Snapshot 64072
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Agreement
THIS DATA PROCESSING AGREEMENT (DPA) is made on the date of the last signature on the Order Form
This Data Processing Addendum (“DPA”) is an addendum to and forms part of the applicable Master Services Agreement (the
“Agreement”), entered into by and between the Customer (“Customer”) and Crownpeak US Inc. (“Crownpeak”), as identified
on the applicable Order Form, pursuant to which Customer has purchased subscriptions to Crownpeak’s services (“Services”).
The purpose of this DPA is to reflect the parties’ agreement with regard to the Processing of Personal Data, in accordance with
the requirements of Data Protection Laws and Regulations.
DATA PROCESSING TERMS
For the duration of the Agreement and in the course of providing the Services to Customer pursuant to the Agreement,
Crownpeak may Process Personal Data on behalf of Customer. Crownpeak and Customer each agree to comply with the
following provisions with respect to any Personal Data submitted by or on behalf of Customer to the Services.
1. DEFINITIONS AND INTERPRETATION
1.1 In this DPA, all defined terms shall have the meaning given in the Agreement, save in respect of the following words,
expressions, and abbreviations, which shall have the following meanings:
“Agreement” means the Master Services Agreement(s) entered into between the
Customer and Crownpeak, together with the schedules thereto and any
documents referred to in those agreement(s), as varied, novated,
supplemented, amended, or replaced from time to time;
“Appropriate Safeguards” means such legally enforceable mechanism(s) for transfers of Personal
Data as may be permitted under Data Protection Laws from time to time;
“Authorised Sub-processor” means any third party appointed by Crownpeak in accordance with the
Agreement or this DPA (as applicable), to process Personal Data;
“Crownpeak Group” means, in respect of Crownpeak, its Parent Undertakings, its Subsidiary
Undertakings and the Subsidiary Undertakings of any of its Parent
Undertakings from time to time;
“Customer Group” means, in respect of the Customer, its Parent Undertakings, its Subsidiary
Undertakings and the Subsidiary Undertakings of any of its Parent
Undertakings from time to time;
“Customer Data” means any Personal Data that Crownpeak processes on behalf of a
Controller as a Processor in the course of providing Products or Services,
as described in this Agreement.
“Data Protection Laws” means all applicable laws and rules, policies, guidance or
recommendations issued by any governmental, statutory or regulatory
body and any industry code of conduct or guideline, in each case relating
to data protection, the processing of personal data and privacy and in force
from time to time; and references to “controller”, “processor”, “data
subjects”, “personal data”, “process”, “processed”, and
“processing” have the meanings set out in, and will be interpreted in
accordance with, such laws, rules, policies, guidance, recommendations,
codes of conduct and guidelines;
“EEA” means the European Economic Area (as it is made up from time to time);
“European Union” means the European Union (as it is made up from time to time);
“GDPR” means the General Data Protection Regulation (EU GDPR)
“Indemnified Costs” means all costs (on a full indemnity basis) including legal and other
professional costs and costs of enforcement;
“Intra-Group Data Transfer means the Agreement that regulates data transfers between the
Agreement” respective entities within the Crownpeak Group;
“Parties” means the parties to the Agreement and this DPA;
“Personal Data” means the personal data (as such term is defined under the Data
Protection Laws) processed by Crownpeak pursuant to the Agreement, as
more particularly defined in Appendix 1 of this Processing Agreement;
“Personal Data Breach” has the meaning set out in, and will be interpreted in accordance with the
Data Protection Laws;
“Purpose” means the processing of Personal Data by Crownpeak pursuant to the
terms of the Agreement;
“Safe Country” means any country outside the EU and/or the United Kingdom which the
relevant authority (or relevant authorities) under the Data Protection Laws
determines offers an adequate level of data protection;
“Security Measures” means the minimum security measures set out in Appendix 2. to this
Processing Agreement;
“Services” means any product or service provided by Crownpeak to a customer
pursuant to the Master Services Agreement
“Standard Contractual Clauses” means contractual clauses annexed to the European Commission's
Implementing Decision 2021/914 of 4 June 2021 on standard contractual
clauses for the transfer of Personal Data to third countries pursuant to
Regulation (EU) 2016/679 of the European Parliament and of the Council.
