Snapshot 233185
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Version:
October 2022
DATA PROCESSING AGREEMENT (“DPA”)
I) General Commission to provide adequate protection for personal data
pursuant to Article 45(3) GDPR.
1. Scope
“Processing of EEA Personal Data” for the sake of this
The DPA is incorporated by reference into and forms an DPA, means processing of personal data which falls in the scope
integral part of the Agreement (as defined in the Terms and of the GDPR or Privacy Laws of UK or Switzerland.
Conditions), unless the parties enter into a separate data
“Standard Contractual Clauses” or “SCCs”- means
processing agreement as part of specific agreements. In the
the standard contractual clauses for the transfer of personal
event of any inconsistency between the DPA and any other
data to third countries as to the Commission Implementing
terms of the Agreement, the DPA shall prevail.
Decision (EU) 2021/914 of 4 June 2021 or any successor or
This DPA applies where TD SYNNEX, acting in a capacity of a supplementing decision;
processor, processes personal data on behalf and in accordance
“Privacy Law” means all applicable laws and regulations
with the instructions of Buyer, acting on its own behalf or
relating to the processing of personal data and privacy that may
on behalf of its customers or their end users (“Clients”) in a
exist in the relevant jurisdictions, for member states of the EU
capacity of a controller. It also applies in case that Buyer, acting
or EEA this includes the GDPR;
in a capacity of a processor, should process personal data on
behalf and in accordance with the instructions of TD SYNNEX “TOMs” means the technical and organizational measures in
acting [on its own behalf or on behalf of a third party] in a the meaning of Privacy Laws;
capacity of a controller.
“Sub-Processor” or “Sub-(sub)processor” means third
This DPA does not apply to TD SYNNEX and Buyer sharing parties authorized under this DPA to have logical access to and
personal data with each other as separate or joined controllers. process personal data in accordance with the Agreement;
TD SYNNEX typically acts as a separate controller if: “Data Transfer” means any party transmitting or giving
access to personal data.
(a) it collects personal data in connection with Buyer’s
operations (such as personal data relating to Buyer’s “Exporter” means any party of a Data Transfer that is located
employees); in the EEA, UK, or Switzerland.
(b) TD SYNNEX processes end user personal data provided by
Buyer’s customer for: II) Special terms for TD SYNNEX as a Processor
(i) carrying out fraud, anti-money laundering, sanctions This section II applies where TD SYNNEX, acting in a capacity
and any other checks including denied party list of a processor, processes personal data on behalf and bound by
screenings, and investigating and prosecuting the instructions of Buyer, acting on its own behalf or on behalf
fraud, money laundering or sanctions violations in of Clients in a capacity of a controller. It applies in addition to
connection with the establishment and maintenance of section III below. In case of an inconsistency between sections
a client relationship and provision of services; II and III, this section II shall prevail.
(ii) compliance with legal and regulatory obligations; 1. Electronical communication. TD SYNNEX may
provide Buyer with information and notices in the context
(iii) anonymization and/or data analytics; and of this DPA electronically, including via email, through the
(iv) the fulfilment of the Agreement, including drop TD SYNNEX standard website, or through a web site that
shipments and, if necessary for the fulfillment of the TD SYNNEX identifies.
Agreement, the transfer of such personal data to third 2. Details of Processing. By using the Services, Buyer
parties who are acting as a controller, such as carriers, agrees to the details of processing including nature,
manufacturers or third party service providers. purpose and subject matter of processing, categories of
data subjects, types of personal data, special categories
2. Definitions of personal data, TOMs and other processors – where
Any term not defined in this DPA or in other parts of the relevant – as defined in the Agreement (including this
Agreement shall have the meaning ascribed to them under the DPA) and as otherwise made available and communicated
General Data Protection Regulation (EU 2016/679) (“GDPR”). by TD SYNNEX electronically, including via email, through
References to articles of GDPR herein [Art….GDPR] shall apply the TD SYNNEX standard website, or through a web site
only to the extent that the processing is subject to the GDPR – that TD SYNNEX identifies.
for all other relevant jurisdictions the corresponding applicable 3. Standard Contractual Clauses. SCCs, if applicable
data protection laws apply. between TD SYNNEX and Buyer, can be found on the TD
“Third Country” means any country which is neither a SYNNEX standard website, or through a web site that TD
member state of the European Union (”EU”) or the European SYNNEX identifies.
