Snapshot 220391
Normalized text
Scripts and page chrome removed; this is what change detection compares.
D ATA PR OC E SSI N G A GR EE M E NT /A D D E N DUM (“D PA ”)
This DPA forms part of the ___________ (the “Agreement”) between Trustmi Network Ltd. (“Trustmi”) and
_______________, its parent company and affiliates (collectively, the “Client”). Both parties shall be referred to as the
“Parties” and each, a “Party”. The Parties agree as follows:
1. Definitions. For purposes of this DPA, defined terms shall have the meaning set forth in the GDPR. “Services” means
performance of the services and activities provided pursuant to or in connection with the Agreement previously entered
into between Trustmi and Client.
2. Roles of the Parties. With regard to the Processing of Personal Data, Client is the Data Controller and Trustmi is the Data
Processor. Trustmi will process Personal Data as necessary to perform the Services pursuant to the Agreement. The
duration, the nature and purposes of the Processing, as well as the types of Personal Data Processed and categories of Data
Subjects are further specified in Schedule 1 of this DPA
3. Client’s Instructions. Subject to the Agreement, Trustmi shall Process Personal Data only in accordance with Client’s
documented instructions, unless required to otherwise by Union or Member State law or any other applicable law to which
Trustmi and its affiliates are subject, in which case, Trustmi shall inform the Client of the legal requirement before
processing, unless that law prohibits such information on important grounds of public interest. Client’s instructions for
the processing of Personal Data shall comply at all times with the GDPR and any other applicable law. To the extent that
Trustmi or its affiliates cannot comply with a request (including, without limitation, any instruction) from Client and/or
its authorized users relating to Processing of Personal Data or where Trustmi considers such a request to be unlawful,
Trustmi (i) shall inform Client, providing relevant details of the problem, (ii) Trustmi may, without any kind of liability
towards Client, temporarily cease all Processing of the affected Personal Data (other than securely storing those data), and
(iii) if the Parties do not agree on a resolution to the issue in question and the costs thereof, each Party may, as its sole
remedy, terminate the Agreement, and Client shall pay to Trustmi all the amounts owed to Trustmi or due before the date
of termination.
4. Rights of Data Subject. If Trustmi receives a request from a Data Subject to exercise its rights under GDPR, Trustmi
shall, to the extent legally permitted, promptly notify and forward the request to Client. Trustmi shall use commercially
reasonable efforts to assist Client, insofar as this is possible, for the fulfilment of Client’s obligation to respond to a Data
Subject request under GDPR.
5. Assistance. Upon the Client’s request, Trustmi will use commercially reasonable efforts to assist Client, at Client’s cost,
in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR taking into account the nature of
the processing, the state of the art, the costs of implementation, the scope, the context, the purposes of the Processing and
the information available to Trustmi.
6. Trustmi personnel. Trustmi shall grant access to the Personal Data to persons under its authority (including, without
limitation, its personnel) only on a need to know basis and ensure that such persons have committed themselves to
confidentiality. For the avoidance of doubt, Trustmi may disclose and Process the Personal Data also (a) to the extent
required by a court of competent jurisdiction or other supervisory authority and/or otherwise as required by applicable
laws or GDPR, or (b) on a “need-to-know” basis under an obligation of confidentiality to legal counsel(s), data protection
advisor(s), and investors or potential acquirers.
7. Sub-processors. Client hereby approves Trustmi’s current list of sub-processors included in Schedule 2 (“Sub-processor
List”). Client may subscribe to notifications of new Sub-processors by sending an email to privacy@trustmi.ai [and if
Client subscribes, Trustmi shall provide notification of any new Sub-processor(s) in connection with the provision of the
Services. Client may reasonably object to Trustmi’s use of a new Sub-processor for reasons related to the GDPR by
notifying Trustmi promptly in writing within three (3) business days after receipt of Trustmi’s notice. Failure to object to
such new Sub-processor in writing within three (3) business days following Trustmi’s notice shall be deemed as
acceptance of the new Sub-Processor. In the event Client reasonably objects to a new Sub-processor, as permitted in the
preceding sentences, Trustmi will use reasonable efforts to make available to Client a change in the Services or recommend
a commercially reasonable change to Client’s use of the Services to avoid Processing of Personal Data by the objected-to
new Sub-processor without unreasonably burdening the Client. If Trustmi is unable to make available such change within
a reasonable period of time, Client may, as a sole remedy, terminate the applicable Agreement by providing written notice
to Trustmi, provided that all amounts due under the Agreement before the termination date with respect to the Processing
at issue shall be duly paid to Trustmi. Until a decision is made regarding the new Sub-processor, Trustmi may temporarily
suspend the processing of the affected personal data.
