Snapshot 223538
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Cloud Data Processing Addendum
Last Updated: March 2022
This Data Processing Addendum ("DPA"), forms part of the ERP.Aero Cloud Terms of Services or other written
or electronic terms of service or subscription agreement (“Agreement”) between ERP.Aero, Inc. ("ERP.Aero")
and the Customer signatory thereto. All capitalized terms not defined in this DPA shall have the meanings set
forth in the Agreement. The parties agree that this DPA shall replace any existing DPA or other data protection
provisions the parties may have previously entered into in connection with the Services. In consideration of the
mutual obligations set forth herein, the parties hereby agree that the terms and conditions set out below shall
be added as an addendum to the Agreement.
1. Definitions
(a) "Affiliate" means an entity that directly or indirectly Controls, is Controlled by or is under
common Control with an entity.
(b) "Agreement" means the written or electronic agreement between Customer and ERP.Aero
for the provision of the Services to Customer.
(c) "Control" means an ownership, voting or similar interest representing fifty percent (50%) or
more of the total interests then outstanding of the entity in question. The term "Controlled"
will be construed accordingly.
(d) "Customer Personal Data" means any Personal Data that is uploaded into ERP.Aero Cloud for
storage or hosting that ERP.Aero processes on behalf of Customer in the course of providing
Services.
(e) "Data Protection Laws" means all data protection and privacy laws applicable to the
processing of Customer Personal Data under the Agreement.
(f) "EEA" means the European Economic Area.
(g) “EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council
of 27 April 2016 on the protection of natural persons with regard to the processing of Personal
Data and on the free movement of such data, and repealing Directive 95/46/EC (General Data
Protection Regulation).
(h) “GDPR” means, as applicable: (i) the EU GDPR; and/or (b) the UK GDPR.
(i) "Security Incident" means an unauthorized or unlawful breach of security that leads to the
accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to
Customer Personal Data.
(j) “Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available,
transferring, or otherwise communicating orally, in writing or by electronic or other means,
Customer Personal Data to a third party for monetary or valuable consideration.
(k) "Services" means any cloud service offering provided by ERP.Aero to Customer pursuant to
the Agreement.
(l) "Subprocessor" means any Processor engaged by ERP.Aero or its Affiliates to assist in fulfilling
its obligations with respect to providing the Services pursuant to the Agreement or this DPA.
Subprocessors may include third parties or ERP.Aero’s Affiliates.
(m) “UK GDPR” means the EU GDPR as amended and incorporated into UK law under the UK
European Union (Withdrawal) Act 2018, and applicable secondary legislation made under that
Act.
(n) The terms “Controller”, “Data Subject”, “Processor,” “process,”, “processing” and “Personal
Data” have the meanings given to them in applicable Data Protection Laws.
2. Scope of this DPA
This DPA applies where and only to the extent that ERP.Aero processes Customer Personal Data on
behalf of Customer in the course of providing Services to the Customer pursuant to the Agreement.
The DPA does not apply where ERP.Aero determines the purpose and means of the processing of
Personal Data.
3. Roles and Scope of Processing
3.1 Role of the Parties. As between the parties, Customer may act as Controller and/or Processor of
Customer Personal Data and ERP.Aero may act as Processor and/or subprocessor of Customer
Personal Data. Nothing in the Agreement or in this DPA shall prevent ERP.Aero from using or sharing
any data that ERP.Aero would otherwise collect and process independently of Customer’s use of the
Services.
3.2 Customer as Controller of Customer Personal Data. If Customer is Controller of Customer Personal
Data, Customer agrees that (i) it will comply with its obligations as a Controller under Data Protection
Laws in respect of its processing of Customer Personal Data and any processing instructions it issues
to ERP.Aero; and (ii) it has provided notice and obtained (or will obtain) all consents and rights
necessary for ERP.Aero to process Customer Personal Data pursuant to the Agreement and this DPA.
3.3 Customer as Processor of Customer Personal Data. If Customer is Processor of Customer Personal Data,
Customer warrants on an ongoing basis that the relevant Controller has authorized: (i) ERP.Aero’s
processing of Customer Personal Data as outlined in this DPA and in Exhibit A; (ii) Customer’s
appointment of ERP.Aero as another processor; and (iii) ERP.Aero’s engagement of Subprocessors as
described in Section 5 below. To the extent required by applicable Data Protection Laws, Customer will
immediately forward to the relevant Controller any notice provided by ERP.Aero in connection to this
DPA.