Economic Area (“EEA”), nor is confirmed by the European
1
Version:
October 2022
4. Obligations of TD SYNNEX and Buyer. 1. Obligations of Controller
4.1. TD SYNNEX will comply with all Privacy Law applicable to 1.1. Controller shall be solely responsible for complying with
it in its role as a processor. TD SYNNEX is not responsible all statutory obligations of a controller in view of the
to comply with any laws or regulations applicable to processing according to Privacy Laws. Controller shall,
Buyer´s or its Clients’ industry that are not generally upon termination or expiration of the Agreement and
applicable to providers of the respective Products. TD by way of issuing an instruction, stipulate the measures
SYNNEX does not determine whether Buyer´s or its to return data carrier media including personal data or
Clients’ data includes information subject to any specific to delete stored personal data, and will notify processor
law or regulation. without undue delay of any errors or irregularities it gains
knowledge of in connection with the processing of personal
4.2. Buyer shall evaluate and determine the suitability,
data by the processor.
appropriateness and compliance of Buyer’s or its Clients’
use of the Products with laws and regulations including 1.2. Controller will not use the Products in conjunction with
Privacy Laws especially in terms of the TOMs, other personal data to the extent that doing so would violate
processors involved, data center location and relevant Privacy Laws and will oblige its Clients accordingly.
transfer of data as described in the Agreement including
the DPA and the details of processing. 2. Obligations of Processor
4.3. If Buyer himself is not the controller of the personal data 2.1. Compliance with Processor obligations. Processor
but processes personal data on behalf of Clients, Buyer will comply with all obligations applicable to processors
warrants to have all contracts in place and to have all according to EEA data Privacy Law. Processor is not
necessary permissions and authorizations of Client(s): responsible for determining the requirements of laws
applicable to controller’s or Clients’ business or industry
- to act in relation to TD SYNNEX as the controller under
or that processor´s provision of the Products meet the
this DPA and exercise all rights as a controller towards TD
requirements of such laws.
SYNNEX and its other processors with regard to the DPA;
2.2. Instructions. Processor shall process personal data
- to use TD SYNNEX as a processor to process personal data,
solely in accordance with controller´s written instructions,
as set out in the Agreement including this DPA and the
which are defined in the Agreement including this DPA
details of processing;
and its exhibits, – if applicable –controllers´ authorized
- to be the single point of contact to TD SYNNEX for all use and configuration of the Products or otherwise in
instructions, notices, information and communication writing. Processor shall inform the controller immediately
in connection with this DPA and to interface relevant if processor believes controller´s instruction to be in
communication between Clients and TD SYNNEX, where violation of applicable data protection law, and/or of
legally required. TD SYNNEX shall be discharged of any contractual duties under the Agreement including this
obligation to inform or notify a Client when TD SYNNEX DPA. Processor is entitled to suspend the implementation
has provided such information or notice to Buyer. TD of such instruction until it is examined by the controller
SYNNEX will serve as a single point of contact in view of and confirmed or changed as a result. Processor is
TD SYNNEX´s other processors. permitted process personal data without the controller’s
instruction if required to do so by the law of the EU or its
- to exercise Exporters’ rights according to the Standard
member states to which the processor is subject; in such a
Contractual Clauses – where applicable – towards (i) TD
case, the processor shall inform the controller of that legal
SYNNEX and/or (ii) its other processors via TD SYNNEX
requirement before processing, unless that law prohibits
on behalf of Exporter.
such information on important grounds of public interest.