8. Security and audits. Taking into account the state of the art, Trustmi shall maintain all industry-standard technical and
organizational measures required pursuant to Article 32 of the GDPR. Upon Client’s written request at reasonable intervals
(subject to the confidentiality obligations) Trustmi shall make available to Client relevant information that is necessary to
demonstrate compliance with the obligations laid down in this Section (provided, however, that such information shall
only be used by Client to assess compliance with this Section, and shall not be disclosed to any third party without
2
Trustmi’s prior written approval). At Client’s cost and expense, Trustmi shall allow audits conducted by the Client or
another auditor mandated by Client (who is not a competitor of Trustmi), provided that the Parties shall agree on the scope,
methodology and timing of such audits and inspections. Notwithstanding anything to the contrary, such audits and/or
inspections shall not contain any information, including without limitation, Personal Data that does not belong to Client.
9. Personal data incident management and notification. To the extent required under GDPR, Trustmi shall notify Client
without undue delay after becoming aware of an incident related to Client´s Personal Data. Trustmi shall make reasonable
efforts to identify the cause of such Personal Data incident and take those steps as Trustmi deems necessary, possible and
reasonable in order to remediate the cause of such a Personal Data incident to the extent the remediation is within Trustmi’s
reasonable control. The obligations herein shall not apply to incidents that are caused by Client or Client’s users. In any
event, Trustmi will not be responsible for notifying supervisory authorities and/or concerned Data Subjects.
10. Return and deletion of Personal Data. Trustmi shall, at the choice of Client, delete or return the Personal Data to Client
after the end of the provision of the Services relating to Processing, and shall delete existing copies unless applicable law
requires storage of the Personal Data. In any event, to the extent required or allowed by applicable law, Trustmi may retain
one copy of the Personal Data for evidence purposes and/or for the establishment, exercise or defence of legal claims
and/or to comply with applicable laws and regulations.
11. Transfers of Personal Data.
11.1 Transfers to countries that offer adequate level of data protection. Personal Data may be transferred from the EU
Member States, the three EEA member countries (Norway, Liechtenstein and Iceland) (collectively, “EEA”) and the
United Kingdom to countries that offer adequate level of data protection under or pursuant to the adequacy decisions
published by the relevant data protection authorities of the EEA, the Union, the Member States or the European
Commission (“Adequacy Decisions”), without any further safeguard being necessary.
11.2 Transfers to other countries. If the Processing of Personal Data includes transfers from the EEA to countries outside
the EEA which are not subject to an Adequacy Decision (“Other Countries”), the Parties shall comply with their
applicable obligations under Chapter V of the GDPR, including, if necessary, executing the standard data protection
clauses adopted by the relevant data protection authorities of the EEA, the Union, the Member States or the European
Commission or comply with any of the other mechanisms provided for in the GDPR for transferring Personal Data to
such Other Countries. The parties hereby agree to the SCCs referenced in Schedule 3. “Standard Contractual
Clauses” or “SCCs” means (i) the standard contractual clauses for the transfer of Personal Data to data processors
established in third countries which do not ensure an adequate level of protection as set out in Regulation (EU)
2016/679 of the European Parliament and of the Council from June 4, 2021, as available here, as updated, amended,
replaced or superseded from time to time by the European Commission;
12. Termination. This DPA shall automatically terminate upon the termination or expiration of the Agreement under which
the Services are provided. This DPA cannot, in principle, be terminated separately to the Agreement, except where the
Processing ends before the termination of the Agreement, in which case, this DPA shall automatically terminate.
13. Miscellaneous. This DPA may not be amended or modified except by a written instrument which is signed by both Parties.
This DPA may be executed in counterparts. Client may assign this DPA or its rights or obligations hereunder to any
affiliate thereof, or to a successor or any affiliate thereof, in connection with a merger, consolidation or acquisition of all
or substantially all of its shares, assets or business relating to this DPA or the Agreement. Notwithstanding anything to
the contrary in the Agreement and/or in any agreement between the parties and to the maximum extent permitted by law:
(A) Trustmi’s (including Trustmi’s affiliates’) entire, total and aggregate liability, related to Personal Data or privacy,
including, without limitation, if any, any indemnification related thereto, shall be limited to the amounts paid to Trustmi
under the Agreement within twelve (12) months preceding the event that gave rise to the claim. This limitation of liability
is cumulative and not per incident; (B) In no event will Trustmi and/or Trustmi affiliates and/or their third-party providers,
be liable under, or otherwise in connection with this DPA for: (i) any indirect, exemplary, special, consequential, incidental
or punitive damages; (ii) any loss of profits, business, or anticipated savings; (iii) any loss of, or damage to data, reputation,
revenue or goodwill; and/or (iv) the cost of procuring any substitute goods or services; and (C) the foregoing exclusions
and limitations on liability set forth in this Section shall apply: (i) even if Trustmi, Trustmi affiliates or third-party
providers, have been advised, or should have been aware, of the possibility of losses or damages; (ii) even if any remedy
in this DPA fails of its essential purpose; and (iii) regardless of the form, theory or basis of liability (such as, but not
limited to, breach of contract or tort).