3.4 Customer Instructions. ERP.Aero will process Customer Personal Data only (i) for the purpose of
providing the Services and in accordance with Customer’s documented lawful instructions as set forth
in the Agreement and this DPA; (ii) as part of the direct business relationship between Customer and
ERP.Aero; (iii) on behalf of Customer and ERP.Aero’s other customers, to the extent necessary to
detect data security incidents, or protect against fraudulent or illegal activity; or (iv) as required by law,
provided ERP.Aero shall inform Customer of such legal requirement prior to commencing such
2
processing unless prohibited by law. The parties agree that the Customer’s complete and final
instructions with regard to the nature and purposes of the processing are set out in this DPA. ERP.Aero
will not Sell Customer Personal Data. ERP.Aero certifies that it understands the restrictions in this
Section 3.4 and will comply with such restrictions.
3.5 Details of Data Processing
(a) Subject matter. The subject matter of the data processing under this DPA is Customer Personal
Data.
(b) Duration of the processing. As between ERP.Aero and Customer, the duration of the data
processing under this DPA is the term of the Agreement.
(c) Purpose of the processing. Performance of the Services.
(d) Nature of the processing: ERP.Aero will use and otherwise process Customer Personal Data
only in accordance with Customer’s documented instructions and as described and subject to
the terms of the Agreement and this DPA.
(e) Categories of data subjects: The data subjects of Customer may include Customer’s end users,
employees, contractors, suppliers, and other third parties.
(f) Types of Customer Personal Data. Personal data processed under this DPA include Customer
Personal Data. Customer acknowledges that it solely chooses the nature and types of
Customer Personal Data and that ERP.Aero will be generally unaware of the details of
Customer Personal Data processed within the Services.
4. Data Transfers
4.1 Data Storage and Processing Facilities. Customer Personal Data will only be deployed in the geographic
location(s) that Customer specifies via the Service (the “Deployment Region”). Customer is solely
responsible for any transfer of Customer Personal Data caused by Customer’s subsequent designation
of other Deployment Regions. ERP.Aero may process Customer Personal Data anywhere in the world
where ERP.Aero, its Affiliates or its Subprocessors maintain data processing operations. ERP.Aero will
at all times provide an adequate level of protection for the Customer Personal Data processed, in
accordance with the requirements of applicable Data Protection Laws.
4.2 Cross-Border Transfers. Where the transfer of Customer Personal Data is from the EEA, Switzerland or
the United Kingdom to a territory which has not been recognized by the European Commission as
providing an adequate level of protection for Customer Personal Data on the basis of Article 45 GDPR
(or in the case of transfers from the United Kingdom, by the United Kingdom Government), ERP.Aero
agrees to process that Customer Personal Data in compliance with the provisions outlined in Exhibit A
hereto, which forms an integral part of this DPA.
5. Subprocessing
5.1 Authorized Subprocessors. Customer agrees that in order to provide the Services, ERP.Aero may
engage Subprocessors to process Customer Personal Data. ERP.Aero maintains a list of its authorized
Subprocessors on its website at https://erp.aero/privacy/third-party-providers.
3
5.2 Subprocessor Obligations. Where ERP.Aero authorizes any Subprocessor as described in Section 5.1
above:
(a) ERP.Aero will restrict the Subprocessors access to Customer Personal Data only to what is
necessary to assist ERP.Aero in providing or maintaining the Services, and will prohibit the
Subprocessor from accessing Customer Personal Data for any other purpose;
(b) ERP.Aero will enter or has already entered into a written agreement with the Subprocessor
imposing data protection terms that require the Subprocessor to protect the Customer
Personal Data to the standard required by applicable Data Protection Laws; and
(c) ERP.Aero will remain responsible for its compliance with the obligations of this DPA and for
any acts or omissions of the Subprocessor that cause ERP.Aero to breach any of its obligations
under this DPA.
5.3 Subprocessor Updates. ERP.Aero will provide Customer with a 30-day prior notice on its website if it
intends to make any changes to its Subprocessors. Customer may receive notifications of new
Subprocessors and updates to existing Subprocessors by becoming members of ERP.Aero
Community. Customer may, within 90 days of notification, object in writing to ERP.Aero’s
appointment of a new Subprocessor, provided that such objection is based on reasonable grounds
relating to the processing of Customer Personal Data by the new Subprocessor. In such event, the
parties will discuss such objection in good faith with a view to achieving resolution. If this is not
possible, Customer may suspend or terminate the Agreement (without prejudice to any fees
incurred by Customer prior to suspension or termination).
6. Security Measures and Security Incident Response
6.1 Security Measures. ERP.Aero has implemented and will maintain appropriate technical and
organizational security measures to protect Customer Personal Data from Security Incidents and to
preserve the security and confidentiality of the Customer Personal Data ("Security Measures"). The
Security Measures applicable to the Services are set forth in the ERP.Aero Cloud Security Addendum
available at https://www.ERP.Aero/security as updated or replaced from time to time in accordance
with Section 6.2 below.
