Snapshot 255907
Normalized text
Scripts and page chrome removed; this is what change detection compares.
🔎 Popl now powers your pre-event workflows: Introducing Popl Prospect
Data Protection Addendum
Print this page
Data Protection Addendum
Customers trust Popl with their data, and the Popl team takes that responsibility seriously. Security and compliance are top priorities for Popl because they are fundamental to customers’ trust with our service. Popl is committed to securing the customer data, eliminating systems vulnerability, and ensuring continuity of service. Popl uses a variety of best practices, along with industry-standard technologies and services to secure your data from unauthorized access, disclosure, use, and loss.
This Data Protection Regulation Addendum (“Data Protection Addendum”) is part of the Terms of Service available at https://popl.co/pages/popl-teams-terms-of-service or, if applicable, any other separate written agreement (“Services Agreement”), by and between Popl Co., a Delaware corporation (“Company”) and Customer named in Services Agreement. The parties agree this Data Protection Addendum is an extension of Services Agreement and as an extension, Data Protection Addendum will outline certain requirements for Company’s processing of personal data on behalf of Customer in the course of providing services to Customer.
Table of Contents
1. Definitions
2. Scope
3. Protection
4. Incidents
5. Appendix 1: Subject Matter and Details of the Data Processing
6. Appendix 2: Technical and Operational Security Policies and Practices
7. Appendix 3: List of Subprocessors
1. Definitions
1.1 “Data Protection Laws” means applicable laws relating to privacy and the processing of personal data that may exist in any relevant jurisdiction where Company conducts business. Data Protection Law includes, where applicable, European Data Protection Laws and Non- European Data Protection Laws (as defined below).
1.1.1 “European Data Protection Laws” means all data protection laws and regulations applicable to European Economic Area and its member states (“EEA”), Switzerland and the United Kingdom (“UK”), including;
(i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (“GDPR”);
(ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector;
(iii) applicable national implementations of (i) and (ii);
(iv) the GDPR as it forms part of UK law by virtue of section 3 of the UK European Union (Withdrawal) Act 2018 and the UK Data Protection Act 2018 (together, “UK Data Protection Laws”); and
(v) the Swiss Federal Act on Data Protection, as revised effective September 1, 2023, and its ordinances (“Swiss DPA”).
1.1.2 “Non-European Data Protection Laws” means the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations (“CCPA”); other U.S. state consumer privacy laws, to the extent applicable to the processing; the Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”); the Brazilian General Data Protection Laws (“LGPD”), Federal Law no. 13,709/2018; the South African Protection of Personal Information Act 4 of 2013 and its regulations (“POPIA”); and the Privacy Act 1988 (Cth) of Australia, as amended (“Australian Privacy Law”).
1.2 “Quality Industry Practice” means, in relation to any activity and under any circumstance, exercising the same skill, expertise and judgement and using facilities and resources of a similar or superior quality as would be expected from a person who:
(a) Is skilled and experienced in providing the services in question, seeking in good faith to comply with his contractual obligations and seeking to avoid liability arising under any duty of care that might reasonably apply;
(b) Takes all proper and reasonable care and is diligent in performing his obligations; and
(c) Complies with all applicable laws and any applicable industry standards including any recognized industry quality standards and applicable law.
1.3 “Standard Contractual Clauses” mean the standard contractual clauses for the transfer of personal data to third countries issued by the European Commission on the basis of Article 46(2)(c) of the GDPR pursuant to Commission Implementing Decision (EU) 2021/914. Where applicable, the Standard Contractual Clauses may be varied by the UK Transfer Addendum or other applicable addendums, as per guidance from the UK Information Commissioner’s Office (ICO). The Standard Contractual Clauses include Module Two (controller-to-processor) and, where applicable, Module One (controller-to-controller).
1.4 The terms “Appropriate Technical and Organizational Measures”, “Data Controller”, “Data Processor”, “Data Subject”, “Personal Data”, “Processing”, and “Subprocessor”, have the meaning given to them under applicable Data Protection Laws or if not defined thereunder, the GDPR, and “process”, “processes" and “processed”, with respect to any personal data, shall be interpreted accordingly. Capitalized terms used but not defined in this Data Protection Addendum have the meanings given to them in the Services Agreement or, if not defined there, in the Terms of Service.
