Snapshot 232773
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to main content HireGlobal Data Processing Agreement Date of Last Revision: April 12, 2024 This Data Processing Agreement (“DPA”) is incorporated into the HireGlobal Services Agreement between HireGlobal LLC of 2810 N. Church Street #36879, Wilmington, Delaware 19802 and its affiliates (“Processor” or “HireGlobal”) and Client (“Controller” or “Client”) (together the “Parties”). The Parties agree as follows: 1. Purpose and Definitions. (a) The Parties are entering into this DPA in order to comply with their respective obligations under the EU General Data Protection Regulation (EU) 2016/679 (the “GDPR”), the California Consumer Privacy Act of 2018, as amended from time to time, including any successor legislation (the “CCPA”), the United Kingdom's Data Protection Act 2018, the GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 (the “UK GDPR”), and any other applicable data protection, data privacy and data security laws (collectively the “Data Protection Laws”). The Parties have entered into an arrangement whereby Controller may transfer Personal Data to Processor in connection with Processor's provision of certain Services to Controller (defined below). (b) “Affiliate” means any entities or persons, including without limitation, any corporation, company, partnership, or limited liability company, which, directly or indirectly through one or more intermediaries, controls, is controlled by, or is under common control with a party. (c) “Controller” means the Party acting as Controller or Business as defined by the Data Protection Laws. (d) “Processing”, “Process” and “Processes” means any operation or set of operations which is performed upon Personal Data (defined below) or sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. (e) “Processor” means the Party acting as the Data Processor or Service Provider as defined by Data Protection Laws. (f) “Personal Data” is defined as under Applicable Data Laws and includes similar terms under any other Data Protection Laws, including Personal Information under the CCPA. (g) “Personal Data Breach” means a potential breach or actual breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise Processed. (h) “Product” means Processor’s provision of human resources management, payroll, compliance, and other associated services to Controller through Processor’s HireGlobal offering. 2. Term; Roles. This DPA begins on the Effective Date and continues until Processor and any Subprocessor no longer Process Personal Data under this DPA. Processor will only Process Personal Data in accordance with Appendix A to this DPA. 3. Subprocessors. Processor will only use the Subprocessors listed at toptal.com/hireglobal/subprocessors (the “Subprocessor List”). Processor will update the Subprocessor List at least thirty (30) days prior to any new Subprocessor Processing Personal Data under this DPA. Controller may reasonably object to the additional Subprocessor during that time. If the Controller reasonably objects to a Subprocessor and the Parties are unable to come to a reasonable compromise, then the Processor will attempt to provide the Product without the use of the objected Subprocessor. If Processor is unable to do so, Controller may terminate this DPA and any underlying agreements as their sole remedy. 4. Processor’s Obligations. Processor will: (a) Process the Personal Data only on Controller’s instructions as necessary to provide the Product, including with regard to transfers of Personal Data to a Third Country (defined below). In accordance with the terms of this DPA and applicable Data Protection Laws, Processor will promptly notify Controller if Processor cannot comply with Controller’s instructions due to a legal requirement under Data Protection Laws; (b) keep the Personal Data confidential and not disclose Personal Data to any third party except as may be required by applicable law or as approved by Controller; (c) ensure that those authorised to Process Personal Data are under a binding, written obligation of confidentiality; (d) will only use the Personal Data for the purposes listed within Appendix A of this DPA; (e) not Sell or Share (as defined in the CCPA) Personal Data to any third party; (f) reasonably assist Controller in ensuring compliance with Controller’s obligations as required pursuant to applicable Data Protection Laws, including Articles 28 and 32 through 36 of the UK GDPR and the EU GDPR, taking into account the nature of Processing and the information available to the Processor; (g) promptly notify Controller of any rights request received by a data subject or consumer; (h) notify Controller without undue delay and within forty-eight (48) hours of becoming aware of any Personal Data Breach involving Controller’s Personal Data; (i) promptly notify Controller in writing upon making a determination that it has not met, or can no longer meet, its obligations under this DPA. In such case, Processor will follow Controller’s reasonable and lawful written instructions, including instructions to cease further Processing of the Personal Data, and take reasonably necessary steps to remediate any Processing of such Personal Data not in accordance with this DPA; (j) allow Controller the right, at Controller’s expense and upon the agreed appointment of an auditor, to audit its Processing operations, systems, and/or facilities where reasonably required by Controller to assess the Processor’s compliance with this DPA. Alternatively, and at Controller’s expense, Controller may make reasonable requests for information to demonstrate the Processor’s compliance with this DPA and applicable Data Protection Laws. The Parties will mutually agree on the scope, timing, and duration of any audit, agreement not to be unreasonably withheld. Controller may only exercise this right one (1) time in any twelve (12) month period. If Controller reasonably believes that Processor is unable to fulfil its obligations based on an audit or information obtained under this provision, Processor will have an opportunity to confirm it is able to fulfil its obligations. If Controller maintains its reasonable belief, it may terminate this DPA as its sole remedy. 