"Sub-processor" means any Processor engaged by Crownpeak or its Subsidiaries to assist
in fulfilling its obligations with respect to providing the Services pursuant
to the Agreement or this DPA.
“Subsidiary” means, in respect of Crownpeak, its Parent Undertakings, its Subsidiary
Undertakings and the Subsidiary Undertakings of any of its Parent
Undertakings from time to time.
"UK Addendum" means the International Data Transfer Addendum (Version B1.0) issued
by the Information Commissioner's Office under s.119(A) of the UK Data
Protection Act 2018, as updated or amended from time to time.
1.2 In this Processing Agreement (except where the context otherwise requires):
1.2.1 headings are inserted for ease of reference only and shall not affect construction;
1.2.2 the expression “person” means any individual, firm, body corporate, unincorporated association,
partnership, government, state, or agency of state or joint venture;
1.2.3 the Appendices form part of this Processing Agreement and will have the same force and effect as if
expressly set out in the body of this Processing Agreement and any reference to this Processing
Agreement will include a reference to the Appendices;
1.2.4 references to any statute or statutory provision will include any subordinate legislation made under it
and will be construed as references to such statute, statutory provision and/or subordinate legislation
as modified, amended, extended, consolidated, re-enacted and/or replaced and in force from time to
time;
2
1.2.5 where the context requires, words denoting the singular include the plural and vice versa and words
denoting any gender include all genders; and
1.2.6 any words following the words “include”, “includes”, “including”, “in particular” or any similar words or
expressions will be construed without limitation and accordingly will not limit the meaning of the words
preceding them.
2. RELATIONSHIP WITH THE MASTER SERVICES AGREEMENT
2.1 The Parties acknowledge and agree that from the date of this DPA the processing of Personal Data pursuant to the
Agreement shall be governed by the terms of this DPA and in the event of any conflict between the terms, this DPA
shall prevail.
2.2 Except for the changes made by this DPA, the Agreement remains unchanged and in full force and effect.
2.3 Any claims brought under or in connection with this DPA shall be subject to the Agreement, including but not limited
to, the exclusions and limitations set forth in the DPA.
2.4 Any claims against Crownpeak or its Subsidiaries under this DPA shall be brought solely against the entity that is a
party to the Agreement. This DPA shall only become legally binding between the Customer and Crownpeak when
the Order Form referencing this DPA has been fully signed. The terms of this DPA will end simultaneously and
automatically with the termination of the Agreement, provided however any obligation imposed on a party under this
DPA in relation to the Processing of Personal Data shall survive any termination or expiration of the Agreement for as
long as that party maintains such Personal Data in its possession. This DPA is part of and subject to the terms of the
Agreement. Customer’s remedies with respect to any breach by Crownpeak of the terms of this Agreement will be
subject to any aggregate limitation of liability that applies to the Customer under the Agreement. With regard to the
subject matter of this DPA, in the event of inconsistencies between the provisions of this DPA and the Agreement,
the provisions of this DPA shall prevail with regard to the parties’ data protection obligations.
2.5 No one other than a party to this DPA, its successors and permitted assigns shall have any right to enforce any of its
terms.
2.6 This DPA shall be governed by and construed in accordance with governing law and jurisdiction provisions in the
Agreement, unless required otherwise by applicable Data Protection Laws.
2.7 This DPA will automatically terminate upon expiration or termination of the Agreement. The parties agree that certain
obligations might extend beyond the termination of this DPA in order to comply with legal requirements, such as anti-
money laundering requirements.
3. RELATIONSHIP OF THE PARTIES
3.1 The Parties acknowledge and agree that with regards to the Processing of Customer Data, the Customer is the
Controller and Crownpeak is the Processor. Crownpeak will process Customer Data in accordance with the
Customer’s instructions as outlined in Section 4.2 of this DPA.
4. SCOPE OF PROCESSING
4.1 Customer Processing of Customer Data. Customer agrees that (i) it shall comply with its obligations as a Controller
under Data Protection Laws in respect of its processing of Customer Data and any processing instructions it issues
to Crownpeak, and (ii) it has provided notice and obtained (or shall obtain) all consents and rights necessary under
Data Protection Laws for Crownpeak Technology GmbH to process Customer Data and provide the Services pursuant
to the Agreement and this DPA.
