Snapshot 16578
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Refresh to view the mobile styleguide 📱
Data Processing Agreement
Details scope and purpose of processing (EU GDPR/UK GDPR)
BETWEEN
ZERO HEIGHT LIMITED incorporated and registered in England and Wales with company number 09604946 whose registered office is at Suite 230, 372 Old Street, London, United Kingdom, EC1V 9LT ("we" "our" "us" "zeroheight")
and
you ("Customer")
1. BACKGROUND
1.1. zeroheight agreed to provide access to its platform subject to the terms of the relevant plan (the "Agreement").
1.2. This data processing agreement ("DPA") is between zeroheight and Customer (each a "party" and collectively the "parties"), pursuant to (and subject to the terms of) the Agreement.
1.3. In the event that we process any Authorised User Data or Personal Content of individuals located in the UK, EEA or Switzerland, or of any Customer who is established in the UK, EEA or Switzerland, this DPA forms part of the Agreement and applies to the processing of Authorised User Data or Personal Content. In the event of a conflict between any of the provisions of this DPA and the provisions of the Agreement, the provisions of this DPA shall prevail.
2. DEFINITIONS
2.1. Capitalised terms used but not defined herein, shall have the respective meanings given to them in the Agreement.
Defined Terms
“personal data”, “data subject”, “processing”, “controller”, “data controller”, “processor”, “data processor” and “supervisory authority” shall have the respective meaning given to them in the UK GDPR or EU GDPR (as applicable), and in the event of a conflict between between these terms, the broadest definition in any circumstance shall apply.
Adequacy Decision
a decision adopted by a competent authority declaring that a jurisdiction meets an adequate level of protection of personal data.
Analytics Data
Authorised User Data collected by or supplied to zeroheight for the purpose of delivering the Service, including account administration, for which zeroheight is or becomes an entity which separately determines the purpose and means of processing such data.
Authorised User
an employee, agent or independent contractor of Customer who is (subject to the Plan) authorised by Customer to use the Services.
Authorised User Data
"personal data" that we process on behalf of Customer in relation to each Authorised User in connection with your use of the Services.
Data Protection Laws
UK Data Protection Legislation and any other European Union legislation (including EU GDPR) relating to personal data and all other legislation and regulatory requirements in force from time to time which apply to a party relating to the use of personal data (including, without limitation, the privacy of electronic communications).
EEA
the Member States of the European Union together with Iceland, Norway, and Liechtenstein.
EU GDPR
the General Data Protection Regulation ((EU) 2016/679), as it has effect in EU law.
EU SCCs
the Standard Contractual Clauses (EEA) approved by European Commission Decision 2021/914 on 4 June 2021.
Ex EEA Transfer
the export of personal data to a country or territory outside the EEA other than a country or territory ensuring an adequate level of protection of personal data as determined by the European Commission.
Ex UK Transfer
the export of personal data to a country or territory outside the UK and such transfer is not governed by an adequacy decision made by the Secretary of State in the UK in accordance with the relevant provisions of the UK GDPR and the Data Protection Act 2018.
Lawful Safeguard
legally enforceable mechanism(s) for Ex EEA Transfers and/or Ex UK Transfers as may be permitted under all applicable Data Protection Laws from time to time.
Personal Content
personal data that is not Authorised User Data contained in Customer Content we process on behalf of Customer in connection with Customer's use of the Services.
Security Incident
any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, any Authorised User Data or Personal Content.
Services
as defined in the Agreement.
Sub-processor
any sub-processor engaged by us who agrees to process Authorised User Data or Personal Content on behalf of Customer.
UK SCCs
UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, Version B1.0, in force from March 21, 2022.
UK Data Protection Legislation
all applicable data protection and privacy legislation in force from time to time in the UK including without limitation the UK GDPR; the Data Protection Act 2018 (and regulations made thereunder) (DPA 2018); the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended.
UK GDPR
has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018.
