Snapshot 40095
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Page 1 of 9
DATA PROCESSING ADDENDUM
This Data Processing Addendum ("DPA") forms part of the Terms available at sli.do/terms (“Terms”)
between Slido and Customer. Slido and Customer are each a “Party” and collectively, the “Parties”.
Except as modified below, the Terms shall remain in full force and effect.
In consideration of the mutual obligations set out herein, the Parties hereby agree that:
The terms and conditions set out below shall be added as an addendum to the Terms.
Except where the context requires otherwise, references in this DPA to the Terms are to the Terms as
amended by, and including, this DPA.
DEFINITIONS AND INTERPRETATION
In this DPA, the following terms shall have the meanings set out below and cognate terms shall be
construed accordingly:
“Applicable Data Privacy Law” means EU General Data Protection Regulation 2016/679 (“GDPR”), California
Consumer Privacy Act of 2018 (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”), and any
related regulations or guidance provided by the California Attorney General, or any other applicable data
protection or privacy law where applicable;
“Customer Personal Data” means any Personal Data or Personal Information Processed by Slido on behalf
of the Customer pursuant to or in connection with the Terms and this DPA;
“Standard Contractual Clauses” means the relevant model contract clauses adopted by the European
Commission which can be used as a ground for data transfers from the EU to third countries;
“Appropriate Safeguards” means such legally enforceable mechanism(s) for transfers of Personal Data as
may be permitted under the Applicable Data Privacy Law, especially but not limited to Art 46 GDPR.
Capitalized terms not otherwise defined herein shall have the meaning given to them in the Terms or the
Applicable Data Privacy Law.
The word “include” shall be construed to mean include without limitation, and cognate terms shall be
construed accordingly.
Version 1.10 online
Page 2 of 9
1. PROCESSING OF CUSTOMER PERSONAL DATA
1.1. Role of the Parties. The Parties acknowledge and agree that with regard to the Processing of
Customer Personal Data, Customer is the Controller (or Business), Slido is the Processor (or Service
Provider) and that Slido will engage Subprocessors pursuant to the requirements set out in Clause 4
Subprocessors below.
1.2. Customer’s Processing of Customer Personal Data. Customer shall, in its use of the Services
and instructions to Slido:
a) comply with Applicable Data Privacy Law in their Processing of Customer Personal Data; and
b) have sole responsibility for the accuracy, quality and legality of Customer Personal Data and the
means by which Customer acquired Customer Personal Data.
1.3. Slido’s Processing of Customer Personal Data. Slido shall:
a) comply with Applicable Data Privacy Law in their Processing of Customer Personal Data; and
b) treat Customer Personal Data as Confidential Information; and
c) not Process Customer Personal Data other than on the relevant Customer’s documented
instructions unless Processing is required by Applicable Data Privacy Law, in which case Slido shall
to the extent permitted by applicable laws inform Customer of that legal requirement before the
relevant Processing of that Customer Personal Data; and
d) act and shall continue to act, solely as Customer’s Processor (or Service Provider) with respect to all
Customer Personal Data transferred to Slido under the Terms; and
e) is prohibited from selling Customer Personal Data, and retaining, using or disclosing Customer
Personal Data (i) for any purpose other than for the specific purpose of performing under the Terms,
or (ii) outside of the direct business relationship between Customer and Slido.
Slido certifies that Slido understands the restrictions in this clause and will comply with them in
accordance with Applicable Data Privacy Laws.
1.4. Processing Instructions. Customer instructs Slido and authorises Slido to Process Customer
Personal Data; and transfer Customer Personal Data according to clause 10, as reasonably
necessary:
a) for the provision of the Services and consistent with the Terms and this DPA;
b) to comply with other documented reasonable instructions provided by Customer where such
instructions are consistent with the Terms and this DPA.
1.5. Details of the Processing. Exhibit 1 to this DPA sets out:
a) the subject matter and duration of the Processing of Customer Personal Data;
Version 1.10 online
Page 3 of 9
b) the nature and purpose of the Processing of Customer Personal Data;
c) the categories of Data Subject (or Consumer) to whom the Customer Personal Data relates; and
d) the types of Customer Personal Data to be Processed.
