Snapshot 232420
Normalized text
Scripts and page chrome removed; this is what change detection compares.
DATA PROCESSING AGREEMENT
Last updated [June 2026]
1 Definitions
In this Data Processing Agreement:
‘Applicable Law’ means any legislation or regulation which is binding on a party.
‘Customer’ means a ‘Customer’ under the Terms of Service.
‘Customer Instance’ means an instance of a Product established by Snapper for a Customer
(where applicable).
‘Customer Data’ means:
a all data inputted or created by a Customer, or any other person in connection with the
Products;
b any other data collected by or on behalf of a Customer or any other person and made
available to Snapper in connection with the Products; and
c any modifications, adaptations, or derivations of the data described above.
‘Customer Personal Data’ means Customer Data that is Personal Data which is Processed
by Snapper through the Products.
‘Data Protection Laws’ means all legislation and regulations relating to data protection and
privacy that are binding on a party in relation to Customer Personal Data, including:
a in the EU, Regulation (EU) 2016/679 of the European Parliament and of the Council of
27 April 2016 on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data, and repealing Directive 95/46/EC;
b in the UK, the Data Protection Act 2018, the Data Protection, Privacy and Electronic
Communications (Amendments etc) (EU Exit) Regulations 2019 (the ‘Data Protection
Regulations’), and the UK GDPR (as defined in the Data Protection Regulations); and
c in New Zealand, the Privacy Act 2020.
‘Data Subject’ means a natural person to whom Customer Personal Data relates.
‘Personal Data’ has the meaning given to it, or to the term ‘personal information’, by
applicable Data Protection Laws.
‘Personal Data Breach’ has the meaning given to it by applicable Data Protection Laws.
‘Process’ means to compile, arrange, develop, store, transmit, aggregate, anonymise or
otherwise use (and ‘Processing’ has the same meaning).
‘Products’ means the software platform known as MOSAIQ TRANSIT INTELLIGENCE
SUITE, which includes the products, modules, APIs and other applications described at
mosaiq.co.
DATA PROCESSING AGREEMENT – MOSAIQ TRANSIT INTELLIGENCE SUITE 1
‘Snapper’ means Snapper Services Limited.
‘Subject Access Request’ has the meaning given to it by clause 8.
‘Technical Measures’ has the meaning given to it by clause 3.
‘Terms of Service’ means the terms of service applicable to use of a Product, as set out at
mosaiq.co.
2 Snapper’s use of Customer Data
Customer hereby instructs Snapper to Process the Customer Personal Data for which
Customer is the controller (including by retaining copies of that Customer Personal Data) for
the following purposes:
a providing the Products and each Customer Instance;
b preventing and/or addressing service, support, or technical problems;
c undertaking maintenance, support, upgrades, and revisions of the Products and each
Customer Instance;
d detecting, investigating, and protecting against security incidents, and fraudulent,
malicious, and illegal activity in connection with the Products and each Customer
Instance;
e producing analytics, statistics, and reports regarding the use of the Products and each
Customer Instance, including to understand how such software is being used and
performing, for maintenance and quality assurance purposes, and to improve and
develop new services;
f exercising Snapper’s rights and complying with Snapper’s obligations under this Data
Processing Agreement;
g creating anonymised datasets in connection with the use of each Customer Instance, to
assist Snapper to improve Snapper’s software and its offering of services to Customers,
and others; and
h where required and/or permitted to do so in accordance with Applicable Law.
3 Snapper’s obligations
Snapper will:
a when Processing any of the Customer Personal Data, comply with all obligations
imposed on Snapper under Data Protection Laws;
b implement and maintain adequate technical and organisational measures for the
protection of the security, confidentiality, and integrity of the Customer Data (including
the Customer Personal Data) (‘Technical Measures’);
c ensure the Technical Measures include measures for preventing access, use,
modification, or disclosure of the Customer Data by Snapper’s personnel (including by
requiring that Snapper’s personnel are bound by the obligation of confidentiality), except:
DATA PROCESSING AGREEMENT – MOSAIQ TRANSIT INTELLIGENCE SUITE 2
i to provide the Products and each Customer Instance in the manner contemplated
by this agreement (including to address service, support, or technical issues);
ii as required by Applicable Law;
iii with Customer’s written consent; and
iv as otherwise contemplated by this Data Processing Agreement;
d Process the Customer Data (and will host and access all of the Customer Personal Data
Processed through each Customer Instance) using such equipment or personnel located
within the European Union, the United Kingdom, New Zealand, and/or any other country
in which Snapper is permitted under applicable Data Protection Laws to Process
Customer Personal Data (including, without limitation, because of an adequacy decision
or other permitted transfer mechanisms such as standard contractual clauses);
e inform Customer of any legal requirement to which Snapper is subject which will require
Snapper to Process any of the Customer Personal Data, unless Snapper is prohibited
from doing so.