1.5 "Customer Personal Data" means personal data contained in Customer Content (as defined in the Services Agreement), including Scanned Personal Data, that Company processes on behalf of Customer in the course of providing the Services.
1.6 "Data Provider Terms" means any license terms or use restrictions applicable to Popl Data that Company makes available to Customer.
2. Scope
2.1 Roles: The parties agree that, as between the parties, Customer is a Data Controller and that Company is a Data Processor in relation to personal data that Company processes on behalf of Customer in the course of providing the services under Services Agreement (“Services”).
2.1.1 Customer Personal Data. As between the parties, Customer is a Data Controller and Company is a Data Processor with respect to Customer Personal Data.
2.1.2 Popl Data. Company is an independent Data Controller with respect to its sourcing of Popl Data, its maintenance of that data, and its disclosure of that data to Customer through the Services. Upon Company making Popl Data available to Customer, Customer is an independent Data Controller with respect to its own use of that data.
2.1.3 Storage on Customer's Behalf. To the extent Company stores, displays, or transmits Popl Data within Customer's account or to systems Customer connects to the Services, Company does so on Customer's behalf, and Sections 3.3, 3.5, and 4 apply to such data. This Section 2.1.3 does not affect Company's role under Section 2.1.2.
2.2 Categories: The subject-matter of the data processing, the types of personal data processed, and the categories of data subjects will be defined by, and/or limited to that necessary to carry out Services described in, Services Agreement. The categories of data subjects and personal data are set forth on Appendix 1 hereto.
2.3 Duration: Processing will be carried out until the date Company ceases to provide Services to Customer.
2.4 Popl Data.
2.4.1 Company. With respect to Popl Data processed as a Data Controller, Company will (a) comply with Data Protection Laws; (b) maintain a lawful basis for its processing and the contractual rights from Data Providers necessary to make Popl Data available to Customer; (c) provide any notice to data subjects required of Company by Data Protection Laws, including through Company's privacy notice; (d) respond to data subject requests directed to Company; and (e) notify Customer where a data subject's deletion, objection, or opt-out request concerns Popl Data Company has provided to Customer and Data Protection Laws require such notice.
2.4.2 Customer. Customer will (a) use Popl Data only as permitted by the Services Agreement, any Data Provider Terms, and Data Protection Laws; (b) maintain its own lawful basis and provide any notice to data subjects required of Customer for its own use of Popl Data; and (c) honor suppression, deletion, or opt-out notices Company provides under Section 2.4.1(e).
2.4.3 Cooperation. Each party will provide reasonable assistance to the other in responding to data subject requests, complaints, or regulatory inquiries that concern the other party's processing of Popl Data.
2.4.4 Inapplicable Provisions. Sections 3.1, 3.2, 3.4, 3.6, 3.7, and 3.9 do not apply to Company's processing of Popl Data as a Data Controller.
2.5 CCPA. For purposes of the CCPA, Company is a "service provider" with respect to Customer Personal Data. With respect to Popl Data, Company acts as a "business" and is responsible for its own obligations under the CCPA. Company shall not sell, lease, or rent Customer Personal Data as part of its business activities as a service provider. To the extent Company’s disclosure of Popl Data to Customer is a sale of personal information under the CCPA, Company makes Popl Data available to Customer only for the purposes described in Section 4.10.3 of the Terms of Service (sales, marketing, recruiting, and business development outreach directed to individuals in their professional capacity), and Customer will use Popl Data only for those purposes, will comply with its obligations under the CCPA and provide the same level of privacy protection as the CCPA requires of Company, will notify Company if it determines that it can no longer meet those obligations, and will permit Company, upon notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Popl Data. Company may take reasonable and appropriate steps to ensure that Customer uses Popl Data in a manner consistent with Company’s obligations under the CCPA, including through Section 4.10.6 of the Terms of Service.
