Snapshot 64104
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Addendum
This Data Processing Addendum (“Addendum”) is incorporated into and forms part of the Agreement
(“Agreement”) between Zenoo Ltd (“Zenoo”) and the person contracting with Zenoo who agrees to
accept the provisions of this addendum (“Customer”) pursuant to one or more agreements with Zenoo
(each an “Agreement”). This Addendum is intended to ensure the parties’ compliance with Data
Protection Legislation.
1 Definitions
1.1 “Data Protection Legislation” means the Data Protection Act 2018, Regulation (EU)
2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of Personal Data and on the free movement of
such data, as it forms part of the law of England and Wales, Scotland and Northern Ireland by
virtue of section 3 of the European Union (Withdrawal) Act 2018 (or “UK GDPR”) and any
applicable guidance or regulations issued by the UK Information Commissioner, in each case as
amended or supplemented from time to time by UK law, and any other applicable laws from
time to time relating to the processing of Personal Data and privacy.
1.2 “Personal Data”, “Controller” and “Processor” have the meanings set out in the UK GDPR.
1.3 References to Zenoo “ensuring” (or where Zenoo agrees to “ensure”) are to be construed as
Zenoo implementing and maintaining such proportionate technical and organizational measures
as are designed to ensure that the relevant outcome is achieved to the extent only that those
measures are proportionate and appropriate in the context of the relevant Personal Data
reasonably expected to be processed pursuant to the Agreement.
2 Scope and relationship of the parties
2.1 Customer is the Controller or Processor (as applicable) and Zenoo acts as Processor or sub-
Processor.
2.2 Zenoo will process Personal Data solely for the purpose of providing services under the
Agreement and in accordance with documented instructions from Customer.
3 Compliance obligations
3.1 Zenoo agrees to ensure a level of security appropriate to the Personal Data processed by it
pursuant to the Agreement and to ensure that the following are implemented in accordance
with the requirements of applicable Data Protection Legislation:
3.1.1 Personal Data is processed lawfully, fairly, and transparently;
3.1.2 personnel accessing Personal Data are subject to appropriate confidentiality
obligations; and
3.1.3 assist the Customer in fulfilling its obligations regarding data subjects’ rights and
data protection impact assessments to the extent required of Zenoo by Data
Protection Legislation to which it is subject.
4 Sub-processing
4.1 Zenoo shall not engage sub-Processors without the Customer’s prior written approval.
4.2 Where the Customer approves the engagement of a sub-Processor, Zenoo will ensure that sub-
Processors are contractually bound by obligations that mirror those in this Addendum and shall
(unless otherwise agreed with the Customer) remain liable for any breaches by the sub-
Processor of the requirements of the Data Protection Legislation to implement and maintain
necessary technical and organizational measures in connection with the Agreement.
5 International transfers
5.1 Zenoo shall not transfer Personal Data outside the UK without ensuring adequate safeguards.
5.2 Transfers to third countries will be governed by the UK Addendum to the EU Standard
Contractual Clauses approved clauses for data transfers outside the UK or any applicable UK
Addendum or International Data Transfer Agreement as mandated by the UK’s Information
Commissioner’s Office or other applicable Supervisory Authority (as that term is defined in the
UK GDPR).
5.3 The EU-U.S. Privacy Shield shall not be used as a legal basis for data transfers.
6 Security and breach notification
6.1 Zenoo shall ensure that it maintains a robust information security program (including
appropriate access controls, encryption and incident response protocols).
6.2 In the event of a Personal Data breach, Zenoo shall notify the Customer without undue delay
and in any case within 24 hours.
7 Data subject rights and cooperation
7.1 Zenoo shall:
7.1.1 notify the Customer of any data subject request that it receives related to
Personal Data processed pursuant to the Agreement; and
7.1.2 ensure that it provides the Customer with such reasonable assistance as it is
reasonably able (at the Customer’s expense) to enable the Customer to comply
with its obligations under the applicable Data Protection Legislation.
8 Return or deletion of data
Upon termination of the Agreement, Zenoo shall, at Customer’s choice, return or securely
delete all Personal Data (except to the extent that Zenoo understands that it is required by law
to retain it).
9 Audits
The Customer may on reasonable notice audit Zenoo’s data processing activities and Zenoo
shall cooperate by providing all documentation reasonably necessary to demonstrate material
compliance.
10 Liability and remedies
Zenoo shall be liable for breaches of this Addendum. The Customer may seek injunctive relief in
the event of serious non-compliance.