3. DATA PROCESSING
3.1 Customer as Controller. Customer and zeroheight acknowledge that for the purpose of Data Protection Laws, where Customer uses the Service and makes decisions about the personal data being processed via the Service, Customer is controller and zeroheight is processor.
3.2 zeroheight as Controller. We may in some circumstances be the controller of Analytics Data (for example when monitoring usage on our Service), which may or may not constitute personal data for the purpose of Data Protection Laws. Situations where we may act as controller are further set out in our privacy policy.
3.3 Customer Compliance. Customer shall at all times comply with applicable Data Protection Laws, including providing any required notices and relevant consents for the processing instructions it gives to us. Customer shall ensure all instructions it gives in relation to personal data are in compliance with Data Protection Laws. Nothing in the Agreement or this DPA relieves Customer of any responsibilities or liabilities under Data Protection Laws.
3.4 Nature and Purpose of Processing. Annex A describes the subject matter, duration, nature and purpose of processing and the personal data categories and data subject types in respect of which we may process personal data in order to provide the Service and fulfil our obligations under the Agreement.
3.5 Instructions for Data Processing.
(a) We will only process Authorised User Data and Personal Content in accordance with Customer’s written instructions, unless processing is required by applicable law, in which case we shall inform Customer of that legal requirement prior to processing (unless legally prohibited from doing so). The Agreement and this DPA shall be Customer’s complete and final instructions to us in relation to the processing of such data (unless otherwise agreed in writing).
(b) We will comply with Customer's written instructions requiring us to amend, transfer, delete or otherwise process Authorised User Data/Personal Content, or to stop, mitigate or remedy any unauthorised processing, unless legally prohibited from doing so.
(c) We will notify Customer if, in our opinion, Customer’s instruction would not comply with Data Protection Law (unless legally prohibited from doing so). Where such processing is non-compliant, we shall be entitled to pause the Services until the parties have agreed appropriate amended instructions which are no longer infringing.
3.6 Additional processing. Processing outside the scope of this DPA or the Agreement will require prior written agreement between Customer and us on additional instructions for processing.
3.7 Required consents. Where required by applicable Data Protection Laws, Customer will ensure that it has obtained/will obtain all necessary consents and supplied data subjects with all relevant notices for the processing of Authorised User Data/Personal Content by us in accordance with the Agreement.
4. TRANSFER OF PERSONAL DATA
4.1 Authorised Sub-processors. Customer agrees that we may use the Sub-processors set out in Annex B (as updated from time-to-time) to fulfil our contractual obligations under the Agreement.
(a) We shall not permit, allow or otherwise facilitate Sub-processors to process Authorised User Data/Personal Content unless we enter into a written agreement with the Sub-processor which imposes substantially similar obligations on the Sub-processor with regard to their processing of Authorised User Data/Personal Content as are imposed on us under this DPA.
(b) We shall notify Customer from time to time of the identity of any Sub-processors we engage.
(c) If Customer (acting reasonably) does not approve of a new Sub-processor, then without prejudice to any right to terminate the Agreement, Customer may request that we move the Authorised User Data/Personal Content to another Sub-processor and shall (within a reasonable period of time following receipt of such request) use all reasonable endeavours to ensure that the relevant Sub-processor does not process any further Authorised User Data/Personal Content.
4.2 Liability of Sub-processors. We will at all times remain responsible for compliance with our obligations under the DPA and will be liable to Customer for the acts and omissions of any Sub-processor approved by Customer as if they were our acts and omissions.
4.3 Transfers of personal data outside the UK/EEA/Switzerland.
(a) If Customer transfers personal data to zeroheight from the European Economic Area (EEA), Switzerland, or the United Kingdom (UK), the parties will automatically apply one of the following "Lawful Safeguards" as required (in the following order of precedence):
(i) an Adequacy Decision;
(ii) any mechanism, derogation, exemption, or exception that the parties are able to invoke, such as the consent of the relevant data subjects or a derogation under Article 49 of the GDPR;
(iii) a successor program to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks, if any, to the extent the data importer participates; or
(iv) the applicable EU SCCs and/or UK SCCs pursuant to Annex D.