2. DATA SUBJECT (OR CONSUMER) RIGHTS
2.1. Data Subject (or Consumer) Request. Slido shall, to the extent legally permitted, notify
Customer at the email address associated with the licence owner without undue delay if Slido
receives a request from a Data Subject (or Consumer) to exercise the Data Subject’s (or
Consumer’s) right of access (or disclosure), right to rectification, restriction of Processing, erasure
(or deletion or the “right to be forgotten”), data portability, object to the Processing, or its right not to
be subject to an automated individual decision making (“Data Subject (or Consumer) Request”). The
Parties must not discriminate against a Consumer because they exercised their rights.
2.2. Slido Assistance. Taking into account the nature of the Processing, Slido shall assist Customer
by implementing appropriate technical and organisational measures, insofar as this is possible, for
the fulfilment of the Customer’s obligations to respond to requests to exercise Data Subject (or
Consumer) rights under the Applicable Data Privacy Law. Slido shall not be liable for Customer’s
failure to address Data Subject (or Consumer) Requests.
3. SLIDO PERSONNEL
3.1. Confidentiality. Slido shall ensure that its personnel engaged in the Processing of Customer
Personal Data are informed of the confidential nature of Customer Personal Data, have received
appropriate training on their responsibilities and have executed written confidentiality agreements or
are under an appropriate statutory obligation of confidentiality. Slido shall ensure that confidentiality
obligations regarding Customer Personal Data survive the termination of the personnel
engagement.
3.2. Limitation of access. Slido shall ensure in each case that access is strictly limited to those
individuals who need to know / access the relevant Customer Personal Data, as strictly necessary
for the purposes of the Terms and this DPA, and to comply with Applicable Data Privacy Laws in the
context of that individual's duties to Slido.
4. SUBPROCESSING
4.1. Appointment. Customer authorises Slido to appoint Subprocessors in connection with the
Services and in accordance with this Clause 4.
Version 1.10 online
Page 4 of 9
4.2. Current Subprocessors.
LOCATION
WHERE DATA
PERSONAL
SUBPROCESSOR PURPOSE PERSONAL TRANSFER
DATA
DATA IS SAFEGUARD
HOSTED
Standard
Amazon Web Infrastructure Contact data, Ireland,
Contractual
Services, Inc. as a service Content data Germany
Clauses
Our parent company Cisco Systems Inc. and its subsidiaries may also act as Subprocessors in
some circumstances under Standard Contractual Clauses entered into.
New Subprocessors. Slido will notify customers of new Sub-processors by updating the list of
Sub-processors on the Website. Customer may also sign up to receive notifications of new
Sub-processors via e-mail by e-mailing [email protected] with the subject “Subscribe to New
Subprocessor Notifications” and specifying the email address such notifications should be sent to.
If, within a reasonable time specified in the notice, Customer notifies Slido in writing of any
objections to the proposed appointment based on reasonable grounds relating to data protection:
Slido shall work with Customer in good faith to make available a commercially reasonable change in
the provision of the Services which avoids the use of that proposed Subprocessor. Where such a
change cannot be made, notwithstanding anything in the Terms, Customer may by written notice to
Slido with immediate effect terminate the relationship to the extent that it relates to the Services
which require the use of the proposed Subprocessor. Such termination is without prejudice to any
fees incurred by Customer prior to the termination.
4.3. With respect to each Subprocessor, Slido shall:
a) carry out adequate due diligence before the Subprocessor first Processes Customer Personal
Data to ensure that the Subprocessor is capable of providing the level of protection for
Customer Personal Data required by the Applicable Data Privacy Law;
b) ensure that the arrangement between on the one hand Slido and on the other hand the
Subprocessor, is governed by a written contract including terms which offer at least the same
level of protection for Customer Personal Data as those set out in the Applicable Data Privacy
Law.
4.4. Liability. Slido shall be liable for the acts and omissions of its Subprocessors to the same
extent Slido would be liable if performing the services of each Subprocessor directly under the
terms of this DPA.
