Snapshot 73153
Normalized text
Scripts and page chrome removed; this is what change detection compares.
DATA PROCESSING AGREEMENT/ADDENDUM
This Data Processing Agreement (“DPA”) is made and entered into as of this ____ day of ______, 202 __ forms part of the Service
Terms and Conditions (the “Agreement”). You acknowledge that you, (“Organization”) (collectively, ”You”, ”Your”, “Client”, or
“Data Controller”) have read and understood and agree to comply with this DPA, and are entering into a binding legal agreement
with Tuvis Solutions Ltd. as defined below (“Tuvis”, ”Us”, ”We”, ”Our”, “Service Provider” or “Data Processor”) to reflect the
parties’ agreement with regard to the Processing of Personal Data (as such terms are defined below) subject to the Data Protection
Laws and Regulations under this DPA. Both parties shall be referred to as the “Parties” and each, a “Party”.
WHEREAS, Tuvis shall provide the services set forth in the Agreement (collectively, the “Services”) for Client, as described in
the Agreement; and
WHEREAS, In the course of providing the Services pursuant to the Agreement, we may process Personal Data on your behalf, in
the capacity of a “Data Processor”; and the Parties wish to set forth the arrangements concerning the processing of
Personal Data (defined below) within the context of the Services and agree to comply with the following provisions
with respect to any Personal Data, each acting reasonably and in good faith.
NOW THEREFORE, in consideration of the mutual promises set forth herein and other good and valuable consideration, the receipt
and sufficiency of which are hereby acknowledged by the Parties, the parties, intending to be legally bound, agree as follows:
1. INTERPRETATION AND DEFINITIONS
1.1 The headings contained in this DPA are for convenience only and shall not be interpreted to limit or otherwise
affect the provisions of this DPA.
1.2 References to clauses or sections are references to the clauses or sections of this DPA unless otherwise stated.
1.3 Words used in the singular include the plural and vice versa, as the context may require.
1.4 Capitalized terms not defined herein shall have the meanings assigned to such terms in the Agreement.
1.5 Definitions:
(a) “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common
control with the subject entity. “Control”, for purposes of this definition, means direct or indirect
ownership or control of more than 50% of the voting interests of the subject entity.
(b) “Authorized Affiliate” means any of Client’s Affiliate(s) which (a) is subject to the Data Protection Laws
And Regulations of the European Union, the European Economic Area and/or their member states,
Switzerland and/or the United Kingdom, and (b) is permitted to use the Services pursuant to the Agreement
between Client and Tuvis, but has not signed its own agreement with Tuvis and is not a “Client” as defined
under the Agreement.
(c) “CCPA” means the California Consumer Privacy Act of 2018 and its modifications and amendments,
including the California Privacy Rights Act.
(d) “Controller” or “Data Controller” means the entity which determines the purposes and means of the
Processing of Personal Data. For the purposes of this DPA only, and except where indicated otherwise, the
term “Data Controller” shall include the Organization and/or the Organization’s Authorized Affiliates.
(e) “Data Protection Laws and Regulations” means all laws and regulations of the European Union, the
European Economic Area and their Member States, the United Kingdom and Brazil, if applicable to the
Processing of Personal Data under the Agreement.
(f) “Delete” means to remove or obliterate Personal Data such that it cannot be recovered or reconstructed.
(g) “Data Subject” means the identified or identifiable person to whom the Personal Data relates.
(h) “Member State” means a country that belongs to the European Union and/or the European Economic
Area. “Union” means the European Union.
(i) “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April
2016 on the protection of natural persons with regard to the processing of personal data and on the free
movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
(j) “LGPD” means the Brazilian General Data Protection Law no 13709/2018 (“Lei Geral de Proteção de
Dados Pessoais”).
(k) “Tuvis” means the relevant Tuvis entity of the following Tuvis legal entities: Tuvis Solutions Ltd.
(l) “Tuvis Group” means Tuvis and its Affiliates engaged in the Processing of Personal Data.
(m) “Personal Data” means any information relating to an identified or identifiable natural person; an
identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to
an identifier such as a name, an identification number, location data, an online identifier or to one or more
factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that
natural person..
(n) “Process(ing)” means any operation or set of operations which is performed upon Personal Data, whether
or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or
alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making
available, alignment or combination, restriction, erasure or destruction.
(o) “Processor” or “Data Processor” means the entity which Processes Personal Data on behalf of the
Controller.
(p) “Security Documentation” means the Security Documentation applicable to the specific Services
purchased by Client, attached in the current version as of date of this DPA as Schedule 2 to this DPA and as
updated from time to time, and such new versions are accessible by request to privacy@tuvis.com, or as
otherwise made reasonably available by Tuvis.
