Snapshot 58337
Normalized text
Scripts and page chrome removed; this is what change detection compares.
DATA PROCESSING AGREEMENT - Assuric Software Platform
This Data Processing Agreement (“DPA”) is an addendum to the Terms of Service (“Terms”) and any
separate contract (“Agreement”) between Customer and Assuric UK Opco Limited (”Assuric”).
SUBJECT MATTER AND DURATION
Subject Matter. This DPA is intended to govern Customer’s provision and Assuric’s Processing of
Customer Personal Data pursuant to the Agreement. All capitalised terms that are not expressly
defined in this DPA will have the meanings given to them in the Agreement. If and to the extent
language in this DPA or any of its attachments conflicts with the Agreement, this DPA shall control.
Duration and Survival. This DPA will become binding upon the effective date of the Agreement and
shall survive until expiration or termination of the Agreement.
Variables
Parties’ relationship Controller to Processor
Main Agreement Services Agreement in place between the Parties
Term This DPA will commence on the final date of signature and will
continue for the duration of the Main Agreement
Breach Notification Period Without undue delay after becoming aware of a personal data breach
Sub-processor Notification A reasonable timeframe before the new sub-processor is granted
Period access to Personal Data
[Liability Cap] Each party’s aggregate liability under this DPA will not exceed liability
caps as per the Main Agreement
Governing Law and As per the Main Agreement
Jurisdiction
Data Protection Laws All laws, regulations and court orders which apply to the processing
of Personal Data in:
● the European Economic Area (EEA)
● the United Kingdom (UK)
This includes the UK General Data Protection Regulation (UK GDPR),
as amended from time to time.
Services related to processing As described in the Main Agreement
Duration of processing For the Term of this DPA
Nature and purpose of Management of compliance documentation and processes using the
processing Assuric platform
addresses, roles, phone numbers.
Data subjects The individuals whose Personal Data will be processed are
employees
Special
Personalprovisions
Data None
The types of personal data processed are employee names, email
addresses, roles, phone numbers.
Data subjects The individuals whose Personal Data will be processed are
employees
Special provisions None
Annex 1
Security measures. Technical Cyber Essentials Plus certified with annual penetration testing.
and organisational measures
to ensure the security of
Security controls include: encryption, multi-factor authentication,
Personal Data
role-based access control, audit logs for access and change to
Annex 1
personal data, secure coding practices.
Security measures. Technical Cyber Essentials Plus certified with annual penetration testing.
and organisational measures Full details of security measures are maintained at Assuric’s
to ensure the security of publicly accessible Security Page and Trust Centre.
Security controls include: encryption, multi-factor authentication,
Personal Data
role-based access control, audit logs for access and change to
personal data, secure coding practices.
Full details Annex 2
of security measures are maintained at Assuric’s
publicly accessible Security Page and Trust Centre.
Sub-processors. Current
1. Google Cloud Platform:
sub-processors
Role: Cloud infrastructure provider / hosting
Location: EU Data Centres
Annex 2
Transfer Mechanism(s): UK adequacy regulations (EU/EEA)
Sub-processors. Current
2. Twilio: Cloud Platform:
1. Google
sub-processors
Role: Transactional email provider / hosting
Cloud infrastructure
Location: EU Data Centres
Transfer Mechanism(s): UK adequacy regulations (EU/EEA)
3.
2. Intercom:
Twilio:
Role: Customer Support
Transactional emailTool
Location: US
EU Data Centres
Transfer Mechanism(s):
Mechanism: EU-U.S. Data Privacy
UK adequacy Framework
regulations (EU-U.S.
(EU/EEA)
DPF), and the UK Extension to the EU-U.S. DPF (UK-U.S. DPF
3. Intercom:
A list of sub-processors is also maintained at the sub-processor
Role: Customer Support Tool
page of Assuric’s publicly facing Trust Centre.
Location: US Data Centres
Transfer Mechanism: EU-U.S. Data Privacy Framework (EU-U.S.
DPF), and the UK Extension to the EU-U.S. DPF (UK-U.S. DPF
A list of sub-processors is also maintained at the sub-processor
page of Assuric’s publicly facing Trust Centre.
TERMS
1. What is this agreement about?
1.1 Purpose. The parties are entering into this Data Processing Agreement (DPA) for the
purpose of processing Personal Data (as defined above).
1.2 Definitions. Under this DPA:
(a) adequate country means a country or territory that is recognised under Data Protection
Laws from time to time as providing adequate protection for processing Personal Data,
and
(b) Controller, data subject, personal data breach, process/processing, Processor and
supervisory authority have the same meanings as in the Data Protection Laws and
(c) Sub-Processor means another processor engaged by the Processor to carry out
specific processing activities with Personal Data.