4.2 Customer Instructions. Crownpeak shall process Customer Data in accordance with Customer’s instructions. By
entering into the Agreement, Customer instructs Crownpeak to process Customer Data to provide the Services, and
pursuant to any other written instructions given by Customer and acknowledged in writing by Crownpeak as
constituting instructions for purposes of this Agreement. Customer acknowledges and agrees that such instruction
authorizes Crownpeak to Process Customer Data (a) to perform its obligations and exercise its rights under the
Agreement; (b) to perform its legal obligations and to establish, exercise or defend legal claims in respect of the
Agreement; and (c) to provide the service as described in the Agreement, including but not limited to billing, account
management, technical support, and product development.
4.3 Crownpeak Processing of Customer Data. Crownpeak shall process Customer Data for the purposes described in
this DPA and only in accordance with Customer’s documented lawful instructions. The parties agree that this DPA
and the Agreement set out the Customer’s complete and final instructions to Crownpeak in relation to the processing
of Customer Data and processing outside the scope of these instructions (if any) shall require prior written agreement
between Customer and Crownpeak.
3
5. PROCESSING OF PERSONAL DATA
5.1 The Customer, acting as Controller, authorises Crownpeak to process the Personal Data during the term of the
Agreement as a processor solely for the Purpose and to the extent described in Appendix 1.
5.2 To the extent that Crownpeak is acting in its capacity as a processor for and on behalf of the Customer, Crownpeak
agrees and warrants that it will:
5.2.1 only process the Personal Data for the Purposes specified and, in any event, only pursuant to any
documented lawful instructions received from the Customer (including, for the avoidance of doubt, this
DPA, unless required by law to act without such instructions. In which case, Crownpeak will notify the
Customer of any such legal requirement prior to such processing unless such law prohibits notice to the
Customer on public interest grounds;
5.2.2 immediately inform the Customer if, in its reasonable opinion, any instruction received in connection
with this DPA infringes any Data Protection Laws;
5.2.3 at all times comply with its obligations under the Data Protection Laws, in relation to the processing of
the Personal Data;
5.2.4 immediately notify the Customer in writing of any changes to the Services and/or the processing details
set out in Appendix 1.
6. SECURITY
6.1 Crownpeak shall implement and maintain appropriate technical and organisational measures at a minimum to the
standard of the Security Measures outlined in Appendix 2 to ensure a level of security appropriate to the risk
presented by processing the Personal Data, including as appropriate:
6.1.1 the pseudonymization and encryption of Personal Data;
6.1.2 the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing
systems and services;
6.1.3 the ability to restore the availability and access to Personal Data in a timely manner in the event of a
physical or technical incident; and
6.1.4 a process for regularly testing, assessing and evaluating the effectiveness of technical and
organisational measures for ensuring the security of processing;
7. COOPERATION AND SUPPORT
7.1 Crownpeak shall maintain a written Record of Processing Activity (RoPA) in accordance with the Data Protection
Laws, including in electronic form (the “Data Record”), of all categories of processing activities carried out on behalf
of the Customer on Personal Data and promptly upon request provide a copy of the Data Record to the Customer.
7.2 Crownpeak shall promptly notify the Customer of any request that it receives for exercise of a data subject’s rights
under the Data Protection Laws or communication or complaint that it receives from a data subject or Supervisory
Authority or other third party in connection with Customer Data;
7.3 Crownpeak shall provide reasonable assistance to the Customer in responding to requests for exercising data
subjects’ rights under the Data Protection Laws and communications and complaints from data subjects and
Supervisory Authorities and other third parties in connection with Customer Data, including by appropriate technical
and organisational measures, insofar as this is possible;
7.4 Crownpeak shall provide reasonable assistance to the Customer in:
7.4.1 documenting any Personal Data Breaches to the standard required in order to meet notification
requirements under Data Protection Laws;
7.4.2 taking measures to address Personal Data Breaches, including, where appropriate, measures to
mitigate their possible adverse effects; and
7.4.3 conducting data protection impact assessments of any processing operations and consulting with
Supervisory Authorities, data subjects and their representatives accordingly.