(q) “Standard Contractual Clauses“ or “SCC” means (i) the applicable module of the standard contractual
clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the
European Parliament and of the Council from June 4th 2021, as available here, as updated, amended,
replaced or superseded from time to time by the European Commission; or (ii) where required from time to
time by a supervisory authority for use with respect to any specific restricted transfer, any other set of
contractual clauses or other similar mechanism approved by such Supervisory Authority or by Applicable
Laws for use in respect of such Restricted Transfer, as updated, amended, replaced or superseded from time
to time by such Regulatory Authority or Data Protection Laws and Regulations.
(r) “Sub-processor” means any Processor engaged by Tuvis and/or Tuvis Affiliate to Process Personal Data
on behalf of Client.
(s) “Supervisory Authority” means an independent public authority which is established by an EU Member
State pursuant to the GDPR or in Brazil pursuant to the LGPD.
2. PROCESSING OF PERSONAL DATA
2.1 The Parties acknowledge and agree that with regard to the Processing of Personal Data under this DPA, Tuvis is
the Data Processor and that (iii) Tuvis or members of the Tuvis Group may engage Sub-processors pursuant to
the requirements set forth in Section 5 “Sub-processors” below. For clarity, this DPA shall not apply with respect
to Tuvis processing activity as a Data Controller with respect to Tuvis data as defined in the Privacy Policy.
2.2 Client shall, in its use of the Services, Process Personal Data in accordance with the requirements of Data
Protection Laws and Regulations and comply at all times with the obligations applicable to data controllers.
For the avoidance of doubt, Client’s instructions for the Processing of Personal Data shall comply with Data
Protection Laws and Regulations. Client shall have sole responsibility for the means by which Client acquired
Personal Data. Without limitation, Client shall comply with any and all transparency-related obligations
(including, without limitation, displaying any and all relevant and required privacy notices or policies) and shall
at all times have any and all required ongoing legal bases in order to collect, Process and transfer to Tuvis the
Personal Data and to authorize the Processing by Tuvis of the Personal Data which is authorized in this DPA.
Client shall defend, hold harmless and indemnify Tuvis, its Affiliates and subsidiaries (including without
limitation their directors, officers, agents, subcontractors and/or employees) from and against any liability of
any kind related to any breach, violation or infringement by Client and/or its authorized users of any Data
Protection Laws and Regulations and/or this DPA and/or this Section.
2.3 Tuvis’ Processing of Personal Data.
a. Subject to the Agreement, Tuvis shall Process Personal Data that is subject to this DPA only in accordance
with Client’s documented instructions as necessary for the performance of the Services and for the
performance of the Agreement and this DPA, unless required by Union or Member State law or any other
applicable law to which Tuvis and its Affiliates are subject; in which case, Tuvis shall inform the Client of the
legal requirement before processing, unless that law prohibits such information on important grounds of
public interest. The duration of the Processing, the nature and purposes of the Processing, as well as the
types of Personal Data Processed and categories of Data Subjects under this DPA are further specified in
Schedule 1 (Details of the Processing) to this DPA.
b. To the extent that Tuvis or its Affiliates cannot comply with a request (including, without limitation, any
instruction, direction, code of conduct, certification, or change of any kind), from Client and/or its authorized
users relating to Processing of Personal Data or where Tuvis considers such a request to be unlawful, Tuvis
(i) shall inform Client, providing relevant details of the problem (but not legal advice), (ii) Tuvis may,
without any kind of liability towards Client, temporarily cease all Processing of the affected Personal Data
(other than securely storing those data), and (iii) if the Parties do not agree on a resolution to the issue in
question and the costs thereof, each Party may, as its sole remedy, terminate the Agreement and this DPA
with respect to the affected Processing, and Client shall pay to Tuvis all the amounts owed to Tuvis or due
before the date of termination. Client will have no further claims against Tuvis (including, without limitation,
requesting refunds for Services) due to the termination of the Agreement and/or the DPA in the situation
described in this paragraph (excluding the obligations relating to the termination of this DPA set forth
below).
3. RIGHTS OF DATA SUBJECTS
3.1 If Tuvis receives a request from a Data Subject to exercise its rights as laid down in Data Protection Laws and
Regulations (“Data Subject Request”), Tuvis shall, to the extent legally permitted, promptly notify and forward
such Data Subject Request to Client. Taking into account the nature of the Processing, Tuvis shall use
commercially reasonable efforts to assist Client by appropriate technical and organizational measures, insofar as
this is possible, for the fulfilment of Client’s obligation to respond to a Data Subject Request under Data
Protection Laws and Regulations. To the extent legally permitted, Client shall be responsible for any costs arising
from Tuvis' provision of such assistance.