3. Protection
Regarding Customer Personal Data (and, to the extent provided in Section 2.1.3, Popl Data stored or transmitted on Customer's behalf) processed in the course of providing Services, Company will adhere to the following requirements:
3.1 Instructions: Company will process the Customer Personal Data only in accordance with the written instructions from Customer and only in compliance with Data Protection Laws. Such instructions may be specific or of a general nature as set out in this Data Protection Addendum, the Services Agreement, or as otherwise notified by Customer to Company in writing from time to time. The nature and purposes of the processing shall be limited to that necessary to carry out such instructions, and not for Company's own purposes, or for any other purposes except as required by law. If Company is required by law to process the personal data for any other purpose, Company will inform Customer of such requirement prior to the processing unless prohibited by law from doing so. Nothing in this Section 3.1 limits Company's processing of Popl Data as a Data Controller under Section 2.1.2.
Customer instructs Company to process Customer Personal Data to the extent necessary to create Aggregated Data (as defined in Section 4.11 of the Terms of Service) solely for the purposes of operating, maintaining, and improving the Services, and Company shall carry out such processing as a Processor in accordance with this Data Protection Addendum. Data that has been anonymized and aggregated in accordance with Section 4.11 of the Terms of Service, such that it no longer constitutes personal data under Data Protection Laws, shall not be subject to this Data Protection Addendum; provided that Company’s use of such Aggregated Data shall remain subject to the restrictions in Section 4.11 of the Terms of Service. Any Aggregated Data that constitutes, or becomes capable of being used to identify, any individual shall be treated as personal data subject to this Data Protection Addendum. Aggregated Data shall not include Enriched Personal Data, and Company shall not use Aggregated Data to create, supplement, or validate Enriched Personal Data.
3.2 Extent: Company will process the personal data only to the extent, and in such manner, as is necessary for the provision of Services. Company may only correct, delete or block the personal data processed on behalf of Customer as and when instructed to do so by Customer.
3.3 Measures: Company will implement and maintain appropriate technical and organizational measures to protect the personal data against unauthorized or unlawful processing and against accidental loss, destruction, damage, theft, alteration, or disclosure. These measures will consider the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. The measures shall be appropriate to the harm which might result from any unauthorized or unlawful processing, accidental loss, destruction, damage, or theft of the personal data and having regard to the nature of the personal data which is to be protected and as a minimum shall be in accordance with the Data Protection Laws and Quality Industry Practice. Such measures shall include, as appropriate:
3.3.1 Encryption and pseudonymization of personal data;
3.3.2 Ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
3.3.3 Ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
3.3.4. Process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.
3.4 Access: Company will not give access to or transfer any personal data to any third party (including any affiliates, group companies or subcontractors) without giving Customer prior notice and an opportunity to object to Customer via an update to https://security.popl.co/subprocessors; notwithstanding the foregoing, the sub-contractors listed on https://security.popl.co/subprocessors as of the date of this Data Protection Addendum are deemed pre-approved by Customer, subject to the conditions contained herein. Where Customer does not object in good faith on grounds related to data protection to Company engaging a subcontractor to carry out any part of Services, Company must ensure the reliability and competence of such third party, its employees or agents who may have access to the personal data processed in the provision of Services, and must include in any contract with such third party provisions in favor of Customer which are substantially equivalent to those in this Data Protection Addendum and Services Agreement and as are required by applicable Data Protection Laws. For the avoidance of doubt, where a third party fails to fulfil its obligations under any sub-processing agreement or any applicable Data Protection Laws, Company will remain fully liable to Customer for the fulfilment of its obligations under this Data Protection Addendum and the Services Agreement. Company’s Data Providers are subcontractors for purposes of this Section 3.4 to the extent Company discloses personal data to them to generate Popl Data for Customer. Data Providers are not Subprocessors with respect to Popl Data.
3.5 Personnel: Company will take reasonable steps to ensure the reliability and competence of any Company personnel who have access to the personal data. Company will ensure that all Company personnel required to access the personal data are informed of the confidential nature of the personal data and comply with the obligations set out in this Data Protection Addendum.