7.5 Crownpeak shall comply with instructions from the Customer regarding the rectification, deletion, blocking and making
available of Personal Data, during and after the term of the Agreement. The Customer shall be responsible for any
costs arising from Crownpeak’s provision of such assistance;
4
7.6 Crownpeak shall not, without the Customer’s prior written consent, respond to any request for exercise of a data
subject’s rights under the Data Protection Laws or communication or complaint from a data subject or Supervisory
Authority in connection with Personal Data. The Customer shall be responsible for any costs arising from Crownpeak’s
provision of such assistance;
7.7 Crownpeak shall reasonably cooperate with Customer, in relation to any audit of Crownpeak necessary to enable
Customer to comply with its obligations under applicable Data Protection Laws and shall seek the equivalent
cooperation from relevant Sub-processors. Except where prohibited by law, any such audit shall be subject to the
confidentiality obligations set forth in the Agreement.
7.8 Any audit shall be conducted either by Customer of by a third party auditor mandated by Customer, provided that
such third-party auditor has signed a confidentiality agreement with Crownpeak and is not a competitor of Crownpeak
or any Crownpeak Affiliate and provided that such audit is limited to the legally required scope. Customer shall use
reasonable endeavours to minimise any disruption caused to the Crownpeak’s business activities as a result of such
audit. No audit shall last more than two (2) business days each time unless a longer period is required to fulfil any
requirement under Data Protection Laws. Audits shall take place no more than once in any calendar year unless and
to the extent that Customer (acting reasonably and in good faith) has reasonable grounds to suspect any material
breach of this DPA by Crownpeak and/or is required to perform by a court or Supervisory Authority. Costs of the audit,
including appointment of the auditor, will be borne by Customer.
7.9 For the avoidance of doubt, Customer shall reimburse Crownpeak for any and all reasonable expenses incurred by
Crownpeak in compliance with the obligations under Clause 7.
8. BREACH MANAGEMENT
8.1 Crownpeak shall take reasonable efforts to notify the Customer within 48 hours after becoming aware of a Personal
Data Breach and provide (save where, and in so far as, it is not possible to provide the following information at the
same time, in which case the information may be provided in phases without undue further delay) all relevant
information in relation to the Personal Data Breach affecting the Customer, including:
8.1.1 the nature of the Personal Data Breach and details of the likely consequences of the Personal Data
Breach;
8.1.2 the categories and approximate number of data subjects and Personal Data records concerned; and
8.1.3 any measure proposed to be taken to address the Personal Data Breach and to mitigate its possible
adverse effects;
8.1.4 Take steps deemed necessary and reasonable in order to remediate the cause of such Persona Data
Breach to the extent the remediation is within Crownpeak’s reasonable control.
8.2 In relation to the provision of information, Crownpeak will not delay notification under Clause 8.1 on the basis that an
investigation is incomplete or ongoing.
8.3 Crownpeak shall not make or permit any announcement, in respect of any Personal Data Breach to any person
relevant to the Customer without the Customer’s prior written consent.
9. SUB-PROCESSORS
9.1 Subject to Clause 9.2, Customer agrees that Crownpeak’s subsidiaries may act as sub-processors and that
Crownpeak Group may engage sub-processors to process Customer Data on the Customer’s behalf. Crownpeak will
not transfer or otherwise permit the disclosure of the Personal Data to any third party, permit any third party to process
Personal Data or engage or use any third party for the processing of Personal Data, including new sub-processors,
without the prior written authorisation of the Customer;
9.2 To the extent Crownpeak appoints an Authorised Sub-processor, Crownpeak will:
9.2.1 before the Authorised Sub-processor first processes Personal Data, carry out adequate due diligence
to ensure that the Authorised Sub-processor is capable of providing a substantially similar level of
protection for Personal Data required by this DPA;
9.2.2 prior to the processing taking place, ensure that there is a written contract in place between Crownpeak
and the Authorised Sub-processor that specifies the Authorised Sub-processor’s activities and imposes
on the Authorised Sub-processor a substantially similar level of protection for Personal Data as those
imposed on Crownpeak in this Agreement;
9.2.3 remain responsible for all acts and omissions of Authorised Sub-processors as if they were its own; and
9.2.4 promptly notify the Customer of any changes, additions or replacements of sub-processors.
