.
The parties’ authorized signatories have duly executed this Data Processing Agreement as of the date set forth below their respective signatures but made effective as of the DPA Effective Date.
Attachment 1 To The Data Processing Addendum
Description of Processing Activities
The parties acknowledge that Apideck’s processing of personal data will include all personal data submitted or uploaded to the Services by Customer from time to time, for the purpose of, or otherwise in connection with, Apideck providing the Services to Customer. Set out below are descriptions of the processing/transfers of personal data as contemplated as of the date of this DPA. Such descriptions are subject to change or may be supplemented from time to time to reflect new products, features or functionality comprised within the Services. Apideck will update relevant documentation to reflect such changes.
Categories of data subjects whose personal data is transferred
Data subjects include the individuals about whom personal data is provided to Apideck via the Services by (or at the direction of) Customer or by Customer’s end users, the extent of which is determined and controlled by the Customer in its sole discretion, and which may include but is not limited to personal data relating to the following categories of data subjects:
Service Administrators a. Employees or contractors of Customer, Customer’s Affiliates, customers, business partners and vendors having access to the Apideck application (who are natural persons) b. Agents, advisors, freelancers of Customer having access to the Apideck application (who are natural persons)
Customer’s End Users a. Customer’s users interacting with the Services (who are natural persons) (“End Users”)
Categories of personal data transferred
Personal data relating to individuals provided to Apideck via the Services, by (or at the direction of) Customer or by Customer’s end users, the extent of which is determined and controlled by Customer in its sole discretion, and which may include but is not limited to personal data relating to the following categories of data:
First, Middle and Last Name
Title or Position
Employer
Personal and Business Contact Information (company, email, physical address, phone number)
Network connection data
IP address
Location of request (as indicated in IP address)
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions, keeping a record of access to the data, restrictions for onward transfers or additional security measures
Customer may submit special categories of data to the Service as a part of its Customer Data, the extent of which is determined and controlled by Customer in its sole discretion, and which is for the sake of clarity personal data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data, and the processing of data concerning health or sex life.
Security measures are made available at https://compliance.apideck.com/security
The frequency of the transfer
Continuous
Nature of the processing
Apideck provides services related to application integration based on a SaaS model, accessible through a web interface and/or API.
Purpose(s) of the data transfer and further processing
The purpose of the data processing under this DPA is the provision of Apideck Services to the Customer and the performance of Apideck's obligations under the Agreement or as otherwise agreed by the parties.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
Until 90 days after termination and expiry of the Agreement. Personal Data is purged from Apideck’s systems on a rolling 90-day period, starting the day after termination, with the latest collected data being purged on day 90.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Where Apideck engages Processors (or Sub-processors) it will do so in compliance with the terms of any applicable Standard Contractual Clauses. The subject matter, nature and duration of the Processing activities carried out by the Processor (or Sub-processor) will not exceed the subject matter, nature and duration of the Processing activities as described in this Attachment. The list of approved Sub-processors is available at https://compliance.apideck.com/subprocessors.
Supervisory Authority
The supervisory authority of Belgium shall act as competent supervisory authority.
Not a customer yet?
Apideck enables you to set up your own ecosystem in minutes instead of months of development time.
Get started!