Snapshot 630
Normalized text
Scripts and page chrome removed; this is what change detection compares.
GDPR DATA PROCESSING ADDENDUM
This Processor Data Processing Addendum (“DPA”) will apply to you to the extent
that either: (i) you are established in the European Economic Area, or (ii) the
personal data we process as your processor relates to residents from the European
Economic Area.
This DPA shall amend all of your agreements with us (“Agreements”) governing the
use of the Website and/or the Services (as defined in the Agreements).
1. Definitions
Words and expressions used in this DPA but not defined herein shall have the
meanings given to such words and expressions in the General Data Protection
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April
2016 (“GDPR”).
“Applicable Data Protection Law” means all applicable European Union laws and
regulations governing the use or processing of data relating to natural persons
(including the GDPR) and any national implementing laws, regulations and
secondary legislation, as amended or updated from time to time.
“You” refers to the controller who has entered into this DPA with us, the processor
and “Your Data" refers to the personal data that you provide to us from time to time.
2. Details of the Processing
The details of the processing of Your Data as required by Article 28(3) of the GDPR
are set out in Annex 1.
3. Your Obligations
3.1 You determine the purposes for which Your Data is being or will be processed,
and the manner in which they are or will be processed.
3.2 You represent, warrant and agree that with respect to Your Data provided to us
pursuant to this DPA, You:
(a) comply with personal data security and other obligations prescribed by
Applicable Data Protection Law for controllers;
(b) confirm that the provision of Your Data to us complies with Applicable
Data Protection Law;
(c) have established a procedure for the exercise of the rights of the
individuals whose personal data is collected;
(d) only process data that has been lawfully and validly collected and ensure
that such data is relevant and proportionate to the respective uses;
(e) ensure that after assessment of the requirements of Applicable Data
Protection Law, the security and confidentiality measures implemented
are suitable for protection of Your Data against any accidental or unlawful
destruction, accidental loss, alteration, unauthorized or unlawful
disclosure or access, in particular when the processing involves data
transmission over a network, and against any other forms of unlawful or
unauthorized processing; and
(f) take reasonable steps to ensure compliance with the provisions of this
DPA by Your personnel and by any person accessing or using Your Data
on its behalf.
4. Our Obligations
4.1 We will carry out the processing of Your Data on Your behalf and on Your
instructions.
4.2 Further to the provisions of Article 28 of the GDPR, we agree that we will:
(a) process Your Data only on Your behalf and in compliance with Your
instructions (including relating to international data transfers), including
instructions in this DPA and all Agreements between You and us, unless
required to do so by European Union or Member State law to which we
are subject;
(b) immediately inform You if in our opinion an instruction from You infringes
Applicable Data Protection Law;
(c) implement appropriate technical and organizational security measures as
set out in Annex 3 prior to the commencement of the processing activities
for Your Data, maintain such security measures (or better security
measures) for the duration of this DPA, and provide You with reasonable
evidence of its privacy and security policies;
(d) take reasonable steps to ensure that (i) persons employed by it and (ii)
other persons engaged at its place of business who may process Your
Data are aware of and comply with this DPA;
(e) comply with confidentiality obligations in respect of Your Data as detailed
in all Agreements and take appropriate steps to ensure that its
employees, authorized agents and any sub-processors comply with and
acknowledge and respect the confidentiality of Your Data, including after
the end of their employment, contract or at the end of their assignment;
(f) inform You of:
(i) any legally binding request for disclosure of Your Data by a law
enforcement authority, unless otherwise prohibited, such as in order
to preserve the confidentiality of an investigation by the law
enforcement authorities;
(ii) any personal data breach within the meaning of Applicable Data
Protection Law relating to Your Data which may require a notification
to be made to a supervisory authority or data subject under
Applicable Data Protection Law (“Security Incident”);
(iii) any relevant notice, inquiry or investigation by a supervisory
authority relating to Your Data; and
(iv) any requests for access to, rectification, erasure, restriction, blocking
or transmission of Your Data received directly from a data subject
without responding to that request, unless You have authorized a
response or such a response is required by law;
(g) taking into account the nature of the processing and/or information
available, provide reasonable co-operation and assistance to You in
respect of Your obligations regarding:
(i) requests from data subjects in respect of access to, rectification,
erasure, restriction, blocking or transmission of Your Data;
(ii) the investigation of any Security Incident and the notification to the
supervisory authority and data subjects in respect of such a Security
Incident;
(iii) the preparation of data protection impact assessments and, where
applicable, carrying out consultations with the supervisory authority;
(iv) the security of Your Data, including by implementing the technical
and organizational security measures as set out in Annex 3;
(h) if we are required by law to process Your Data, take reasonable steps to
inform You of this requirement in advance of any processing, unless we
are prohibited from informing You on grounds of important public interest;
and
(i) upon reasonable request, make available to You information necessary to
demonstrate compliance with the obligations in this Clause 4.
4.3 You or an accredited third-party audit firm appointed by You may audit our
compliance with the terms of this DPA during regular business hours in a
manner that is not disruptive to our business, upon reasonable advance notice
to us of no less than 60 days and subject to reasonable confidentiality
procedures. You are responsible for all costs and fees related to such audit,
including all reasonable costs and fees for any and all time we expend for any
such audit, in addition to the rates for support services performed by us and
any expenses incurred by us in complying with this Clause 4.3 and Clause
4.2(i). Before the commencement of any such audit, You and us shall mutually
agree upon the timing, duration and scope of the audit. You shall promptly
notify us of information regarding any non-compliance discovered during the
course of an audit. You may not audit us more than once annually.