III) General Processing Terms 2.3. Disclosure/Access. Processor shall not disclose personal
data to any third party, unless authorized by controller
This section III applies in addition to section II where TD or required by the law of the EU or its member states. If
SYNNEX, acting in a capacity of a processor , processes such law requires to give third party, or a government,
personal data on behalf and bound by the instructions of Buyer, court or supervisory authority based on such law demands
acting on its own behalf or on behalf of Clients in a capacity of a access to personal data, processor will notify controller
controller. It also applies in case that Buyer, acting in a capacity prior to disclosure, unless prohibited by law on important
of a processor, should process personal data on behalf and in grounds of public interest. Unless obliged to do so by the
accordance with the instructions of TD SYNNEX acting [on law of the EU or its member states, processor shall not
its own behalf or on behalf of a third party] in a capacity of a disclose or release any personal data in response to such
controller. request served on processor without first consulting with
controller. Where controller’s personal data becomes
subject to search and seizure, confiscation during
bankruptcy or insolvency proceedings, or similar events or
measures by third parties while being processed, processor
shall inform controller without undue delay.
2.4. Duty of confidence. Processor requires all of its
personnel and persons being entrusted with the processing
2
Version:
October 2022
of personal data, to commit themselves to confidentiality - 3. Technical and Organizational Security Measures
unless an appropriate statutory obligation of confidentiality
3.1. Processor and controller shall implement and maintain
applies - and not to process such personal data for any
TOMs as required by applicable Privacy Law. This includes
other purpose except on instructions from controller or
implementing and maintaining TOMs to ensure a level of
otherwise required by the law of the EU or its member
security appropriate to the risks or damage to personal
states.
data, appropriate to the harm that might result from the
2.5. Data Subject Rights. Processor shall reasonably unauthorized or unlawful processing or accidental loss,
assist controller upon controller´s request and as legally destruction or damage and the nature of the data to be
required, in providing data subject access and to respond protected, having regard to the state of technological
to any requests, complaints or other communications development and the cost of implementing any measures
from a data subject, including requests from data subjects (those measures may include, where appropriate,
seeking to exercise their rights under Privacy Laws. If any pseudonymizing and encrypting personal data, ensuring
such request, complaint or communication is received by confidentiality, integrity, availability and resilience of its
or otherwise made to processor, processor shall inform systems and services).
controller without undue delay, if processor is able to
3.2. TOMs are subject to technical progress and further
correlate data subject to controller.
development. Processor reserves the right to modify the
2.6. Data Breach. Processor will notify controller without measures and safeguards implemented, provided, however,
undue delay after becoming aware of any personal data that the functionality and security of the Products are not
breach (“Data Breach”) affecting controller´s personal degraded. Any substantial security-related decisions on the
data. Processor shall take such measures and actions as organization of data processing and the applied procedures
reasonable to remedy or mitigate the effects of the personal shall be notified to controller.
Data Breach and shall assist the controller in ensuring
3.3. By using a Product, controller acknowledges the TOMs as
compliance with its obligations under applicable Privacy
outlined in the Agreement and/or provided by Processor
law to notify the Data Breach to supervisory authorities
and confirms the TOMs to provide an adequate level
and data subjects taking into account the nature of
of protection in respect to the risks associated with the
processing and the information available to the processor.
processing of personal data.
Particularly, processors shall cooperate with controller by
providing regular updates and other reasonably requested
4. Documentation and Audit Obligations
information. Any press release, notification, public or
regulatory announcement or communication concerning a 4.1. Upon controller´s request, processor shall make available
Data Breach shall be made by controller at controller’s sole to controller, or an authorized third party acting on
discretion, except as otherwise required by applicable laws. controller’s behalf, information necessary for controller or
Clients to comply with their own audit obligations under
2.7. Assistance with Controller obligations. Processor
applicable data protection laws or a supervisory authority´s
shall reasonably assist controller upon controller’s
request, and shall allow for and contribute to reviews and
request, with controller’s obligations regarding security of
audits including inspections as stipulated below.
