Snapshot 36520
Normalized text
Scripts and page chrome removed; this is what change detection compares.
DATA PROCESSING ADDENDUM
This Data Processing Addendum (“DPA”) regulates processing of Personal Data of GDPR-protected
individuals on behalf of the Customer and shall be effective when the Customer is subscribed to the
Service (the “Agreement”) or obtains an Account or starts using the Service (the "Services"),
whichever is the earliest.
I. SCOPE OF DPA AND LIMITATION OF LIABILITY
1.1. The Parties acknowledge and agree that about the Processing of Personal Data, (i) Customer is
the Data Controller, (ii) MRPeasy is the Data Processor and that (iii) MRPeasy may engage Sub-
processors pursuant to the requirements set forth in Section “Sub-processors” below.
1.2. The Customer shall, in its use of the Services, Process Personal Data in accordance with the
requirements of Data Protection Laws and Regulations (meaning all laws and regulations of the
European Union, the European Economic Area and their Member States, and the United
Kingdom, applicable to the Processing of Personal Data under the Agreement) and always
comply with the obligations applicable to data controllers. Customer shall have sole
responsibility for how Customer acquired Personal Data. Without limitation, Customer shall
comply with any and all transparency-related obligations (including, without limitation,
displaying any and all relevant and required privacy notices or policies) and shall have any and
all required legal bases in order to collect, Process and transfer to MRPeasy the Personal Data
and to authorize the Processing by MRPeasy of the Personal Data which is authorized in this
DPA. Customer shall defend, hold harmless and indemnify MRPeasy (including without
limitation their directors, officers, agents, subcontractors and/or employees) from and against any
liability of any kind related to any breach, violation or infringement by Customer and/or its
authorized users of any Data Protection Laws and Regulations and/or this DPA and/or this
Section.
1.3. The Customer shall be solely liable for having all the necessary rights, consents and agreements
for the Processing of Personal Data as described in the DPA. The Customer shall be liable for the
documentation of the Processing. The Customer is responsible for the validity and integrity of
the Personal Data it provides to MRPeasy. The Controller shall also be responsible for
communicating with the Data Protection authorities as well as providing them with all the
necessary notifications. The Controller is responsible for drafting necessary privacy notices and
providing them to the Data Subjects.
1.4. Notwithstanding anything to the contrary in the DPA and/or in any other provisions of the
Agreement between the parties and to the maximum extent permitted by law:
(A) MRPeasy’s entire, total and aggregate liability, related to personal data or information,
privacy, or for breach of, this DPA and/or Data Protection Laws and Regulations, including,
without limitation, if any, any indemnification obligation under the DPA or applicable law
regarding data protection or privacy, shall be limited to the amounts paid to MRPeasy under the
Agreement within 1 (one) month preceding the event that gave rise to the claim. This limitation
of liability is cumulative and not per incident;
(B) In no event will MRPeasy, be liable under, or otherwise in connection with this DPA for: (i)
any indirect, exemplary, special, consequential, incidental or punitive damages; (ii) any loss of
profits, business, or anticipated savings; (iii) any loss of, or damage to data, reputation, revenue
or goodwill; and/or (iv) the cost of procuring any substitute goods or services; and
1
(C) The foregoing exclusions and limitations on liability set forth in this DPA shall apply: (i)
even if MRPeasy has been advised, or should have been aware, of the possibility of losses or
damages; (ii) even if any remedy in this DPA fails of its essential purpose; and (iii) regardless of
the form, theory or basis of liability (such as, but not limited to, breach of contract or tort).
1.5. The limitations of liability shall not apply to damages caused by wilful misconduct or gross
negligence.
1.6. If there is any conflict between the terms of this DPA and the Agreement, the terms of this DPA
shall prevail.
II. INSTRUCTIONS AND RIGHTS OF DATA SUBJECTS
2.1. MRPeasy will only process the Personal Data in accordance with this DPA, the Agreement and
the Customer's written instructions from time to time except where otherwise required by
applicable law. MRPeasy will in due manner inform the Customer if any instruction relating to
the Personal Data infringes or may infringe any Data Protection Law.
2.2. MRPeasy will comply with Customer written instructions requiring MRPeasy to amend, transfer,
delete or otherwise process the Personal Data, or to stop, mitigate or remedy any unauthorised
processing.