(b) Without prejudice to the generality of the foregoing, Customer agrees to the transfer of personal data to Sub-processors outside of the UK or EEA pursuant to clause 4.3(a) and as further set out in Annex B or as otherwise notified to Customer by zeroheight pursuant to clause 4.1 above.
5. DATA SECURITY, AUDITS AND SECURITY NOTIFICATIONS
5.1 Security Obligations. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures set out at Annex C.
5.2 Compliance. Upon request by Customer, we will make available all information reasonably necessary to demonstrate compliance with this DPA and with the obligations imposed on us by Article 28 of GDPR.
5.3 Audit. We will permit Customer and its third-party representatives to audit our compliance (on giving 30 days written notice) with our obligations during the term of the Agreement. We will give Customer and its third-party representatives only such assistance as is necessary to conduct such audits.
5.4 Security Incident Notification. If we or our Sub-processors become aware of a Security Incident we will: (a) notify Customer of the Security Incident within 72 hours; (b) investigate the Security Incident and provide such reasonable assistance to Customer (and any law enforcement or regulatory official) as required to investigate the Security Incident; and (c) take steps to remedy any non-compliance with this DPA.
5.5 Employees and Personnel. We will treat the Authorised User Data/Personal Content as Confidential Information of Customer, and shall ensure that any employees or other personnel have agreed in writing to protect the confidentiality and security of Authorised User Data/Personal Content.
5.6 Assistance. At Customer's expense, we will provide reasonable assistance in meeting Customer's compliance obligations under Data Protection Laws, taking into account the nature of our processing and the information available to us, including in relation to data subject rights, data protection impact assessments and reporting to and consulting with relevant data protection authorities.
6. ACCESS REQUESTS AND DATA SUBJECT RIGHTS
6.1 Data Subject Requests. Save as required or where prohibited (as applicable) under applicable law, we will notify Customer of any request received by us or any Sub-processor from a data subject in respect of personal data included in the Authorised User Data/Personal Content, and will not respond to the data Subject. Customer shall be solely responsible for responding substantively to any such data subject Request or communications involving personal data.
6.2 Changes. We will provide Customer with the ability to correct, delete, block, access or copy the Authorised User Data/Personal Content in accordance with the functionality of the Service.
6.3 Disclosure. We will maintain the confidentiality of Authorised User Data/Personal Content and will not disclose such data to third parties unless Customer or the Agreement specifically authorises such disclosure, or as required by domestic law, court or regulator (including the Commissioner). If a domestic law, court or regulator (including the Commissioner) requires us to process or disclose personal data to a third party, we must first inform Customer of such legal or regulatory requirement and give Customer an opportunity to object or challenge the requirement, unless we are legally prohibited from giving such notice.
6.4 Data Subject Rights. Where applicable, and taking into account the nature of the processing, we will use all reasonable endeavours to assist Customer by implementing any other appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to requests for exercising data subject rights.
7. DATA RETURN AND DESTRUCTION
7.1 Return. At Customer's request and expense, we will give Customer a copy of all or part of the personal data in its possession in our standard format.
7.2 Deletion/Destruction. Following termination of the Agreement for any reason or expiry of its term, we will (within a reasonable period of time) securely delete or destroy, or, if directed in writing by Customer, return and not retain, all or any of the personal data related to the Agreement of which Customer is controller.
7.3. zeroheight as controller. Notwithstanding the foregoing, we shall not be obligated to delete any Analytics Data or other data that becomes integrated into our product and services or our own systems or databases, during or after the Agreement, due to such data either not being personal data pursuant to the GDPR or zeroheight becoming an entity that separately determines the purposes and means of processing of such data and thus being responsible for its own compliance with applicable Data Protection Laws. Each party is responsible for compliance with applicable Data Protection Laws regarding processing any personal data that it retains after termination of the Agreement.