5
9.2.5 if within ten (10) business days of receipt of that notice, Customer notifies Crownpeak in writing of any
objections (on reasonable grounds) to the proposed appointment, Crownpeak and the Customer shall
negotiate in mutual good faith to address Customer’s objections. In the event Crownpeak and Customer
reasonably conclude that Customer’s objections cannot be resolved, then Customer shall have the right
to terminate the Services in accordance with Section 10.2 of the Agreement. If, within ten (10) business
days of receipt of that notice, Customer does not notify Crownpeak of any objections, then the
appointment of the new Sub-processor shall be deemed accepted.
10. CONFIDENTIALITY
10.1 Crownpeak shall ensure that its personnel engaged in the Processing of Customer Data are informed of the
confidential nature of the Customer Data, have received appropriate training on their responsibilities related to the
protection and security of Personal Data, and have executed written confidentiality agreements.
10.2 Crownpeak shall ensure that Crownpeak’s access to Customer Personal Data is limited to those personnel who
require access in connection with the Purpose detailed in Appendix 1 of this Agreement.
11. RETURN OR DELETION OF DATA
11.1 At the option of the Customer, Crownpeak shall securely delete or return to the Customer (in the format required by
the Customer) all Personal Data promptly after the end of the provision of Services relating to processing (or at any
time upon request), and securely delete any remaining copies and promptly certify (via a director) when this exercise
has been completed.
12. INTERNATIONAL TRANSFERS
12.1 To the extent that there is a transfer of EU or UK Personal Data from the Customer to Crownpeak (or an Authorised
Sub-processor appointed by Crownpeak), Crownpeak will (or will ensure that the Authorised Sub-processor will) enter
into the EU Standard Contractual Clauses or UK the International Data Transfer Addendum prior to any transfer taking
place or, with the prior consent of the Customer, put in place alternative agreed transfer mechanisms completed in
accordance with Articles 44-50 of the GDPR and/or approved by the European Commission or the UK’s Information
Commission Officer (ICO).
12.2 With respect to any transfers of Personal Data under this Processing Agreement between Crownpeak Group, the
parties agree to rely on Crownpeak’s Intra-Group Data Transfer Agreement (‘IGDTA’) between Crownpeak
Technology, Inc. and all other Crownpeak Group entities which contains the relevant Standard Contractual Clauses.
12.3 Crownpeak will only make a transfer of Personal Data to a country or territory, to which such transfer is prohibited or
subject to any requirement to take additional steps, to adequately protect the Personal Data for the transfer to be
lawful under the Data Protection Laws, if:
12.3.1 the country or territory to which the Personal Data will be transferred is a Safe Country;
12.3.2 the transfer is pursuant to a written contract in the form of the Processor Model Clauses prior to any
transfer taking place, or, with the prior consent of the Customer, Crownpeak puts in place an alternative
agreed transfer mechanism that is completed in accordance with the Data Protection Laws;
12.3.3 the transfer is effected by way of Appropriate Safeguards (and the Customer’s prior written approval of
the form of such Appropriate Safeguards must be obtained); in relation to the transfer (whether in
accordance with UK or EU GDPR Article 46 or section 75 of the DPA 2018) as determined by the
Controller which could include relevant parties entering into the International Data Transfer Agreement
(the “IDTA”), or International Data Transfer Agreement Addendum to the European Commission’s SCCs
(the “Addendum”), as published by the Information Commissioner’s Office from time to time, as well as
any additional measures determined by the Controller;
12.3.4 Crownpeak or the relevant Authorised Sub-processor is required to make the transfer to comply with:
12.3.4.1 European Union law or European Union member state law, to which Crownpeak is
subject; or
12.3.4.2 United Kingdom law to which Crownpeak is subject, in which case Crownpeak will
notify the Customer of such legal requirement prior to such transfer unless such law
prohibits notice to the Customer on public interest grounds.