2.3. MRPeasy will reasonably assist at Customer’s cost and expenses the Customer with meeting the
Customer’s compliance obligations under the Data Protection Laws, taking into account the
nature of the MRPeasy’s processing and the information available to MRPeasy, including in
relation to Data Subject rights, data protection impact assessments and reporting to and
consulting with the Supervisory Authority or other relevant regulator under the Data Protection
Laws.
2.4. If MRPeasy receives a request from a Data Subject to exercise its right to be informed, right of
access, right to rectification, erasure, restriction of Processing, data portability, right to object, or
its right not to be subject to a decision solely based on automated processing, including profiling
(“Data Subject Request”), MRPeasy shall, to the extent legally permitted and at Customer’s cost,
promptly notify and forward such Data Subject Request to Customer. Taking into account the
nature of the Processing, MRPeasy shall use commercially reasonable efforts to assist Customer
by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment
of Customer’s obligation to respond to a Data Subject Request under Data Protection Laws and
Regulations.
III. NATURE AND PURPOSE OF PROCESSING
3.1. Nature and Purpose
3.1.1. MRPeasy Processes the Controller’s Personal Data to provide the Service. During the provision
of the Service MRPeasy will Process Personal Data for the purposes of delivery of the Services,
billing, Controller support, prevention and investigation of errors or misuse of the Service,
measuring quality and performance of the supplied Services and for the further development of
the supplied Service.
3.2. Scope and Duration
3.2.1. MRPeasy Processes the Controller’s Personal Data to the extent such processing is necessary for
the purposes set out in Section 3.1.1 above. In any case, the MRPeasy will Process the Personal
Data for as long as the Controller is using the supplied Service. Upon the termination of the DPA
2
for any reason, MRPeasy will cease to Process the Personal Data and shall return to the Controller
or delete the Personal Data.
3.3. Types of Personal Data and categories of data subjects
3.3.1. Categories of data subjects may include Customer’s or its end-customers or their service
providers’ contact persons, employees, users, clients and other natural persons whose Personal
Data Customer elects to process via the supplied Services, the extent of which is determined and
controlled by the Customer.
3.3.2. Types of Personal Data include Personal Data that Customer or its users have submitted, stored,
sent or received via the supplied Services such as name, contact information, role and data
subject’s other attributes, the extent of which is controlled by the Customer.
IV. SECURITY
4.1. MRPeasy will maintain all industry-standard technical and organizational measures required to
protect Personal Data against accidental, unauthorised, or unlawful destruction, loss, alteration,
disclosure or access, taking into account the state of the art, the costs of implementation and the
nature, scope, context and purposes of the processing of the Personal Data to be carried out under
or in connection with the Agreement.
4.2. Upon the Customer’s request, MRPeasy will use commercially reasonable efforts to assist
Customer, at Customer’s cost, in ensuring compliance with the obligations pursuant to Articles
32 to 36 of the GDPR considering the nature of the processing, the state of the art, the costs of
implementation, the scope, the context, the purposes of the Processing and the information
available to MRPeasy.
4.3. MRPeasy will implement appropriate technical and organisational security measures appropriate
to the risk, including as appropriate:
(a) the pseudonymisation and encryption of personal data;
(b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of
processing systems and services;
(c) the ability to restore the availability and access to personal data in a timely manner in the event
of a physical or technical incident; and
(d) a process for regularly testing, assessing and evaluating the effectiveness of the security
measures.
V. SUB-PROCESSING
5.1. MRPeasy shall be entitled to engage Sub-Processors (meaning any agent, subcontractor or other
third party engaged by the MRPeasy (or by any other Sub-Processor) for carrying out any
processing activities in respect of the Personal Data) located within the European Economic
Area. The Customer undertakes to agree on such Processing of Personal Data with each sub-
Processor in writing so that the sub-Processor is bound by restrictions regarding Processing that
are at least as restrictive than those set out in this DPA.
5.2. The Customer is entitled to receive information of Sub-Processors used by MRPeasy from time
to time and any changes that MRPeasy makes in the use of Sub-Processors. If the Customer does
not accept the change of a Sub-Processor, the Customer shall have the right to terminate the
3
Agreement for the part concerning the relevant supplied Service with immediate effect. If the
Customer has reasonable grounds, it is entitled to oppose the use of a new Subcontractor.