Version 1.10 online
Page 5 of 9
5. SECURITY
5.1. Slido obligations. Taking into account the state of the art, the costs of implementation and the
nature, scope, context and purposes of Processing as well as the risk of varying likelihood and
severity for the rights and freedoms of natural persons, Slido shall, at its cost and expense, in
relation to Customer Personal Data implement appropriate technical and organizational measures in
accordance with the Security Appendix available at
https://trustportal.cisco.com/c/r/ctp/trust-portal.html#/1604543381171981 to ensure a level of
security appropriate to that risk, including, as appropriate, the measures referred to in the Applicable
Data Privacy Law, especially Article 32 of the GDPR. In assessing the appropriate level of security,
Slido shall take account in particular of the risks that are presented by Processing, in particular from
a Personal Data Breach.
5.2. These measures should entail physical, logical and data access control as well as data transfer,
instruction, entry, availability and separation control.
5.3. Customer obligations. Notwithstanding the above, Customer agrees that except as provided by
this DPA, Customer is responsible for its secure use of the Services, including securing its account
authentication credentials, protecting the security of Customer Personal Data when in transit to and
from the Services.
6. PERSONAL DATA BREACH
6.1. Slido shall notify Customer at the email address associated with the licence owner without
undue delay upon Slido becoming aware of a Personal Data Breach affecting Customer Personal
Data, providing Customer with sufficient information to allow Customer to meet its obligations to
report or inform Data Subject (or Consumers) of the Personal Data Breach under the Applicable
Data Privacy Law.
6.2. Slido shall co-operate with Customer and take such reasonable commercial steps as are
directed by Customer to assist in the investigation, mitigation and remediation of each such
Personal Data Breach.
6.3. Slido shall promptly resolve as far as possible, at its own cost and expense, all data protection
and security issues discovered by Customer and reported to Slido that reveal a breach or potential
breach by Slido of its obligations under the Applicable Data Privacy Law.
6.4. If Slido is in breach of its obligations under this DPA, Customer may suspend the transfer of
Customer Personal Data to Slido until the breach is remedied.
Version 1.10 online
Page 6 of 9
7. ASSISTANCE, INFORMATION, RECORDS AND AUDIT
7.1. Slido shall assist the Customer in ensuring compliance with the obligations pursuant to Articles
32 to 36 of the GDPR taking into account the nature of processing and the information available.
7.2. Slido contracts with respected external security firms who perform regular audits of the Slido
Services to verify that our security practices are sound and to monitor Slido Services for any new
vulnerabilities discovered by security research community. The most recent report from the audit is
available upon Customer request once the Customer enters into a non-disclosure agreement with
Slido.
7.3. Slido shall make available to the Customer all information necessary to demonstrate
compliance with the obligations laid down in the Applicable Data Privacy Law and upon reasonable
notice by Customer and at Customer’s expense allow for and contribute to audits, including
inspections, conducted by Customer or another auditor mandated by Customer. Before the
commencement of any such on-site audit, Customer and Slido shall mutually agree upon the scope,
timing, and duration of the audit, in addition to a reasonable reimbursement rate. Customer shall
promptly notify Slido with information regarding any noncompliance discovered during the course of
an audit in order to allow Slido to deal with it promptly.
8. DELETION OR RETURN OF CUSTOMER PERSONAL DATA
8.1. Slido shall, at the choice of the Customer, delete or return all the Customer Personal Data to the
Customer after the end of the provision of Services, and deletes existing copies unless applicable
law requires storage of the Customer Personal Data.
9. LIMITATION OF LIABILITY
9.1. Unless expressly provided otherwise, each Party’s liability, taken together in the aggregate,
arising out of or related to this DPA, whether in contract, tort or under any other theory of liability is
subject to the limitation of liability clauses of the Terms.
10. TRANSFER MECHANISMS
10.1. In the absence of an adequacy decision, Customer Personal Data may only be transferred to a
third country outside the EEA or to an international organisation where there are Appropriate
Safeguards.
11. NOTIFICATION
Version 1.10 online
Page 7 of 9
11.1. Should Slido receive a request from a court or a government agency relating to Customer
Personal Data, Slido will notify the Customer that its personal data has been requested, unless
applicable law prohibits disclosure.