4. TUVIS PERSONNEL
4.1 Tuvis shall grant access to the Personal Data to persons under its authority (including, without limitation, its
personnel) only on a need-to-know basis and ensure that such persons engaged in the Processing of Personal
Data have committed themselves to confidentiality or are under an appropriate statutory obligation of
confidentiality.
4.2 Tuvis may disclose and Process the Personal Data (a) as permitted hereunder (b) to the extent required by a
court of competent jurisdiction or other Supervisory Authority and/or otherwise as required by applicable laws
or applicable Data Protection Laws and Regulations (in such a case, Tuvis shall inform the Client of the legal
requirement before the disclosure, unless that law prohibits such information on important grounds of public
interest), or (c) on a “need-to-know” basis under an obligation of confidentiality to legal counsel(s), data
protection advisor(s), accountant(s), inventors or potential acquirers.
5. AUTHORIZATION REGARDING SUB-PROCESSORS
5.1 Tuvis’ current list of Sub-processors is included in Schedule 3 (“Sub-processor List”) and is hereby approved by
Client.
5.2 Client shall subscribe to notifications of new Sub-processors by sending an email to privacy@tuvis.com, with
the subject SUBSCRIPTION TO SUB-PROCESSORS NOTIFICATION and if Client subscribes, Tuvis shall provide
notification of any new Sub-processor(s).
5.3 Client may reasonably object to Tuvis’ use of a Sub-processor for reasons related to the GDPR by notifying Tuvis
promptly in writing within five (5) business days after receipt of Tuvis’ notice in accordance with the mechanism
set out in Section 5.2 and such written objection shall include the reasons related to the Data Protection Laws
and Regulations for objecting to Tuvis’ use of such Sub-processor. Failure to object to such Sub-processor in
writing within five (5) business days following Tuvis’ notice shall be deemed as acceptance of the Sub-Processor.
In the event Client reasonably objects to a Sub-processor, as permitted in the preceding sentences, Tuvis will
use reasonable efforts to make available to Client a change in the Services or recommend a commercially
reasonable change to Client’s use of the Services to avoid Processing of Personal Data by the objected-to
Sub-processor without unreasonably burdening the Client. If Tuvis is unable to make available such change
within a reasonable period of time, which shall not exceed thirty (30) days, Client may, as a sole remedy,
terminate the applicable Agreement and this DPA with respect only to those Services which cannot be provided
by Tuvis without the use of the objected-to Sub-processor by providing written notice to Tuvis provided that all
amounts due under the Agreement before the termination date with respect to the Processing at issue shall be
duly paid to Tuvis. Until a decision is made regarding the Sub-processor, Tuvis may temporarily suspend the
Processing of the affected Personal Data. Client will have no further claims against Tuvis due to the termination
of the Agreement (including, without limitation, requesting refunds) and/or the DPA in the situation described
in this paragraph.
5.4 In accordance with Articles 28.7 and 28.8 of the GDPR, if and when the European Commission lays down the
Standard Contractual Clauses referred to in such Article, the Parties may revise this DPA in good faith to adjust it
to such Standard Contractual Clauses. This Section 5 shall not apply to subcontractors of Tuvis which provide
ancillary services to support the performance of the DPA. This includes, for example, telecommunication
services, maintenance and user service, cleaning staff, or auditors.
6. SECURITY
6.1 Taking into account the state of the art, the costs of implementation, the scope, the context, the purposes of
the Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural
persons, Tuvis shall maintain all industry-standard technical and organizational measures required pursuant to
applicable Data Protection Laws and Regulations for protection of the security (including protection against
unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or
damage, unauthorized disclosure of, or access to, Personal Data), confidentiality and integrity of Personal Data,
as set forth in the Security Documentation which are hereby approved by Client. Upon the Client’s request,
Tuvis will use commercially reasonable efforts to assist Client, at Client’s cost, in ensuring compliance with the
obligations pursuant to applicable Data Protection Laws and Regulations taking into account the nature of the
processing, the state of the art, and the information available to Tuvis.
6.2 Upon Client’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in
the Agreement and this DPA, Tuvis shall make available to Client that is not a competitor of Tuvis (or Client’s
independent, third-party auditor that is not a competitor of Tuvis) a copy or a summary of Tuvis’ then most
recent third-party audits or certifications, as applicable (provided, however, that such audits, certifications and
the results therefrom, including the documents reflecting the outcome of the audit and/or the certifications,
shall only be used by Client to assess compliance with this DPA, and shall not be used for any other purpose or
disclosed to any third party without Tuvis’ prior written approval and, upon Tuvis' first request, Client shall
return all records or documentation in Client’s possession or control provided by Tuvis in the context of the
audit and/or the certification). At Client’s cost and expense, Tuvis shall allow for and contribute to audits,
including inspections of Tuvis’, conducted by the controller or another auditor mandated by the controller (who
is not a direct or indirect competitor of Tuvis) provided that the parties shall agree on the scope, methodology,
timing and conditions of such audits and inspections. Notwithstanding anything to the contrary, such audits
and/or inspections shall not contain any information, including without limitation, personal data that does not
belong to Client.