5.3. The Customer shall notify MRPeasy of its opposition without delay and no later than 14 days
after receiving the notification from MRPeasy. If the Parties do not reach a consensus on the use
of a new Subcontractor, both Parties are entitled to terminate the Agreement with 30 days’ notice,
in so far as the change of Subcontractor would affect the Processing of the Personal Data pursuant
to the DPA.
5.4. The Controller has the right, at its own cost, to audit the MRPeasy and its sub-Processor’s
compliance with this DPA. Unless otherwise agreed, the Controller shall appoint an independent
third-party expert as an auditor. The auditor cannot be a competitor of MRPeasy. MRPeasy has
the right to reject an auditor that does not meet this criterion. The MRPeasy shall participate in
the audit at Customer’s cost.
VI. PERSONAL DATA BREACHES
6.1. MRPeasy will inform the Customer of all Data breaches related to the service without undue
delay after receiving such information.
6.1.1. Upon request, MRPeasy will provide the Customer with all relevant information related to the
Data breach. If available, the following information shall be attached to the notification:
6.1.2. a description of the data breach and the circumstances leading to it;
6.1.3. a description of the nature of the data breach, including, when possible, the sets of Data Subjects
and the estimated number affected by the breach as well as the sets of Personal Data types and
the estimated number affected by the breach;
6.1.4. a description of the likely consequences caused by the breach; and
6.1.5. a description of the reparative measures taken or planned to be taken in order to avoid such data
breaches in the future, and when necessary, the measures taken to minimize the harmful effect of
the data breach.
6.2. MRPeasy will not inform any third-party of any accidental, unauthorised or unlawful processing
of all or part of the Personal Data and/or a Personal Data Breach without first obtaining the
Customer's written consent, except when required to do so by EU law.
6.3. MRPeasy shall be entitled to remuneration for work carried out in connection with the delivery
in accordance with the time elapsed and at the data processor’s generally applicable hourly rate
for such work, as well as for any costs and outlays incurred in connection with the work.
MRPeasy shall be entitled to require the payment of a deposit for accepting the delivery
instruction.
VII. INTERNATIONAL TRANSFERS
7.1. MRPeasy shall be entitled to transfer Personal Data freely within the European Union and the
European Economic Area. The Customer is entitled to receive information regarding the location
where the Personal Data is processed at any time upon request.
7.2. MRPeasy shall not transfer the Customer’s Personal Data outside the European Economic Area
without the Controller’s prior written consent unless expressly agreed otherwise in the
Agreement.
4
7.3. If the Customer gives consent for the Processing and authorizes the Processor to enter into
agreements on its behalf regarding the provisions and Standard Contractual Clauses about
Controller’s rights and obligations, MRPeasy and its Subcontractors are entitled to Process
Personal Data in third countries if: a) The country fulfils the Data protection requirements set by
The European Commission (Directive 95/46/EC); b) the party residing outside of the EU/EEA
territory is part of the Privacy Shield Personal Data transfer mechanism; c) The Standard
Contractual Clauses are used in the transfer or; d) the contractual provisions regarding Personal
Data protection are otherwise agreed upon in a way that meet the requirements set in EU Data
Protection Regulation Article 46.
VIII. TERM AND TERMINATION
8.1. This DPA will remain in full force and effect so long as:
(a) the Agreement remains in effect; or
(b) MRPeasy retains any of the Personal Data related to the Agreement in its possession or control.
8.2. Upon the termination of the DPA for any reason, MRPeasy will retain the Controller’s Personal
Data for thirty (30) days after the effective date of the termination and make such Personal Data
available to the Controller via the supplied Services. After the thirty (30) days' period, MRPeasy
shall have the right to destroy the Personal Data of the Controller from the Service. MRPeasy is
entitled to retain Personal Data over the period of 30 days if applicable legislation so demands.
IX. CONTACT PERSONS
9.1. The Controller shall provide MRPeasy with the name and contact details of the person(s) within
their organisation being responsible for the Processing of the Controller’s Personal Data and data
protection.
9.2. Contact information of MRPeasy Data Processing Officer: dpo@mrpeasy.com
5