Snapshot 64842
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Comm100 Data Processing Addendum
This Data Processing Addendum ("DPA") supplements the Comm100 EULA available at
https://www.comm100.com/eula/ or other agreement between Customer and Comm100
Network Corporation (“Comm100” or “Processor”) when the GDPR applies to your use of the
Comm100 Service(s) to process the Personal Data. This DPA is an agreement between you
and the entity you represent and Comm100. Unless otherwise defined in this DPA or EULA, all
capitalized terms used in this DPA will have the meanings given to them in Section 1 of this
DPA.
1. DEFINITIONS
“Controller” means the natural or legal person, public authority, agency or other body which,
alone or jointly with others, determines the purposes and means of the Processing of Personal
Data.
“Controller Personal Data” means the Personal Data which Comm100 is processing as
Processor on behalf of Controller in order to provide the Services.
“Data Subject” is the identified or identifiable natural person the Personal Data is relating
to.
“Data Protection Law(s)” means the GDPR and all Member State data protection laws and
regulations.
"GDPR" means the General Data Protection Regulation 2016/679.
“Member State” means a country that is member of the European Union or the European
Economic Area.
“Personal Data” means any information relating to a Data Subject’, which information is
subject to the Data Protection Laws; an identifiable natural person is one who can be
identified, directly or indirectly, in particular by reference to an identifier such as a name, an
identification number, location data, an online identifier or to one or more factors specific to
the physical, physiological, genetic, mental, economic, cultural or social identity of that
natural person.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful
destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data
transmitted, stored or otherwise processed.
“Process” or “Processing” means any operation or set of operations which is performed on
Personal Data or on sets of Personal Data, such as collection, recording, organization,
structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by
transmission, accessing, alignment or combination, restriction, erasure or destruction.
“Processor” means a natural or legal person, public authority, agency or other body, which
processes Personal Data on behalf of the Controller, for the avoidance of doubt, the Processor
shall be the entity identified as the Processor in the Preamble.
Data Protection Agreement © 2022 Comm100 Network Corporation. All Rights Reserved. Used by permission
“Service(s)”, means the services provided by Processor as agreed in the EULA and excludes
Processor services or products that are: (i) beta basis, (ii) not generally available for licensing
to Processor’s customers, (iii) or any third party products or services that integrate or
interoperate with the Services.
“Storage Period” means the save time of Personal Data depends on the Services and plan
which the Controller used, which is defined in the EULA.
“Subprocessor” means any subcontractor or any of Processor’s subsidiaries and affiliates
engaged for the Processing of Controller Personal Data only. A list of current Subprocessor
will be provided to Controller upon request.
“Supervisory Authority” means an independent public authority which is established by a
Member State pursuant to the GDPR.
2. DATA PROCESSING
2.1 This Agreement applies solely to the extent Comm100 Processes Controller’s Personal
Data. The Controller hereby appoints Comm100 as Processor to Process such Personal Data
in Accordance with this Agreement.
2.2 Comm100 shall Process the Controller’s Personal Data for the sole purpose of providing
the Services according to the terms of this Agreement and as Permitted by the EULA. The
Controller acknowledges and agrees that this Agreement and the EULA collectively contain
its instructions for the Processing of Controller Personal Data. Comm100 will implement
Controller’s documented additional reasonable instructions which, unless expressly agree
otherwise, shall at all times be consistent and in accordance with the nature of the EULA.
Comm100 may terminate the EULA if Controller provides instructions to Process Personal
Data which are inconsistent with the EULA, or Comm100 could not comply with without (i)
incurring additional costs or (ii) undertaking material variations to the manner in which
the Services are provided which variations Comm100 does not propose to introduce in
respect of the majority of its other customers.
2.3 Comm100 shall reasonably comply with all applicable Data Protection Laws in respect of
the Services applicable to it as a Processor. Comm100 shall not be responsible for
complying with Data Protection Laws applicable to Controller or its industry that are not
otherwise consistent with the provision of the Services or if, and to the extent that, the
relevant provision of Data Protection Law would not also apply to Comm100’s provision of
services equivalent to the Services to other customers. Customers shall comply with all
Data Protection Laws applicable to Customer as Controller.
2.4 The Processing activities that Comm100 will provide, and the types of Personal Data that
will be Processed by Comm100 are detailed below.
Nature, purpose and subject matter of the Processing
To enable ongoing communications between Controller and its customers and other end
users, to record such communications, and to operate the Services, where applicable, all
in accordance with the EULA.