4 Subprocessor
Snapper may engage a subprocessor to hold or process the Customer Personal Data, and
must do so on written terms which:
a require such subprocessor to hold or process the Customer Personal Data solely for the
purposes described in clause 2;
b impose obligations on the subprocessor which are consistent with the obligations
imposed on Snapper in this Data Processing Agreement (as if references in this clause
to ‘Snapper’ were references to the subprocessor).
5 Transfer of Customer Personal Data to subprocessor
Snapper will ensure that the transfer of the Customer Personal Data to a subprocessor
engaged by Snapper complies with applicable Data Protection Laws.
6 Personal Data Breach
Snapper will notify Customer without undue delay and in any event within 48 hours after
becoming aware of a Personal Data Breach or suspected Personal Data Breach in relation to
any Customer Personal Data, and Snapper will give all necessary assistance to Customer to
respond to and/or notify any person in connection with such a Personal Data Breach or
suspected Personal Data Breach.
7 Record keeping and auditing
Snapper will:
a maintain all related records to demonstrate Snapper’s compliance with the obligations
set out in this Data Processing Agreement and will make such records available to
Customer on reasonable request;
DATA PROCESSING AGREEMENT – MOSAIQ TRANSIT INTELLIGENCE SUITE 3
b permit Customer or an independent third party auditor for whom Customer (or a person
acting on behalf of Customer) is responsible to conduct audits of Snapper’s records and
systems, to the extent within Snapper’s control, for the purposes of Customer or such
auditor assessing Snapper’s compliance with the obligations set out in this Data
Processing Agreement, provided that:
i any audit that Customer (or an auditor appointed by or on behalf of Customer)
conducts must be undertaken at a time and in a manner which causes the least
disruption to Snapper’s business and operations;
ii Snapper may charge Customer for reasonable out-of-pocket expenses that Snapper
incurs in connection with, and for (on a time and attendance basis) any of Snapper’s
internal resources for which Snapper deploys to respond to any request for, or
conduct of, an audit under this clause 7 (including reasonable legal costs as
between client and solicitor).
8 Requests and assistance
Snapper:
a will promptly notify Customer if Snapper receives a request from a Data Subject to
exercise any rights in connection with the Customer Personal Data under Data Protection
Laws (‘Subject Access Request’); and
b will, on request by or on behalf of Customer, provide assistance to Customer:
i in Customer’s response to any Subject Access Request;
ii in connection with the conduct of any data protection or privacy impact assessment
relating to the Processing,
in which case Snapper may charge Customer for all reasonable out-of-pocket expenses that
Snapper incurs in connection with, and (on a time and attendance basis) for any of Snapper’s
internal resources which Snapper deploys to respond to, any request made under this clause
8.
9 Customer obligations
Customer must:
a comply with all Data Protection Laws applicable to Customer’s collection, use, disclosure
and Processing of the Customer Personal Data;
b ensure that all necessary notices, permissions, and/or consents are in place to enable
Snapper to Process the Customer Personal Data in the manner contemplated by clause
2;
c promptly notify Snapper if Customer becomes aware of any breach of any Data
Protection Laws in connection with the Customer Personal Data and/or any complaint,
request, or other matter which may adversely affect Snapper’s reputation arising from or
in connection with Snapper’s use of the Customer Personal Data (regardless of whether
such use complies with Data Protection Laws).
DATA PROCESSING AGREEMENT – MOSAIQ TRANSIT INTELLIGENCE SUITE 4
10 Collection of Personal Data directly by Snapper
Nothing in this Data Processing Agreement will prevent Snapper from directly contacting
users of the Products to ask for feedback on the service, including by sending out customer
satisfaction surveys and/or subscribing users to Snapper’s email newsletters or marketing
database, provided that as between Snapper and Customer, with respect to any Personal
Data that Snapper collects from users in this manner:
a Snapper will not be held to Process that Personal Data on Customer’s behalf for the
purposes of this Data Processing Agreement; and
b Snapper will remain responsible for ensuring that the collection, use and disclosure of
that Personal Data complies with Data Protection Laws.
11 Updates
11.1 How Snapper may update: Snapper may update this document by:
a posting an updated document at mosaiq.co; and/or
b notice in writing to Customers issued in accordance with the Terms of Service.
11.2 Effective date of updates Any updates made by Snapper in accordance with clause 11.1 will
take effect as between Snapper and any existing Customer:
a in the case of non-material updates (such as grammatical changes), the inclusion of
changes to accommodate the introduction of new services or features, or changes which
a reasonable person would consider are beneficial to Customers, immediately;
b in the case of all other updates, 30 days after the date on which they are notified to you,
or such longer period as we may notify to you (and continued use of the Products after
such date will be deemed acceptance of the relevant updates).
DATA PROCESSING AGREEMENT – MOSAIQ TRANSIT INTELLIGENCE SUITE 5