2. What are each party’s obligations?
2.1 Controller obligations. Controller instructs Processor to process Personal Data in
accordance with this DPA, and is responsible for providing all notices and obtaining all
consents, licences and legal bases required to allow Processor to process Personal Data.
2.2 Processor obligations. Processor instructs Sub-Processor to process Personal Data in
accordance with this DPA, and is responsible for sharing Controller’s instructions with
Sub-Processor prior to the processing of Personal Data.
2.3 Processor obligations. Processor will:
(a) only process Personal Data in accordance with this DPA and Controller’s instructions
(unless legally required to do otherwise),
(b) not sell, retain or use any Personal Data for any purpose other than as permitted by this
DPA and the Main Agreement,
(c) inform Controller immediately if (in its opinion) any instructions infringe Data Protection
Laws,
(d) use the technical and organisational measures described in Annex 1 when processing
Personal Data to ensure a level of security appropriate to the risk involved,
(e) notify Controller of a personal data breach within the Breach Notification Period and
provide assistance to Controller as required under Data Protection Laws in responding
to it,
(f) ensure that anyone authorised to process Personal Data is committed to confidentiality
obligations,
(g) without undue delay, provide Controller with reasonable assistance with:
(i) data protection impact assessments,
(ii) responses to data subjects’ requests to exercise their rights under Data Protection
Laws, and
(iii) engagement with supervisory authorities,
(h) if requested, provide Controller with information necessary to demonstrate its
compliance with obligations under Data Protection Laws and this DPA,
(i) allow for audits at Controller’s reasonable request, provided that audits are limited to
once a year and during business hours except in the event of a personal data breach,
and
(j) return Personal Data upon Controller’s written request or delete Personal Data by the
end of the Term, unless retention is legally required.
2.4 Warranties. The parties warrant that they and any staff and/or subcontractors will comply
with their respective obligations under Data Protection Laws for the Term.
3. Sub-processing
3.1 Use of sub-processors. Controller authorises Processor engage other processors
(referred to in this section as sub-processors) when processing Personal Data.
Processor’s existing sub-processors are listed in Annex 2.
3.2 Sub-processor requirements. Processor will:
(a) require its sub-processors to comply with equivalent terms as Processor’s obligations
in this DPA,
(b) ensure appropriate safeguards are in place before internationally transferring Personal
Data to its sub-processor, and
(c) be liable for any acts, errors or omissions of its sub-processors as if they were a party
to this DPA.
3.3 Approvals. Processor may appoint new sub-processors provided that they notify
Controller in writing in accordance with the Sub-processor Notification Period.
3.4 Objections. Controller may reasonably object in writing to any future sub-processor. If the
parties cannot agree on a solution within a reasonable time, either party may terminate this
DPA.
4. International personal data transfers
4.1 Instructions. Processor will transfer Personal Data outside the UK, the EEA or an adequate
country only on documented instructions from Controller, unless otherwise required by law.
4.2 Transfer mechanism. Where a party is located outside the UK, the EEA or an adequate
country and receives Personal Data:
(a) that party will act as the data importer,
(b) the other party is the data exporter, and
(c) the relevant Transfer Mechanism will apply.
4.3 Additional measures. If the Transfer Mechanism is insufficient to safeguard the transferred
Personal Data, the data importer will promptly implement supplementary measures to
ensure Personal Data is protected to the same standard as required under Data Protection
Laws.
4.4 Disclosures. Subject to terms of the relevant Transfer Mechanism, if the data importer
receives a request from a public authority to access Personal Data, it will (if legally
allowed):
(a) challenge the request and promptly notify the data exporter about it, and
(b) only disclose to the public authority the minimum amount of Personal Data required and
keep a record of the disclosure.
5. Other important information
5.1 Survival. Any provision of this DPA which is intended to survive the Term will remain in full
force.
5.2 Order of precedence. In case of a conflict between this DPA and other relevant
agreements, they will take priority in this order:
(a) Transfer Mechanism,
(b) DPA,
(c) Main Agreement.
5.3 Notices. Formal notices under this DPA must be in writing and sent to the Contact on the
DPA’s front page as may be updated by a party to the other in writing.
5.4 Third parties. Except for affiliates, no one other than a party to this DPA has the right to
enforce any of its terms.
5.5 Entire agreement. This DPA supersedes all prior discussions and agreements and
constitutes the entire agreement between the parties with respect to its subject matter and
neither party has relied on any statement or representation of any person in entering into
this DPA.
5.6 Amendments. Any amendments to this DPA must be agreed in writing.
5.7 Assignment. Neither party can assign this DPA to anyone else without the other party's
consent.
5.8 Waiver. If a party fails to enforce a right under this DPA, that is not a waiver of that right at
any time.
5.9 Governing law and jurisdiction. The Governing Law applies to this DPA and all disputes will
only be litigated in the courts of the Jurisdiction.