Data Protection Agreement © 2022 Comm100 Network Corporation. All Rights Reserved. Used by permission
Duration of the Processing
For the Storage Period as defined in the EULA.
Data Types
Personal data captured in communications between Controllers and their customers or
other individuals.
Categories of Data Subjects
Controller’s customers or any other individuals or entities that Controller uses the
Services to engage with.
3. DATA SUBPROCESSING
3.1 Controller hereby consents and authorizes Comm100 to engage the Subcontractors listed
in this web page. Comm100 will notify Controller (via email, the Services, or otherwise)
of any intended changes concerning the addition or replacement of other Sub-processors
and add the names of new and replacement sub-processors to the list prior to them
starting sub-processing of Personal Data. In the event that Controller has a reasonable
objection to change, Controller will provide notice to Comm100 within fourteen (14)
calendar days of Comm100’s notice. (a) Comm100 shall work with Controller in good faith
to make availa-ble a commercially reasonable change in the provision of the Services
which avoids the use of that Subprocessor; and (b) where such a change cannot be made
and Comm100 choose to retain the Subprocessor, Comm100 shall notify Controller at least
fourteen (14) days prior to the authorization of the Subprocessor to Process Controller’s
Personal Data and the Controller may terminate the EULA.
3.2 Comm100 remains responsible for the Sub-processors and for their acts and omissions to
the same extent that Comm100 would be responsible for such acts or omissions under this
Agreement.
4. TECHNICAL AND ORGANIZATIONAL MEASURES
Comm100 shall implement and maintain appropriate technical and organizational measures
designed to protect the security, confidentiality and integrity of the Personal Data, including
to protect Personal Data against accidental or unlawful destruction, loss, alteration,
unauthorized disclosure of, or access to. Comm100 reserves the right to update its technical
and organizational measures and will not materially decrease the overall security of the
Services. Comm100 is certified under ISO 27001 and agrees to maintain an information
security program for the Services that complies with the ISO 27001 standards for the
establishment, implementation, control, and improvement of the Comm100 security
standards.
5. ASSISTANCE AND COMPLIANCE WITH DATA REQUESTS
In the event a Data Subject requests access to, or the deletion, blocking, and/or correction of
any Personal Data directly to Comm100, Comm100 will promptly notify the Controller of such
request to the extent legally permissible. In addition, Comm100 will provide the Controller
with reasonable assistance to enable the Controller to address the Data Subjects’ request. In
Data Protection Agreement © 2022 Comm100 Network Corporation. All Rights Reserved. Used by permission
the event a government or Supervisory Authority demands access to Personal Data, Comm100
will promptly notify Controller prior to disclosure unless prohibited by law.
6. INFORMATION AND AUDIT
6.1 Comm100 uses external auditors to verify its information security program. This audit: (a)
will be performed at least annually; (b) will be performed according to ISO 27001 stand-
ards or such other alternative standards that are substantially equivalent to ISO 27001; (c)
will be performed by independent third-party security professional at Comm100’s selec-
tion and expense; and (d) will result in the generation of an audit report, which will be
Comm100’s confidential information. If Controller request, the reports will be made avail-
able to Controller subject to a non-disclosure agreement covering the report (an “NDA”).
6.2 At Controller’s written request, Comm100 will provide Controller with all the requested
confidential information so that Controller can reasonably verify Comm100’s compliance
with the security obligations under this Agreement. If Controller’s agreement does not in-
clude a provision protecting Comm100 confidential information, the information will be
made available to Controller subject to a mutually agreement upon non-disclosure agree-
ment covering the report (an “NDA”).
7. PERSONAL DATA DELETION
Comm100 will, unless otherwise required by Data Processing Law and subject to Comm100’s
Storage Period, either delete, make inaccessible, or return to the Controller all Controller
Personal Data upon termination or expiration of EULA, as requested by Controller. For the
avoidance of doubt, the Controller can download transcripts of its interactions with its Data
Subjects via the Services in accordance with the EULA.
8. SECURITY BREACH NOTIFICATION
If Comm100 becomes aware of either, (a) any unlawful access to any Personal Data; or (b) any
unauthorized access to any Personal Data, where in either case such access results in loss,
disclosure, or alteration of Personal Data, Comm100 will as promptly as possible: (a) notify
Controller of the security incident; and (b) take reasonable steps to mitigate the effects and
to minimize any damage resulting from the security incident.
Data Protection Agreement © 2022 Comm100 Network Corporation. All Rights Reserved. Used by permission