8. DATA PROTECTION IMPACT ASSESSMENT AND PRIOR CONSULTATION
8.1 To the extent required under applicable Data Protection Laws, we will provide reasonable assistance to Customer (at Customer's expense) with any data protection impact assessments and with any prior consultations to any supervisory authority of Customer, in each case solely in relation to processing of Authorised User Data/Personal Content and taking into account the nature of the processing and information available to us.
9. TERM AND TERMINATION
9.1 This DPA will remain in full force and effect: (i) so long as the Agreement remains in effect; or (i) until the return or secure deletion or disposal of the last of the Authorised User Data and/or Personal Content in our (or any of our Sub-Processor’s) possession or control in accordance with this DPA, at which point this DPA will terminate with immediate effect.
9.3 On termination of this DPA, howsoever caused, we will immediately cease Processing Authorised User Data/Personal Content.
10. LIABILITY
10.1 When acting as separate controllers (or where the parties are deemed to be joint controllers) of any personal data hereunder, each party shall only be liable for its own breach of applicable Data Protection Laws or of this DPA and shall not be jointly and/or severally liable with the other party for the other party’s breach.
In all other cases, zeroheight’s total aggregate liability towards Customer or any third party shall be subject to the cap on liability set forth in the Agreement.
ANNEX A
PERSONAL DATA PROCESSING PURPOSES AND DETAILS
Data exporter: Customer
Data importer: zeroheight
Subject matter of processing: In order to enable the provision of Service pursuant to the Agreement.
Duration of processing: For the duration of the Agreement, unless otherwise agreed in writing.
Nature of processing: Storage, transmission, analysis and use in order to provide the Service.
Business purpose: For the provision of Service, pursuant to the Agreement.
Personal data categories:
Authorised User Data
Personal Content uploaded to the platform by Authorised Users
Data subjects:
Authorised Users
Individuals identified in Personal Content
ANNEX B
View SUB-PROCESSORS
ANNEX C
TECHNICAL AND ORGANISATIONAL MEASURES
Introduction
We maintain internal policies and procedures, or procure that our Sub-processors do so, which are designed to:
a. secure any personal data processed by us against accidental or unlawful loss, access or disclosure;
b. identify internal risks to secure any unauthorised access to the personal data processed by us;
c. minimise security risks, including through risk assessment and regular testing.
We will conduct periodic reviews of the security of our network and the adequacy of our information security program as measured against industry security standards and our policies and procedures (including our security policy), and will use all practical efforts to procure that our Sub-processors do so as well.
We will periodically evaluate the security of our network and associated services to determine whether additional or different security measures are required to respond to new security risks or findings generated by the periodic reviews, and will use reasonable efforts to procure that our Sub-processors do so as well.
Access controls
We limit access to personal data by implementing appropriate access controls. These are based on the principle of least privilege, so access is only granted to those who need it. Access levels are reviewed on a regular basis.
Availability and back-up of personal data
We take regular backups of data to enable recovery of deleted data. Backups are stored separately and are fully encrypted.
Disposal of IT equipment
We have in place processes to securely remove all personal data before disposing of IT systems (for example, by using appropriate technology to purge equipment of data and/or destroying hard disks).
Encryption
We encrypt data both in transit and at rest (see our data Classification Policy for more details). We ensure it is encrypted at all points and use tooling to check for any unencrypted data.
Transmission or transport of personal data
We implement appropriate controls to ensure personal data is fully secured during transmission or transit.
Device security
We employ a number of tools to ensure that devices are fully secure, including mobile device management software. We enforce password complexity requirements as well as multi-factor authentication wherever possible to ensure all devices with access to zeroheight data are secure. Any default passwords that are provided are removed and not used.
Cloud security
Our cloud architecture is designed to ensure all data is processed and stored securely, and all personal data is safeguarded. We work to continuously improve the security of our cloud infrastructure and conduct regular audits. We also leverage a range of logging and intrusion detection tools to ensure data security.
Staff training and awareness
We carry out staff training on data security and privacy issues relevant to their job role and ensure that new starters receive appropriate training before they start their role.
Staff are subject to disciplinary measures for breaches of our policies and procedures relating to data privacy and security.