3.6 Obligations: Company will take all reasonable steps to assist Customer in meeting Customer’s obligations under applicable Data Protection Laws, including Customer’s obligations to respond to requests by data subjects to exercise their rights with respect to personal data, adhere to data security obligations, respond to data breaches and other incidents involving personal data, conduct data protection impact assessments, and consult with supervisory authorities. Company will promptly inform Customer in writing if it receives:
(i) a request from a data subject concerning any personal data; or
(ii) a complaint, communication, or request relating to Customer’s obligations under Data Protection Laws.
3.7 Retention: Company will not retain any of the personal data for longer than is necessary to provide the Services. At the end of Services, or upon Customer's request, Company will securely destroy or return (at Customer’s election) the personal data to Customer. Upon termination of the Services, and in accordance with Section 6.6 of the Terms of Service, Company will delete Popl Data from Customer's account. Company may retain Popl Data in its own systems as a Data Controller in accordance with Data Protection Laws and its agreements with Data Providers. Customer's rights to retain Popl Data after termination are governed by the Services Agreement and any applicable Data Provider Terms.
3.8 Location: Regarding personal data related to data subjects located in the European Economic Area, Customer hereby gives consent to the processing of such personal data in the United States by Company, provided that:
3.8.1 Company will take such steps as may reasonably be required by Customer on an ongoing basis to ensure there is adequate protection for such personal data in accordance with applicable Data Protection Laws; and
3.8.2 Company will process such data in accordance with Standard Contractual Clauses. For the purposes of the descriptions in Standard Contractual Clauses and only as between Customer and Company, Customer agrees that Customer is a data controller and "data exporter" and Company is the data processor and "data importer". For purposes of the Standard Contractual Clauses, the optional docking clause in Clause 7 applies; Option 2 of Clause 9(a) applies, and the time period for the notice described in Section 3.4 is [fifteen (15)] days; the optional language in Clause 11(a) does not apply; Option 1 of Clause 17 applies, with the law of Ireland; and the courts of Ireland are the courts referred to in Clause 18(b). Appendixes 1, 2, and 3 of this Data Protection Addendum constitute Annexes I, II, and III of the Standard Contractual Clauses, respectively, and the competent supervisory authority for purposes of Annex I.C is determined in accordance with Clause 13. Module Two applies to Customer Personal Data. To the extent any transfer of Popl Data between the parties constitutes a restricted transfer under European Data Protection Laws, Module One applies, with the transferring party acting as data exporter.
3.9 Audit: Company will allow Customer and its respective auditors or authorized agents to conduct reasonable audits and inspections during the term of Services Agreement, solely to allow Customer to verify that Company is processing personal data in accordance with its obligations under this Data Protection Addendum, Services Agreement, and applicable Data Protection Laws.
3.10 CCPA: To the extent the CCPA applies to personal data that Company processes on behalf of Customer, Company will act as Customer’s service provider with respect to that personal data and will not (a) sell or share it; (b) retain, use, or disclose it for any purpose, including any commercial purpose, other than the business purposes described in this Section 3.10 or as otherwise permitted by the CCPA; (c) retain, use, or disclose it outside the direct business relationship between Customer and Company; or (d) combine it with personal data that Company receives from or on behalf of another person, or collects from its own interactions with consumers, except as permitted by the CCPA. Customer discloses such personal data to Company for the business purposes of providing the Services described in the Services Agreement, including capturing contact information from event badges, business cards, and QR codes, enriching Customer’s contact records with Popl Data, transcribing and summarizing audio recordings, synchronizing data with systems that Customer connects to the Services, and providing support. Company will comply with its obligations under the CCPA and provide the same level of privacy protection as the CCPA requires of Customer, will notify Customer if it determines that it can no longer meet those obligations, and will permit Customer, upon notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of such personal data. Customer may take reasonable and appropriate steps to ensure that Company uses such personal data in a manner consistent with Customer’s obligations under the CCPA, including through the audit rights in Section 3.9. Customer will inform Company of any consumer request under the CCPA with which Company must comply and provide the information Company needs to comply with it.