13. ENTIRE AGREEMENT
13.1 To the extent that there is any conflict between the terms of the Agreement and this DPA as it relates to the processing
of Personal Data (including the appointment of Authorised Sub-processors), this DPA shall prevail.
6
13.2 This DPA, together with the Agreement, constitutes the entire agreement between the Parties as it relates to the
processing of Personal Data and supersedes any previous agreements, arrangements, undertakings, or proposals,
written or oral, between the Parties in relation to its subject matter.
13.3 The Parties agree that this DPA (and, in particular, the Appendices included hereto) may be updated from time to
time by written agreement between the Parties, so as to reflect the factual position of the Personal Data processing
at the relevant time and/or future changes in the legislation applicable to processing of personal data.
13.4 Where, under this DPA, Crownpeak is required to notify the Customer of any matter or thing, such notification will be
marked for the attention of the Customer’s Data Protection Officer and sent by e-mail to the following e-mail address:
<Company e-mail address>
7
APPENDIX 1
Personal Data
Product or Service: Digital Governance Management Services
Subject matter and Duration of The subject matter and duration of the Processing of the Customer Data are set
processing out in the Agreement and this DPA.
Nature and Purpose of Crownpeak provides a consent management platform, used by Customer to
processing inform website visitors of first- and third-party data collection practices and to
track visitors’ consent to or refusal of collection and processing of same by
Customer and its partners.
Type of personal data Authorized Username and email addresses.
IP address and pseudonymized data used to track users’ consent choices.
Categories of data subject Authorized users of the Services.
Website visitors of Customer.
Product or Service: Digital Quality Management Services
Subject matter and Duration of The subject matter and duration of the Processing of the Customer Data are set out
processing in the Agreement and this DPA.
Nature and Purpose of processing Crownpeak provides a digital quality management platform, used by Customer to
assess and control the quality and consistency of its digital touchpoints.
Type of personal data Authorized Username and email addresses.
Categories of data subject Authorized users of the Services.
Product or Service: FirstSpirit Services
Subject matter and Duration of The subject matter and duration of the Processing of the Customer Data are set out
processing in the Agreement and this DPA.
Nature and Purpose of processing Crownpeak provides a digital experience management platform, used by Customer to
build and manage websites and digital experiences.
Crownpeak’s activities are limited to: (i) Capturing of behaviour data to understand
how the customer uses the platform; (ii) account log in; and (iii) providing targeted
content within the application.
Crownpeak does not collect or process any Personal Data beyond that stated above.
Type of personal data Authorized Username, IP address, location and email address.
Categories of data subject Authorized users of the Services.
Product or Service: Digital Experience Management Services
Subject matter and Duration of The subject matter and duration of the Processing of the Customer Data are set
processing out in the Agreement and this DPA.
Nature and Purpose of Crownpeak provides a digital experience management platform, used by
processing Customer to build and manage websites and digital experiences.
Crownpeak’s activities are limited to: (i) Capturing of behaviour data to
understand how the customer uses the platform; (ii) account log in; and (iii)
providing targeted content within the application.
Crownpeak does not collect or process any Personal Data beyond that stated
above.
Type of personal data Authorized Username, IP address, location and email address.
Categories of data subject Authorized users of the Services.
Product or Service: Fredhopper Services
Subject matter and Duration of The subject matter and duration of the Processing of the Customer Data are set
processing out in the Agreement and this DPA.
Nature and Purpose of Crownpeak provides a product search, navigation and merchandising
processing functionality, used by Customer to build and manage their eCommerce platforms.
Crownpeak’s activities are limited to: (i) Browsing information and purchasing
tendencies and (ii) account log in.
Crownpeak does not collect or process any Personal Data beyond that stated
above.
Type of personal data Authorized User’s full name and email address.
Categories of data subject Authorized users of the Services.
Product or Service: Experience Orchestrator Services
Subject matter and Duration of The subject matter and duration of the Processing of the Customer Data are set
processing out in the Agreement and this DPA.
Nature and Purpose of Crownpeak provides smart merchandising capabilities on Customer’s
processing eCommerce platform that enable the Customer to verify, analyse and optimize
personalization algorithms and merchandising rules, as well as recommend
product or content based on algorithm strategies during the customer journey.