ANNEX D
Subject to Section 4.3 of this DPA, where there is an Ex-EU Transfer or an Ex-UK Transfer of personal data and the mechanisms referenced in Section 4.3(a) (i), (ii), or (iii) of this DPA do not apply, the parties shall comply with the EU SCCs or/ UK SCCs (as applicable) which, in the event that other data transfer mechanisms do not apply, shall be entered into and incorporated into this DPA as set out below.
I. Ex-EEA Transfers.
Where the transfer involves an Ex-EEA Transfer, such transfer shall be governed by the EU SCCs.
A. Controller-Processor
When the processing activities between the parties constitutes a Controller-Processor relationship, Module 2 of the EU SCCs shall automatically apply and shall be completed as follows:
All explanatory notes and footnotes deleted.
As the Ex-EEA Transfer is a controller to processor transfer, only the provisions relating to Module 2 apply to such ex-EEA Transfer, and the provisions relating only to Modules 1, 3 and 4 are deleted and shall not apply to such ex-EEA Transfer.
Clause 7 shall be included and the references to it being “optional” in the Clauses shall be deleted.
In respect of Clause 9 (sub-processors), Option 2 general written authorisation applies, and the minimum time period for the data importer to specifically inform the data exporter in writing of any intended changes to that list in accordance with Clause 9 shall be 14 days.
The “OPTION” in Clause 11(a) shall not apply and the wording in square brackets in that Clause shall be deleted.
In respect of Clause 13(a) (supervision), the following wording shall apply: The supervisory authority of one of the Member States in which the data subjects whose Personal Data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I C, shall act as competent supervisory authority.
In respect of Clause 17 (governing law), Option 1 shall apply and the Member State governing law shall be the law of Ireland.
viii. In respect of Clause 18 (choice of forum and jurisdiction), the relevant courts shall be the courts of Ireland.
ix. Annex III is completed with the information available at Annex B of this DPA and supplemented by clauses 4.1 and 4.2 of this DPA.
B. Controller-Controller
When the processing activities between the parties constitutes a Controller-Controller relationship, Module 1 of the EU SCCs shall automatically apply and shall be completed as follows:
All explanatory notes and footnotes deleted.
As the Ex-EEA Transfer is a controller to controller transfer, only the provisions relating to Module 1 apply to such ex-EEA Transfer, and the provisions relating only to Modules 2, 3 and 4 are deleted and shall not apply to such ex-EEA Transfer.
Clause 7 shall be included and the references to it being “optional” in the Clauses shall be deleted.
The “OPTION” in Clause 11(a) shall not apply and the wording in square brackets in that Clause shall be deleted.
In respect of Clause 13(a) (supervision), the following wording shall apply: The supervisory authority of one of the Member States in which the data subjects whose Personal Data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I C, shall act as competent supervisory authority.
In respect of Clause 17 (governing law), Option 1 shall apply and the Member State governing law shall be the law of Ireland.
In respect of Clause 18 (choice of forum and jurisdiction), the relevant courts shall be the courts of Ireland.
C. Processor-Processor
When the processing activities between the parties constitutes a Processor-Processor relationship, Module 3 of the EU SCCs shall automatically apply and shall be completed as follows:
All explanatory notes and footnotes deleted.
As the Ex-EEA Transfer is a processor to processor transfer, only the provisions relating to Module 3 apply to such ex-EEA Transfer, and the provisions relating only to Modules 1, 2 and 4 are deleted and shall not apply to such ex-EEA Transfer.
Clause 7 shall be included and the references to it being “optional” in the Clauses shall be deleted.
In respect of Clause 9 (sub-processors), Option 2 general written authorisation applies, and the minimum time period for the data importer to specifically inform the data exporter in writing of any intended changes to that list in accordance with Clause 9 shall be 14 days.
The “OPTION” in Clause 11(a) shall not apply and the wording in square brackets in that Clause shall be deleted.
In respect of Clause 13(a) (supervision), the following wording shall apply: The supervisory authority of one of the Member States in which the data subjects whose Personal Data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I C, shall act as competent supervisory authority.