3.11 POPIA: For purposes of this Section 3.11, “responsible party,” “operator,” and “personal information” have the meanings given in POPIA. To the extent Customer, as a responsible party in the Republic of South Africa, transfers personal information subject to POPIA to Company, Company acts as Customer’s operator with respect to that personal information, and the parties intend this Data Protection Addendum to constitute a binding agreement that provides an adequate level of protection for purposes of Section 72(1)(a) of POPIA. With respect to such personal information, (a) references in this Data Protection Addendum to personal data include personal information, which may include information relating to an identifiable, existing juristic person; (b) Company will process it in accordance with principles substantially similar to the conditions for the lawful processing of personal information set out in Chapter 3 of POPIA, to the extent those conditions are relevant to Company’s role as operator; and (c) Company will not transfer it to any third party outside the Republic of South Africa, including a subcontractor engaged under Section 3.4, unless that third party is subject to a law, binding corporate rules, or binding agreement that provides a level of protection substantially similar to the protection provided in this Section 3.11 (including with respect to further transfers) or the transfer is otherwise permitted under Section 72(1) of POPIA. Clause (c) does not apply to a transfer to Customer or to a third party at Customer’s direction, including a system that Customer connects to the Services.
4. Incidents
4.1 Response: If Company becomes aware of any accidental, unauthorized or unlawful destruction, loss, alteration, or disclosure of, or access to the personal data that is processed by Company in the course of providing Services under Services Agreement (a “Security Incident”), then Company will:
4.1.1 Without undue delay, and in any event no later than seventy-two (72) hours from becoming aware of the Security Incident, notify Customer and provide Customer with:
(i) a detailed description of the Security Incident;
(ii) the type of data that was the subject of the Security Incident;
(iii) the identity of each affected person, and
(iv) the steps Company takes in order to mitigate and remediate such Security Incident, in each case as soon as such information can be collected or otherwise becomes available (as well as periodic updates to this information and any other information Customer may reasonably request relating to the Security Incident); and
4.1.2 Immediately act, at Company’s own expense, to investigate the Security Incident and to identify, prevent and mitigate the effects of the Security Incident, and carry out any recovery or other action necessary to remedy the Security Incident.
4.2 Laws: Company shall comply at all times with, and assist Customer in complying with its applicable obligations under, Data Protection Laws. Company shall provide any information requested by Customer to demonstrate compliance with the obligations set out in this Data Protection Addendum. Company will not perform its obligations under the Services Agreement or this Data Protection Addendum in such a way as to cause Customer to breach any of its obligations under applicable Data Protection Laws.
4.3 Infringement: Company will notify Customer immediately if, in Company's reasonable opinion, an instruction for the processing of personal data given by Customer infringes applicable Data Protection Laws.
4.4 Popl Data. If a Security Incident affects Popl Data that Company processes as a Data Controller, Company is responsible for any notifications to supervisory authorities or data subjects required of Company by Data Protection Laws, and will notify Customer without undue delay if the Security Incident affects Popl Data Company has provided to Customer.
5. Appendix 1: Subject Matter and Details of the Data Processing
5.1 Data Exporter - The data exporter is Customer.
5.2 Data Importer - The data importer is Popl Co.
5.3 Data Subjects - The personal data transferred concern the following categories of data subjects
5.3.1 Customer
Individual contacts of Customer, including individuals whose event badges, business cards, or QR codes are scanned through the Services and participants in conversations recorded through the Audio Recording Feature; Customer’s Authorized Users; and any other data subjects whose data may be processed from time to time pursuant to Services Agreement and this Data Protection Addendum.
5.3.2 Company
Customer may connect, via an application program interface (API), the Services to systems that store Customer’s data, for example, a customer relationship management (CRM) system or directory system. By electing to make such connections, Customer permits Company to access and read Customer’s data stored in any such connected systems solely to provide the Services to Customer and only in accordance with this Data Protection Addendum.