6.2 Updates to Security Measures. Customer has carried out its own review of the information made
available by ERP.Aero relating to data security and has made an independent determination that the
Services meet Customer’s requirements and legal obligations under Data Protection Laws. Customer
acknowledges that the Security Measures are subject to technical progress and development and that
ERP.Aero may update or modify the Security Measures from time to time provided that such updates
and modifications do not result in the degradation of the overall security of the Services purchased by
the Customer.
6.3 Personnel. ERP.Aero restricts its personnel from processing Customer Personal Data without
authorization by ERP.Aero as set forth in the Security Measures and shall ensure that any person who
is authorized by ERP.Aero to process Customer Personal Data is under an appropriate obligation of
confidentiality.
4
6.4 Customer Responsibilities. Without prejudice to ERP.Aero’s obligations under this DPA, and
elsewhere in the Agreement, Customer is responsible for its secure use of the Services, including: (i)
protecting account authentication credentials; (ii) protecting the security of Customer Personal Data
when in transit to and from the Services; (iii) implementing measures to allow Customer to backup
and archive appropriately in order to restore availability and access to Customer Personal Data in a
timely manner in the event of a physical or technical incident; and (iv) taking any appropriate steps to
securely encrypt or pseudonymise any Customer Personal Data uploaded to the Services.
6.5 Security Incident. In the event of a Security Incident, ERP.Aero will notify Customer without undue
delay and will provide updates to Customer. ERP.Aero will reasonably cooperate with Customer as
required to fulfill Customer’s obligations under Data Protection Laws.
7. Audits
7.1 Audit Reports. ERP.Aero uses external auditors to evaluate the continued effectiveness of its Security
Measures. Upon request and at no additional cost to Customer, ERP.Aero will provide Customer
access to reasonably requested documentation evidencing such effectiveness in the form of the
relevant audits or certifications listed in the ERP.Aero Cloud Security Addendum (“Audit Reports”).
Audit Reports shall be subject to the confidentiality provisions of the Agreement. ERP.Aero shall also
respond to any written audit questions submitted to it by Customer provided that Customer shall not
exercise this right more than once per year.
7.2 Customer Audit Rights. To the extent Customer’s audit requirements under applicable Data Protection
Laws cannot reasonably be satisfied through Audit Reports, documentation or compliance information
ERP.Aero makes generally available to its customers, ERP.Aero will promptly respond to Customer’s
additional audit requests. Before the commencement of an audit, Customer and ERP.Aero will
mutually agree upon the scope, timing, duration, and control and evidence requirements, provided
that this requirement to agree will not permit ERP.Aero to unreasonably delay performance of the
audit. To the extent needed to perform the audit, ERP.Aero will make the processing systems,
facilities and supporting documentation relevant to the processing of Customer Personal Data by
ERP.Aero available. Neither Customer nor the third-party auditors, if any, shall have access to any
data from ERP.Aero’s other customers or to ERP.Aero systems or facilities not involved in the
processing of Customer Personal Data. Customer is responsible for all costs and expenses related to
such audit, including all reasonable costs and expenses for any and all time ERP.Aero expends for any
such audit.
8. Return or Deletion of Data
Upon termination or expiration of the Agreement, ERP.Aero shall (at Customer's election) delete or
return to Customer all Customer Personal Data in its possession or control in accordance with the
terms of the Agreement. This requirement shall not apply to the extent ERP.Aero is required by
applicable law to retain some or all of the Customer Personal Data, or to Customer Personal Data it
has archived on back-up systems, which Customer Personal Data ERP.Aero shall securely isolate and
protect from any further processing, except to the extent required by law.
9. Cooperation
9.1 Data Subject Request. The Services provide Customer with the ability to retrieve and delete Customer
Personal Data. Customer may use these controls to comply with Customer’s obligations under
5
applicable Data Protection Laws, including Customer’s obligations related to any requests from data
subjects (“Data Subject Requests”). To the extent that Customer is unable to independently access
the relevant Customer Personal Data using such controls or otherwise, ERP.Aero shall (at Customer's
expense) provide reasonable cooperation to assist Customer to respond to such Data Subject
Requests. In the event that any such Data Subject Request is made directly to ERP.Aero, ERP.Aero
shall, to the extent legally permitted: (i) advise the data subject to submit their Data Subject Request
to Customer; (ii) promptly notify Customer; and (iii) not otherwise respond to that Data Subject
Request without authorization from Customer unless legally compelled to do so. Customer will be
responsible for responding to any such Data Subject Requests.
9.2 Requests for Customer Personal Data. If ERP.Aero receives a subpoena, court order, warrant or other
legal demand from law enforcement or public or judicial authorities seeking the disclosure of
Customer Personal Data, ERP.Aero shall, to the extent permitted by applicable laws, promptly notify
Customer in writing of such request and reasonably cooperate with Customer to limit, challenge or
protect against such disclosure.