In respect of Clause 17 (governing law), Option 1 shall apply and the Member State governing law shall be the law of Ireland.
In respect of Clause 18 (choice of forum and jurisdiction), the relevant courts shall be the courts of Ireland.
Annex III is completed with the information available at Annex B of this DPA and supplemented by clauses 4.1 and 4.2 of this DPA.
D. Appendix to the EU SCCs
In all cases, the Appendix to the EU SCCs shall be completed as follows:
Annex I (A) is completed as follows in accordance with the data flows between the parties:
Data Exporter – where Customer is the exporter, this shall be completed with the Customer details as set out in the Agreement; where zeroheight is the exporter, this shall be the zeroheight entity as defined in the Agreement.
Data Importer – where Customer is the importer, this shall be completed with the Customer details as set out in the Agreement; where zeroheight is the importer, this shall be the zeroheight entity as defined in the Agreement.
2. Annex I (B) is completed with the information set out at Annex A of this DPA.
3. Annex I (C) is the supervisory authority of one of the Member States in which the data subjects whose Personal Data is transferred under these Clauses in relation to the offering of goods or services to them.
4. Annex II is completed with the details set out at Annex C of this DPA.
E. Swiss Addendum to the EU SCCs
The parties agree that for transfers of Personal Data from Switzerland are subject exclusively to the Data Protection Laws and Regulations of Switzerland (“Swiss Data Protection Laws”), the terms of the EU SCCs shall be amended and supplemented as specified by the relevant guidance of the Swiss Federal Data Protection and Information Commissioner, and the following provisions shall apply:
General and specific references in the EU SCCs to GDPR, or EU or Member State Law, shall have the same meaning as the equivalent reference in Swiss Data Protection Laws.
In respect of data transfers governed by Swiss Data Protection Laws, the EU SCCs also apply to the transfer of information relating to an identified or identifiable legal entity where such information is protected similarly as personal data under Swiss Data Protection Laws until such laws are amended to no longer apply to a legal entity.
Where the data exporter is established in Switzerland or falls within the territorial scope of application of Swiss Data Protection Laws and Regulations, the Swiss Federal Data Protection and Information Commissioner shall act as competent supervisory authority insofar as the relevant data transfer is governed by Swiss Data Protection Laws and Regulations.
In respect of disputes, the choice of forum and jurisdiction as set out in the EU SCCs shall apply. For data subjects habitually resident in Switzerland, the law and courts of Switzerland are an alternative place of jurisdiction.
II. Ex-UK Transfers.
Where the transfer involves an Ex-UK Transfer, such transfer shall be governed by the UK SCCs, which are completed as follows:
For the purposes of Part 1 – Tables:
For the purposes of Table 1 of the UK SCCs, the names of the parties, their roles and their details shall be set out as per the details stated in the Agreement.
For the purposes of Table 2 of the UK SCCs, the boxes shall be completed as follows:
England and Wales is ticked
England and Wales is ticked
Where the transfer is a controller to processor transfer: Exporter is controller and Importer is processor.
Where the transfer is a controller to controller transfer: Exporter is controller and Importer is controller.
Where the transfer is a processor to processor transfer: Exporter is processor and Importer is processor.
UK GDPR applies – this box is ticked.
The linked agreement is the Agreement and this DPA which complete this section.
The boxes related to Term are completed with clause 9 of this DPA and neither party may end the UK SCCs.
The boxes related to further transfers are completed with clause 4 and Annex B of this DPA. The Importer may transfer Transferred Data – this box is ticked.
The Parties will review the security requirements each time there is a change to the Transferred Data, Purposes, Importer Information, TRA or risk assessment - this box is ticked.
3. For the purposes of Table 3 and 4, the boxes are completed with Annex A and C of this DPA.
4. For the purposes of Part 2 – the “Extra Protection Clauses” section is completed with Annex C of this DPA.
5. For the purposes of Part 3 – the “Commercial Clauses” section is completed with this DPA and the Agreement.
6. All explanatory notes and guidance are deleted.