5. Transfer, Disclosure and Third Parties
5.1 You acknowledge and agree that (a) our affiliates may be retained as
sub-processors, and (b) we and our affiliates may engage third parties in
connection with the provision of the data processing services. We or our
affiliate shall enter into contractual arrangements with such sub-processors
requiring them to guarantee a similar level of data protection compliance and
information security to that provided for herein. For the purposes of this Clause
5, You hereby authorise us to engage sub-processors required to assist us for
the purposes of providing the data processing services.
5.2 A current list of sub-processors for the data processing services is set out in
Annex 2. We will provide reasonable notice to You before we engage a new
sub-processor of Your Data, including the date on which the new sub-processor
will begin processing Your Data (the “Sub-Processor Effective Date”). You may
object to our engagement of a new sub-processor by ceasing to use the
Services prior to the Sub-Processor Effective Date. Your continued use of the
applicable Services on or after the Sub-Processor Effective Date constitutes
Your acceptance of the new sub-processor.
5.3 You and us agree that we may transfer and process Your Data outside the
European Economic Area where the requirements of Articles 44 through 47 of
the GDPR are fulfilled, or an exception as listed in Article 49 of the GDPR
applies.
6. Termination
6.1 This DPA will terminate automatically upon termination of the Agreements.
6.2 On the termination of this DPA, at Your choice, us and any sub-processors
shall, subject to the limitations described in any relevant Agreements, return all
of Your Data and copies of such data to You or destroy them and demonstrate
to Your satisfaction that it has taken such measures, unless Applicable Data
Protection Laws prevents it from returning or destroying all or part of Your Data.
In such case, us or sub-processor agree to preserve the confidentiality of Your
Data retained by it and that it will only actively process Your Data after such
date in order to comply with the laws to which it is subject.
7. Governing law and jurisdiction
7.1 This DPA and any dispute or claim arising out of or in connection with it or its
subject matter or formation (including non-contractual disputes or claims) shall
be governed by, and construed in accordance with, the laws of Singapore.
7.2 The parties to this DPA irrevocably agree that the courts of Singapore shall
have exclusive jurisdiction to settle any dispute or claim that arises out of or in
connection with this DPA or its subject matter or formation (including
non-contractual disputes or claims).
8. Conflicts
Except as amended by this DPA, the Agreements will remain in full force and effect.
In the event of any conflict between the terms of this DPA and any other terms
between You and us, including but not limited to the terms of any Agreements, the
terms of this DPA will prevail.
ANNEX 1: DETAILS OF THE PROCESSING OF YOUR DATA
- Subject matter of the processing : Your Data
- Duration of the processing : Until termination of the DPA or until return or
deletion of Your Data in accordance with this
DPA, whichever later
- Nature and purpose of the : Collecting, recording, organising, sorting,
processing saving, modifying, storing, retrieving, using,
transferring, restricting, deleting, and such
other actions as are necessary to provide the
Services to You on the terms set out in the
Agreements and as further initiated by You in
Your use of the Services from time to time
- Types of personal data : Your Data as uploaded to or created on the
Services, whether by You or other users,
including without limitation, Your name, email
address and profile picture
- Categories of data subjects : The users of the Services in the European
Economic Area
- Controller’s obligations and : Your obligations and rights are as set out in
rights this DPA
ANNEX 2: DETAILS OF SUBPROCESSORS
Sub-processor Sub-processo Country Website
Name r Activity
Amazon Web Cloud United States of America https://aws.amazo
Services, Inc. computing and (“USA”) and any other n.com/
(“AWS”) storage country where AWS, its
affiliates or its https://aws.amazo
sub-processors maintain n.com/privacy/
data processing
operations
Microsoft Cloud Singapore, USA or any https://azure.micro
Corporation computing and other country in which soft.com/en-us/
(“Microsoft”) storage Microsoft or its affiliates
or subcontractors https://privacy.micr
maintain facilities osoft.com/en-ca/pri
vacystatement
Google LLC User behaviour USA and any other https://analytics.go
(“Google”) analytics country in which Google ogle.com/analytics/
or any of its web/
sub-processors maintains
facilities. Information on https://policies.goo
locations is available at gle.com/privacy
www.google.com/about/d
atacenters/inside/location
s/index.html
Crisp IM SARL* Customer Various countries within https://crisp.chat/e
support and the European Union and n/
communication USA
https://crisp.chat/e
n/privacy/
The Rocket Email Anywhere in the world https://mailchimp.c
Science Group notifications where Mailchimp, its om/
LLC d/b/a affiliates or its
Mailchimp sub-processors maintain https://mailchimp.c
data processing om/legal/privacy/
operations
Zendesk, Inc. Customer Anywhere in the world https://www.zende
(“Zendesk”)** support and where Zendesk, its sk.com
communication affiliates or its
sub-processors maintain https://www.zende
data processing sk.com/company/c
operations ustomers-partners/
privacy-policy/
* for BandLab for Education only
** for BandLab only
ANNEX 3: TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES
Such security measures include, but are not limited to:
1. the prevention of unauthorized persons from gaining access to personal data
processing systems,
2. the prevention of personal data processing systems from being used without
authorization,
3. ensuring that persons entitled to use a personal data processing system gain
access only to such personal data as they are entitled to accessing in
accordance with their access rights, and that, in the course of processing or
use and after storage, personal data cannot be read, copied, modified or
deleted without authorization,
4. ensuring that personal data cannot be read, copied, modified or deleted without
authorization during electronic transmission, transport or storage on storage
media, and that the target entities for any transfer of personal data by means of
data transmission facilities can be established and verified,
5. ensuring that personal data is processed solely in accordance with Your
instructions,
6. ensuring that personal data is protected against accidental destruction or loss.