processing, data protection impact assessments and prior
consultations taking into account the information available 4.2. Controller may request processor to provide relevant
to TD SYNNEX and the nature of processing. Processor information on the TOMs including – where available
will provide assistance in connection with audits of any – auditor’s certificates, reports or excerpts from reports
competent supervisory authority to the extent such audit provided by independent bodies (e.g. auditor, data
relates to the processing of personal data by the processor protection officer, IT security department, data privacy
under this Agreement and as reasonably requested by auditor, quality auditor).
the controller. Processor’s assistance may be subject to
reasonable charge unless processor’s assistance is already 4.3. To the extent it is not possible to otherwise satisfy an audit
addressed in the Agreement accordingly. obligation mandated by applicable Privacy Law, controller
or its mandated auditor may conduct personal on-site
2.8. End of Contract. Processor shall, at the choice of audits at controller´s cost on individual basis, usually
controller, delete or return all personal data to controller not more often than once a year, during regular business
upon termination or expiry of the Agreement, and delete hours, with reasonable interference with processor’s
existing copies unless EU or member state law requires operations and upon reasonable prior notice. Processor
processor’s storage of the personal data. may determine that such audits and inspections are subject
to the execution of a confidentiality undertaking protecting
the data of other customers and the confidentiality of the
TOMs and safeguards implemented.
4.4. Controller shall inform processor without undue delay
about any errors or irregularities detected during an audit.
3
Version:
October 2022
5. Sub-processor 7. Confidentiality
5.1. Controller authorizes processor herewith to transfer Parties shall not disclose any confidential information shared in
personal data or give access to personal data to other connection with this DPA except (i) as required in this DPA or
processors engages by it (and permit other processors to parties’ instruction, (ii) as required by law, (iii) in response to a
do so in accordance with this Clause 5) for the purposes of competent authority or regulatory or government agency, and
providing the Products subject to controller´s obligations (iv) for disclosures to its employees, agents and contractors that
under this Clause 5. The above authorization constitutes are bound by confidentiality on a need-to-know basis.
controller´s prior written consent to the involvement of
other processors by processor if such consent is required
under the Standard Contractual Clauses or Privacy Law.
Processor remains responsible for its other processors’
compliance with the obligations of this DPA. Processor
makes available to controller a current list of other
processors, e.g. on a processor website.
5.2 Controller shall be entitled to object to the engagement of
a new processor within 10 days of notification. Otherwise
controller shall be deemed to have approved such new
assignment or change. Where a materially important
reason for an objection exists, and failing an amicable
resolution of this matter by the parties, controller shall
be entitled to terminate the Agreement in respect of the
concerned Product.
5.3 Processor enters into written agreements with each other
processor it engages being not less protective than those
stipulated in this DPA. Such contract in particular provides
sufficient guarantees to implement appropriate TOMs.
6. International Data Transfer
6.1. Controller authorizes processor herewith to transfer or give
access to the personal data in the context of the services as
outlined in the Agreement, the details of processing and/or
the SCCs – where relevant.
6.2. Any processing of personal data outside the country or
region where controller is located is subject to an adequate
data transfer mechanism if and as required by Privacy Law.
6.3. For international data transfers in the context of the
Processing of EEA Personal Data, SCCs have to be executed
between TD SYNNEX and Buyer if the party transmitting
or giving access to personal data, is located in the EEA,
UK, or Switzerland and the other party, receiving or having
access to such data is located in a Third Country . The
terms of this DPA are not intended to amend or modify
the SCCs but provide clarity in terms of processes and
procedures for complying with the SCCs. In the event of
any conflict between the terms of this DPA and the SCCs,
the SCCs shall prevail.
6.4. For Data Transfers in connection with processor engaging
other processors, processor enters into the applicable
Standard Contractual Clauses (Processor to Processor)
with the other processors and obliges the other processors
accordingly with regard to any further onward transfer.
4