CLIENT: TRUSTMI
Signature: Signature:
Legal Name: Legal Name:
Title: Title:
Date: Date:
3
SCHEDULE 1 - DETAILS OF THE PROCESSING
Subject matter - Trustmi will Process Personal Data as necessary to perform the Services pursuant to the Agreement, as further
instructed by Client in its use of the Services.
Nature and Purpose of Processing
1. Providing the Service(s) to Client; Performing the Agreement, this DPA and/or other contracts executed by the
Parties;
2. Providing support and technical maintenance, if agreed in the Agreement;
3. Complying with applicable laws and regulations, including for cooperating with local and foreign tax authorities,
preventing fraud, money laundering and terrorist financing.
Duration of Processing - Subject to any Section of the DPA and/or the Agreement dealing with the duration of the Processing and the
consequences of the expiration or termination thereof.
Type of Personal Data - Client may submit Personal Data to the Services, the extent of which is determined and controlled by Client in
its sole discretion, and which may include, but is not limited to the following categories of Personal Data:
• Personal data provided by Client through the Services and/or to Trustmi.
• Any other Personal Data or information that the Client decides to provide to the Trustmi or the Services (e.g., Client’s
emails accessed via the API).
Notwithstanding anything to the contrary, the data regulated under our privacy policy available here: https://trustmi.ai/ shall not be
subject to this DPA.
Categories of Data Subjects - Client may submit Personal Data to the Services, the extent of which is determined and controlled by
Client in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of data
subjects: The Client, the Clients Customers and/or vendors services providers or related third parties related to any applicable payments.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
Continuous basis
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
As described in this DPA and/or the Agreement
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
As detailed in Schedule 2.
SCHEDULE 2 – SUB-PROCESSOR LIST
Entity Name Sub-Processing Activities Entity Country
AWS Cloud USA
Google Cloud USA
Slack Communication, customer USA
email and data
Microsoft Communication, Customer USA
Messaging, emails
1Password Passwords manager Canada
Cypago Compliance system USA
SCHEDULE 3 – DATA TRANSFERS
STANDARD CONTRACTUAL CLAUSES
4
If the Processing of Personal Data includes transfers from the EEA to countries outside the EEA which do not offer adequate level of
data protection or which have not been subject to an Adequacy Decision, the Parties shall comply with Chapter V of the GDPR. The
Parties hereby agree to execute the Standard Contractual Clauses as follows:
a) The Standard Contractual Clauses (Controller-to-Processor and Processor-to-Processor (as applicable)) will apply with respect
to restricted transfers between Client and Trustmi that are subject to the EU GDPR.
b) The Parties agree that for the purpose of transfer of Personal Data between Client (as Data Exporter) and Trustmi (as Data
Importer), the following shall apply: (i) Clause 7 of the Standard Contractual Clauses shall be applicable; (ii) In Clause 9, option 2 shall
apply and the method described in Section 7 of the DPA shall apply; (iii) Clause 11 of the Standard Contractual Clauses shall not be
applicable; (iv) In Clause 13: In accordance to the applicable option to be chosen by the Client – which shall be informed to Trustmi;
(v) In Clause 17, option 1 shall apply. The Parties agree that the Standard Contractual Clauses shall be governed by the laws of Ireland;
and (vi) In Clause 18(b) the Parties choose the courts of Dublin, as their choice of forum and jurisdiction.
c) Annex I.A: With respect to Module Two: (i) Data Exporter is Client as a data controller and (ii) the Data Importer is Trustmi
as a data processor. With respect to Module Three: (i) Data Exporter is Client as a data processor and (ii) the Data Importer is Trustmi
as a data processor (sub-processor). Data Exporter and Data Importer Contact details: As detailed in the Agreement. Signature and Date:
By entering into the Agreement and this DPA, each Party is deemed to have signed these Standard Contractual Clauses incorporated
herein, including their Annexes, as of the Effective Date of the DPA.
d) Annex I.B of the Standard Contractual Clauses shall be completed as described in Schedule 1 (Details of the Processing) of
this DPA.
e) Annex I.C of the Standard Contractual Clauses shall be completed as follows: The competent supervisory authority is the Irish
supervisory authority.
f) Annex II of the Standard Contractual Clauses shall be completed as described and agreed between the parties in the Agreement
and/or this DPA.
g) Annex III of the Standard Contractual Clauses shall be completed with the authorized sub-processors detailed in Schedule 2 of
this DPA.