9.3 Legal Compliance. To the extent ERP.Aero is required under applicable Data Protection Laws,
ERP.Aero will (at Customer's expense) provide reasonably requested information regarding the
Services to enable the Customer to carry out data protection impact assessments and prior
consultations with data protection authorities as required by law.
10. General
10.1 For the avoidance of doubt, any claim or remedies the Customer and/or its Affiliates may have against
ERP.Aero, any of its Affiliates and their respective employees, agents and Subprocessors (hereinafter
“ERP.Aero Group”) arising under or in connection with this DPA, including: (i) for breach of this DPA;
(ii) for breach of cross-border data transfers and related provisions outlined in the Standard
Contractual Clauses (to the extent applicable and as defined in Exhibit A hereto); (iii) as a result of fines
(administrative, regulatory or otherwise) imposed upon Customer; and (iv) under applicable Data
Protection Laws, including any claims relating to damages paid to a data subject, will be subject to any
limitation of liability provisions (including any agreed aggregate financial cap) that apply under the
Agreement. Such limitation of liability does not apply to any direct claim or remedies a data subject
may have against Customer or ERP.Aero. Customer further agrees that any regulatory penalties
incurred by ERP.Aero Group in relation to the Customer Personal Data that arise as a result of, or in
connection with, Customer’s failure to comply with its obligations under this DPA or any applicable
Data Protection Laws shall count toward and reduce ERP.Aero’s liability under the Agreement as if it
were liability to the Customer under the Agreement.
10.2 Any claims against ERP.Aero or its Affiliates under this DPA shall be brought solely against the entity
that is a party to the Agreement. No one other than a party to this DPA, their successors and permitted
assignees shall have any right to enforce any of its terms.
10.3 To the extent reasonably necessary to comply with changes to applicable Data Protection Laws or in
response to guidance or mandates issued by any court, regulatory body, or supervisory authority with
jurisdiction over ERP.Aero, ERP.Aero may modify, amend, or supplement the terms of this DPA.
ERP.Aero will endeavour to provide prior written notice of any such changes to Customer by posting
a notice on ERP.Aero’s website and/or in Customer’s ERP.Aero Cloud web portal, where applicable.
10.4 This DPA will be governed by and construed in accordance with governing law and jurisdiction
provisions in the Agreement, unless required otherwise by applicable Data Protection Laws.
6
10.5 Except for the changes made by this DPA, the Agreement remains unchanged and in full force and
effect. In the event of any conflict or inconsistency among the following documents, the order of
precedence will be: (1) the applicable terms in Exhibit A (Cross-Border Data Transfers); (2) the terms
of this DPA outside of Exhibit A; and (3) the Agreement. Any claims brought in connection with this
DPA will be subject to the terms and conditions, including, but not limited to, the exclusions and
limitations set forth in the Agreement.
10.6 If any provision of this DPA is found by any court or administrative body of competent jurisdiction to
be invalid or unenforceable, then the invalidity or unenforceability of such provision does not affect
any other provision of this DPA and all provisions not affected by such invalidity or unenforceability
will remain in full force and effect.
7
EXHIBIT A
CROSS-BORDER DATA TRANSFERS
1. Definitions
(a) “EU Standard Contractual Clauses (Controller-to-Processor)” or “EU SCCs (Controller-to-
Processor)” means the terms located at: http://www.ERP.Aero/compliance/eusccs-c2p
“EU Standard Contractual Clauses (Processor-to-Processor)” or “EU SCCs (Processor-to-
Processor)” means the terms located at: http://www.ERP.Aero/compliance/eusccs-p2p
(c) “UK Standard Contractual Clauses” or “UK SCCs” means the terms located at:
http://www.ERP.Aero/compliance/uksccs-c2p
2. UK Standard Contractual Clauses
2.1 For transfers of Customer Personal Data from the United Kingdom that are subject to Section 4.2 of the
DPA, the UK SCCs will apply and are incorporated into the DPA by reference.
3. EU Standard Contractual Clauses
3.1 For transfers of Customer Personal Data from the EEA and/or Switzerland that are subject to Section
4.2 of the DPA:
(a) Where Customer is a controller of Customer Personal Data, the EU SCCs (Controller-to-
Processor) will apply and are incorporated into the DPA by reference; and
(b) Where Customer is a processor of Customer Personal Data, the EU SCCs (Processor-to-
Processor) will apply and are incorporated into the DPA by reference.
4. Alternative Data Export Solutions
4.1 Notwithstanding the foregoing, the parties agree that in the event ERP.Aero adopts another alternative
data export solution (as recognized under applicable Data Protection Laws), then the alternative data
export solution shall apply instead of the Standard Contractual Clauses. In the event that the alternative
data export solution is later determined to not constitute an adequate level of data protection under
applicable Data Protection Laws, the Standard Contractual Clauses shall apply as the data export
solution.
8