5. Personal Data Breach. Without limiting the generality of any of the obligations of Processor, in the event of a Personal Data Breach, Processor will: (a) notify Controller without undue delay and within forty-eight (48) hours after becoming aware of a Personal Data Breach and provide Controller with: a description of the nature of the Personal Data Breach (including, where possible, the categories and approximate number of data subjects and data records concerned); the details of a contact point within Processor’s business where more information concerning the Personal Data Breach can be obtained; the likely consequences of the Personal Data Breach and measures taken or proposed to be taken to address the Personal Data Breach, including to mitigate its possible adverse effects; to the extent that it is not possible to provide the foregoing information at the time, the initial notification will contain the then available information and Processor will provide further information will as it becomes available without undue delay. 6. Information Security. Taking into account the start of the art, the costs of implementation, and the nature, scope, context, and purposes of process, Processor has implemented and will maintain appropriate technical and organisational measure to ensure an appropriate level of security appropriate to the risks of Processing to protect against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data, including a comprehensive written information security program (“Information Security Program”). The Information Security Program includes the below safeguards where appropriate or necessary to ensure the protection of Personal Data. Current and specific technical and organizational measures relevant to this DPA and Processor’s provision of the Product can be requested at by emailing privacy@hireglobal.com. (a) Access Controls – policies, procedures, and physical and technical controls: (i) to limit access to its information systems to properly authorized persons; (ii) to ensure that all personnel who require access to Personal Data have appropriately controlled access and will maintain the confidentiality of the Personal Data, and to prevent personnel and others who should not have access from obtaining access; (iii) to authenticate and permit access only to authorized individuals and to prevent personnel from providing Personal Data or information relating thereto to unauthorized individuals; (b) Security Awareness and Training – a security awareness and training program for all personnel (including management) that includes how to implement and comply with Processor’s Information Security Program; (c) Security Incident Procedures – policies and procedures to prevent, detect, respond to, and otherwise manage security incidents; (d) Device and Media Controls – policies and procedures that govern the security of hardware and electronic media that contain Personal Data in Processor’s control; and (e) Adjust the Program – the monitoring, evaluation, and adjustment, as appropriate, of the Information Security Program in light of any relevant changes in technology or industry security standards, the sensitivity of the Personal Data, internal or external threats to the Personal Data, and Processor’s own changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to information systems. 7. Return/Destruction. Upon Controller’s request, Processor will return all copies of the Personal Data to Controller or irrevocably erase all copies of the Personal Data, including copies kept by Subprocessors, except for Personal Data required to be maintained pursuant to applicable Data Protection Laws. Any Personal Data so retained will remain subject to the terms of this DPA. This Section will survive termination or expiration of this DPA. Cross Border and Onward Transfers. (a) EU Standard Contractual Clauses. The EU Standard Contractual Clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (the “EU SCCs”) are deemed entered into by the Parties without further action. The EU SCCs apply to Processing Personal Data that is protected by the GDPR and Processed in a third country that does not have an adequacy decision by the UK’s Information Commissioner’s Office or the European Commission, as applicable (each a “Third Country”), The EU SCCs are completed as follows: Controller to Processor. (i) Module Two applies; (ii) Clause 7 (Docking Clause) is included; (iii) in Clause 9, option 2 for general authorization with a time period of 30 days; (iv) in Clause 11 the optional text is not included; (v) in Clause 17, option 1 and Ireland; (vi) in Clause 18(b), Ireland; (vii) Annex I and II within the EU SCCs are deemed completed with the information set out in Appendix A attached to this DPA and in the Subprocessor List. HireGlobal will be considered the data exporter and Controller will be considered the data importer. (b) UK Standard Contractual Clauses. The EU SCCs are deemed entered into by the Parties without further action and also apply to Processing Personal Data that is subject to the Section 3 of the UK GDPR and the Data Protection Act 2018 and Processed in a Third Country with the following modifications: any references to "Directive 95/46/EC" or "Regulation (EU) 2016/679" are replaced with references to the UK GDPR; references to specific Articles of "Regulation (EU) 2016/679" are replaced with the equivalent Article or Section of the UK GDPR; references to "EU", "Union", and "Member