GENERAL TERMS
12. Term
12.1. The term of this DPA shall correspond to the term of the Terms.
13. Authority and Third Parties
13.1. Parties warrant and represent that they have full power and authority to enter into and perform
their respective obligations under the DPA.
13.2. Except as otherwise provided hereunder or under applicable law, no one other than a Party to this
DPA, its successors and permitted assigns shall have any right to enforce any of its terms.
14. Governing Law and Jurisdiction
14.1. The Parties to this DPA hereby submit to the jurisdiction of Slovak courts with respect to any
disputes or claims howsoever arising under this DPA, and this DPA and all non-contractual or other
obligations arising out of or in connection with it are governed by the laws of the Slovak Republic
notwithstanding the conflict of law provisions and other mandatory legal provisions.
15. Order Of Precedence
15.1. The Parties agree that DPA shall replace any existing DPA the Parties may have previously entered
into in connection with the Services.
15.2. Nothing in this DPA reduces Slido's obligations under the Terms in relation to the protection of
Customer Personal Data or permits Slido to Process (or permit the Processing of) Customer
Personal Data in a manner which is prohibited by the Terms.
15.3. With regard to the subject matter of this DPA, in the event of inconsistencies between the
provisions of this DPA and any other agreements between the parties, including the Terms and
including (except where explicitly agreed otherwise in writing, signed on behalf of the Parties)
agreements entered into or purported to be entered into after the date of this DPA, the provisions
of this DPA shall prevail.
Version 1.10 online
Page 8 of 9
16. Severance
16.1. Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall
remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as
necessary to ensure its validity and enforceability, while preserving the Parties’ intentions as
closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or
unenforceable part had never been contained therein.
IN WITNESS WHEREOF, this DPA is entered into and becomes a binding part of the Terms.
EXHIBIT 1: DETAILS OF PROCESSING OF CUSTOMER PERSONAL DATA
This Exhibit 1 includes certain details of the Processing of Customer Personal Data as required by
Applicable Data Privacy Law.
Subject matter and duration of the Processing of Customer Personal Data
Subject matter: The subject matter of the Processing under this DPA is the types of Customer Personal
Data as listed in this Exhibit 1.
Duration: Personal Data may be Processed and stored for the period necessary to fulfil the agreed purposes
of processing pursuant to and for the duration of this DPA and to comply with Applicable Data Privacy Law.
This will generally be for the Term plus the period from the expiry of the Term until deletion of all Customer
Data by Slido in accordance with its back up policies.
The Service offers certain controls for the Users to delete their data.
The nature and purpose of the Processing of Customer Personal Data
Nature: Slido provides a software as a service solution through a cloud based platform that enables
real-time active engagement of participants at Events organised by organisers as described in the Terms.
Purpose: The purpose of the Customer Personal Data Processing under this DPA is:
a) to allow Slido to provide the Services to the Customer as described in the Terms and consistently
with this DPA;
b) to comply with other documented reasonable instructions provided by Customer where such
instructions are consistent with the Terms and this DPA or to process requests initiated by
Customer or Customer’s Users in their use of the Services;
c) to comply with any legal obligation.
The categories of Data Subject (or Consumer) to whom the Customer Personal Data relates
Version 1.10 online
Page 9 of 9
Participants of Customer’s Events.
The types of Customer Personal Data to be Processed under this DPA
Any Customer Personal Data submitted by participants via the Service in their sole discretion contained in:
a) Participant profile data (name, email address, company)
b) Event content data in Enterprise plans (questions, poll answers, ideas, chats - simply content shared
by participants and related to an identified/ identifiable individual)
Special categories of data
It is against the Terms to submit special categories of data via the Service. Notwithstanding the foregoing
and subject to the execution of a written Business Associate Agreement (“BAA”) under the Health
Insurance Portability and Accountability Act of 1996 (“HIPAA”) between Customer as a covered entity under
HIPAA and Slido, Customer with an Enterprise plan may collect protected health information as defined
within the HIPAA in the content fields via the Service in their sole discretion and in accordance with the
terms set forth in the BAA and this DPA.
Version 1.10 online