5.4 Categories of data
5.4.1 The personal data transferred concern the following categories of data:
5.4.2 First and last name
5.4.3 Email address
5.4.4 Telephone number
5.4.5 Mailing or other address information
5.4.6 IP address
5.4.7 Headshots and other images
5.4.8 Social media usernames and links
5.4.9 Job Title
5.4.10 Company Name
5.4.11 Pronoun choice
5.4.12 Event information associated with a scan, such as the event name, location, and date
5.4.13 Notes, tags, custom fields, and other information that Authorized Users associate with a contact
5.4.14 Popl Data that Company makes available to Customer and stores in Customer’s account
5.5 Processing operations - The personal data transferred will be subject to the processing operations described in the Services Agreement, including capturing contact information from event badges, business cards, and QR codes; storing and organizing that information; matching it against records held by Company and its Data Providers to generate Popl Data for Customer; transcribing and summarizing audio recordings; synchronizing data with systems that Customer connects to the Services; and providing support.
5.6 Audio Recording and Transcripts - The Mobile App may be configured to enable Customer or its Authorized Users to record audio of in-person conversations with one or more individuals and to have such recordings transcribed and summarized using AI Features. Audio captured through the Audio Recording Feature is recorded on the Authorized User’s device and copied to Company’s cloud environment. Once uploaded to Company’s cloud environment, the audio file is transcribed and retained, together with the resulting transcript and summary, as Customer Content. The Audio Recording Feature processes recorded audio to distinguish between individual speakers in a conversation (e.g., labeling speakers as “Person A,” “Person B,” etc.) ("Speaker Identification"). Use of Speaker Identification is subject to consent obtained by Customer sufficiently to satisfy the requirements of any applicable biometric privacy laws including, without limitation, the Illinois Biometric Information Privacy Act.
5.7 Popl Data. The Services may enable Customer to append Popl Data to records containing Customer Personal Data. Company processes Popl Data in the records from which it provides it as an independent Data Controller as described in Section 2.1.2, and such data is not personal data transferred by the data exporter for purposes of the Standard Contractual Clauses.
6. Appendix 2: Technical and Operational Security Measures
Company adopts an Information Security Management Systems (ISMS) as a framework for continuous improvement of security. This ISMS includes (but is not limited to):
6.1 Policies: Company has and periodically reviews the Information Security Policies as the major guidelines for security practices. This includes Risk Management, Data Classification, Access Control, Software Development and Data Breaches.
6.2 Awareness: Awareness on security and compliance is fundamental and provided to all users. Some users may have additional specific awareness, relevant for their function.
6.3 Access control: Access is granted on a need-to-know basis and only a small number of users can access production systems where information from Customers is stored. Authentication to production systems is made with 2-factor Authentication as a standard.
6.4 Logging: Relevant audit logs are maintained, including access to sensitive information (including personal data). The logs are kept in separate infrastructure and only accessed by Security team.
6.5 Breaches: Processes are defined to handle Data Breaches. These processes include notification to relevant stakeholders, according to type of incident and applicable laws.
6.6 Network Security: Company implements several security measures to protect its infrastructure from external and internal threats. This includes encryption, firewalls, IDS, and other cloud provider specifics. Access to production systems is made in secure mode and encryption in transit is a default. Sensitive information is also encrypted at rest.
6.7 Physical Security: Company uses data centers managed by cloud providers and delegates all physical security to them, after a due diligence.
6.8 Business Continuity: Company has several technical implementations to assure business continuity of its service. Those include backups, resilient and redundant infrastructure, and a Disaster Recovery Plan.
6.9 Development: Development is made using a secure development methodology that includes peer review and secure coding and testing.
6.10 Improvement: Company security position is based on a continuous improvement process that includes periodic review of security controls effectiveness.
7. Appendix 3: List of Subprocessors
Company uses certain subprocessors to assist it in providing services under Services Agreement. Defined terms used herein will have the same meaning as defined in Services Agreement.
Data Providers from which Company licenses Popl Data are independent controllers, not subprocessors, except where they receive Customer Personal Data for matching, as covered in Section 3.4.
A subprocessor is a third-party data processor engaged by Company who has or potentially will have access to, or process customer information (which may contain personal data). Company engages subprocessors to perform various functions as explained in the table below. You can see a list of all Popl subprocessors here.
How are you planning to use Popl?
For My Team
Set Up My Team
For Myself
Create My Digital Card
For Myself
Create My Digital Card
✕
Request the Buyer's Guide
Enter your info and one of our reps will email you with the guide
(5,292 Reviews)