State law" are all replaced with "UK"; Clause 13(a) and Part C of Annex I is not used; references to the "competent supervisory authority" and "competent courts" will be interpreted as references to the UK’s Information Commissioner’s Office and the courts of England and Wales; and Clause 17 is replaced to state that "The Clauses are governed by the laws of England and Wales" and Clause 18 is replaced to state "Any dispute arising from these Clauses will be resolved by the courts of England and Wales. A data subject may bring legal proceeding against the data exporter and/or data importer before the courts of any country in the United Kingdom. The Parties agree to submit themselves to the jurisdiction of such courts". (c) If the EU SCCs as implemented above cannot be used to lawfully process Personal Data in compliance with the UK GDPR, then the standard contractual clauses for Controllers to Processors approved by the Information Commissioner’s Office and adopted pursuant to Article 46(2)(c) or (d) of the UK GDPR (“UK SCCs”) will also apply to such Processing. Where this is the case, the relevant appendices of the UK SCCs will be populated using the information contained in the Subprocess List and Appendix A, except that Section 7 within Appendix A will refer to the UK’s Information Commissioner’s Office. For purposes of the UK SCCs, Controller will be deemed a data exporter and Processor a data importer. (d) To the extent this DPA conflicts with the EU SCCs as completed by Section 8 of this DPA or the UK SCCs, the EU SCCs or the UK SCCs as completed by Section 8 of this DPA, as applicable, will control. 9. No Consequential Damages; Limitation of Liability. (a) No Consequential Damages. NEITHER PARTY WILL BE LIABLE TO THE OTHER PARTY OR ANY OF ITS AFFILIATES FOR ANY INCIDENTAL, CONSEQUENTIAL, INDIRECT, SPECIAL, PUNITIVE OR EXEMPLARY DAMAGES (INCLUDING DAMAGES FOR LOSS OF BUSINESS, LOSS OF PROFITS OR THE LIKE) ARISING OUT OF OR RELATING TO THIS DPA, SUCH PARTY’S OR ITS AFFILIATES’ PERFORMANCE HEREUNDER, OR ANY INTERRUPTION OR DISRUPTION OF OR BY ANY OF THE FOREGOING, EVEN IF A PARTY OR ITS AFFILIATES HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND REGARDLESS OF THE CAUSE OF ACTION (WHETHER IN CONTRACT, TORT, BREACH OF WARRANTY OR OTHERWISE). (b) Limitation of Liability. NOTWITHSTANDING ANY OTHER PROVISION IN OR MADE A PART OF THIS DPA, AND EXCEPT ONLY WITH RESPECT TO LIABILITIES THAT MAY NOT BE LIMITED OR EXCLUDED AS A MATTER OF APPLICABLE STATUTORY OR CASE LAW, THE AGGREGATE LIABILITY OF EACH PARTY AND ITS AFFILIATES WITH REGARD TO OR ARISING UNDER THIS DPA WILL IN NO EVENT EXCEED THE LESSER OF (A) THE FEES PAID BY CLIENT OR A CLIENT AFFILIATE TO HIREGLOBAL CONNECTION WITH THE PRODUCT DURING THE SIX (6) MONTHS IMMEDIATELY PRECEDING THE DATE ON WHICH SUCH CLAIM FIRST ARISES AND (B) TWO HUNDRED AND FIFTY THOUSAND DOLLARS (USD $250,000); PROVIDED THAT THE LIMITATIONS OF LIABILITY SET FORTH IN THIS SECTION 9.4.2. WILL NOT BE CONSTRUED OR INTERPRETED TO LIMIT THE PAYMENT OBLIGATIONS OF CLIENT OR A CLIENT AFFILIATE IN CONNECTION WITH THE PRODUCT. 10. Miscellaneous. (a) HireGlobal may assign this DPA to any HireGlobal Affiliate at will. Client may not assign this DPA to another party without HireGlobal’s written consent. This DPA, together with the attached Appendix A, constitutes the entire agreement between the Parties with to the subject matter herein. No waiver, change, or modification to this DPA will be effective unless in writing signed by both Parties. Both Parties have had the opportunity to review and negotiate this DPA, and neither party will be deemed the drafter of this DPA for the purposes of interpreting any ambiguity in this DPA. To the extent there is any conflict between this DPA and any other agreement between the Parties regarding the subject matter of this DPA, this DPA controls. In the event that any provision of this DPA will be determined to be illegal or unenforceable, that provision will be first revised to give the maximum permissible effect to its original intent or, if such revision is not permitted, that specific provision will be eliminated so that this DPA will otherwise remain in full force and effect and enforceable. Processor is an independent contractor of Controller, and neither Party is authorized to and will not bind or attempt to bind the other the Party. This DPA is made under, and will be construed and enforced in accordance with, the laws of the State of New York applicable to agreements made and performed therein, without giving effect to principles of choice or conflicts of law. The Parties agree that the federal or state courts of competent jurisdiction sitting in New York County, New York will have exclusive jurisdiction. The Parties hereby submit to the exclusive jurisdiction of such federal or state court in New York and waive any claim of inconvenient forum. This Section will survive termination or expiration of this DPA. Appendix A 1. Subject matter and retention period Personal Data related to Processor’s provision of the Product to Controller, which may be retained until Client requests the return or deletion of Personal Data. 2. Nature and purpose of Processing In connection with the provision of the Product at the Controller’s request. 3. Types of Processed Personal Data Personal Data may include names, email addresses, phone numbers, locations, or other identifying factors, including those related to human resource management, such as bank account information. 4. Duration of Processing Until the termination of Client’s use of the Product. 5. Special Categories of Data None. 6. Categories of data subjects / consumers Controller’s personnel and/or prospective workers. 7. Competent Supervisory Authority: Irish Data Protection Commission (DPC). 8. Subprocessors: As listed at toptal.com/hireglobal/subprocessors.