Crownpeak’s activities are limited to: (i) Capturing of behaviour data to
understand how the customer and the Customers Client’s/End Users use the
platform; (ii) account log in; and (iii) providing targeted content within the
application.
Crownpeak does not collect or process any Personal Data beyond that stated
above.
Type of personal data Authorized User’s full name, email address, browsing time and IP address.
2
Customer’s Clients/End Users: Browsing Time, IP Address, Purchasing
Tendencies, Geolocation and Account ID.
Categories of data subject Authorized users of the Services; Customer’s clients and prospects.
Product or Service: AI Search Services
Subject matter and Duration of The subject matter and duration of the Processing of the Customer Data are set
processing out in the Agreement and this DPA.
Nature and Purpose of Crownpeak provides search capabilities powered by AI to eliminate results
processing requests, increase search conversion rate and better detect shoppers’ intent.
Crownpeak’s activities are limited to (i) Capturing of behaviour data to understand
how the customer and the Customers Client’s/End Users use the platform; (ii)
account log in.
Crownpeak does not collect or process any Personal Data beyond that stated
above.
Type of personal data Authorized User’s full name and email address.
Categories of data subject Authorized users of the Services.
3
APPENDIX 2
Technical and Organisational Measures
Measures of pseudonymization and encryption of personal Crownpeak ensures all private and customer data is
data encrypted and/or anonymized in transit and at rest.
Measures for ensuring ongoing confidentiality, integrity, Crownpeak completes annual audits against all major controls
availability and resilience of processing systems and which detail the tested processes of confidentiality, integrity,
services availability and resilience of the systems which house and
process customer data.
Measures for ensuring the ability to restore the availability Disaster recovery and business continuity procedures are
and access to personal data in a timely manner in the event clearly defined and tested on a continual basis. Scenarios are
of a physical or technical incident played out and reviewed in an annual risk assessment to
ensure appropriate mitigation efforts.
Processes for regularly testing, assessing, and evaluating Information Security oversight is maintained by the CISO,
the effectiveness of technical and organisational measures DPO, CTO and InfoSec Team. Monthly, Quarterly and Yearly
in order to ensure the security of the processing testing over controls occur and gaps are remediated according
to risk.
Measures for user identification and authorization Regimented controls are in place for onboarding,
offboarding and account access control.
Measures for the protection of data during Encryption and advanced algorithms are used to protect
transmission transmission of data.
Measures for the protection of data during storage Data at rest is stored in encrypted AES format.
Measures for ensuring physical security of locations at which AWS SOC2 and Google Cloud Platform SOC2 details all
personal data are processed physical controls in place for data centres.
Measures for ensuring events logging Events are logged through an advanced SIEM and overseen
by a 24/7 managed Security Operations Center.
Measures for ensuring system configuration, including Crownpeak audit reports detail management of secure
default configuration configurations and removal of default configurations.
Measures for internal IT and IT security governance and Oversight of security controls and governance is led by the
management CISO, DPO, CTO and the InfoSec Team.
Measures for certification/assurance of processes and Crownpeak completes audits and Privacy Shield each year.
products
4
Measures for ensuring data minimisation Controls concerning data management and minimization are
detailed in Crownpeak’s audit controls which state that systems
are protected by strict controls limiting data to the minimum
required for the services.
Measures for ensuring data quality
Data quality is ensured through management controls put in
place to oversee data ingestion through change management
which is described in Crownpeak’s audit reports.
Data retention is defined per customer engagement and
Measures for ensuring limited data retention enforced through standard controls.
Measures for ensuring accountability Management oversees all aspects of the Information Security
control practices and tracks aspects of the program through risk
management, roadmap and risk register procedures.
Measures for allowing data portability and ensuring erasure Physical management of data and erasure is governed by
controls detailed in the Crownpeak audit procedures.
5
APPENDIX 3
Sub-Processors
For the purposes of this processing agreement, a list of pre-approved sub-processors acting on behalf of Crownpeak Group can
be found at https://www.crownpeak.com/policies/gdpr/
6