7. PERSONAL DATA INCIDENT MANAGEMENT AND NOTIFICATION
Tuvis shall notify Client without undue delay after becoming aware of the accidental or unlawful destruction, loss,
alteration, unauthorized disclosure of, or access to Personal Data, including Personal Data, transmitted, stored or
otherwise Processed by Tuvis or its Sub-processors of which Tuvis becomes aware (a “Personal Data Incident”).
Tuvis shall make reasonable efforts to identify the cause of such Personal Data Incident and take those steps as Tuvis
deems necessary, possible and reasonable in order to remediate the cause of such a Personal Data Incident to the extent
the remediation is within Tuvis’ reasonable control. The obligations herein shall not apply to incidents that are caused
by Client or Client’s users or are otherwise unrelated to the provision of the Services. In any event, Client will be the
party responsible for notifying supervisory authorities and/or concerned data subjects (where required by Data
Protection Laws and Regulations).
8. RETURN AND DELETION OF PERSONAL DATA
Subject to the Agreement, Tuvis shall, at the choice of Client, delete or return the Personal Data to Client after the end
of the provision of the Services relating to Processing, and shall delete existing copies unless applicable law requires
storage of the Personal Data. In any event, to the extent required or allowed by applicable law, Tuvis may retain one
copy of the Personal Data for evidence purposes and/or for the establishment, exercise or defence of legal claims and/or
to comply with applicable laws and regulations. If the Client requests the Personal Data to be returned, the Personal
Data shall be returned in the format generally available for Tuvis’ Clients.
9. AUTHORIZED AFFILIATES
9.1 The Parties acknowledge and agree that, by executing the DPA, the Client enters into the DPA on behalf of itself
and, as applicable, in the name and on behalf of its Authorized Affiliates, thereby establishing a separate DPA
between Tuvis. Each Authorized Affiliate agrees to be bound by the obligations under this DPA. All access to and
use of the Services by Authorized Affiliates must comply with the terms and conditions of the Agreement and
this DPA and any violation of the terms and conditions therein by an Authorized Affiliate shall be deemed a
violation by Client.
9.2 The Client shall remain responsible for coordinating all communication with Tuvis under the Agreement and this
DPA and shall be entitled to make and receive any communication in relation to this DPA on behalf of its
Authorized Affiliates.
10. TRANSFERS OF DATA
10.1 Transfers to countries that offer adequate level of data protection. Personal Data may be transferred from the
EU Member States, the three EEA member countries (Norway, Liechtenstein and Iceland) (collectively, “EEA”),
the United Kingdom and Brazil to countries that offer adequate level of data protection under or pursuant to
the adequacy decisions published by the relevant data protection authorities (“Adequacy Decisions”), without
any further safeguard being necessary.
10.2 Transfers to other countries. If the Processing of Personal Data includes transfers from the EEA (or Brazil) to
countries outside the EEA (or Brazil respectively), which are not subject to an Adequacy Decision (“Other
Countries”) for example, Israel, the Parties shall comply with the following terms with respect to the EU
transfers of Personal Data, Client as a Data Exporter (as defined in the SCCs) and Tuvis on behalf of itself and
each Tuvis Affiliate (as applicable) as a Data Importer (as defined in the SCCs) hereby enter into the Standard
Contractual Clauses set out in Schedule 4. To the extent that there is any conflict or inconsistency between the
terms of the Standard Contractual Clauses and the terms of this DPA, the terms of the Standard Contractual
Clauses shall take precedence.
10.3 The Client hereby authorizes Tuvis (and its Sub-Processors) to transfer Personal Data related to the Services
provided to the Client to those countries or territories where Tuvis’ Authorized Affiliates and the Sub-Processors
are located, consistent with the Agreement and this DPA.
11. TERMINATION
This DPA shall automatically terminate upon the termination or expiration of the Agreement under which the Services
are provided. Sections 2.2, 2.3.3, 8 and 12 shall survive the termination or expiration of this DPA for any reason. This
DPA cannot, in principle, be terminated separately to the Agreement, except where the Processing ends before the
termination of the Agreement, in which case, this DPA shall automatically terminate.
12. RELATIONSHIP WITH AGREEMENT
In the event of any conflict between the provisions of this DPA and the provisions of the Agreement, the provisions of
this DPA shall prevail over the conflicting provisions of the Agreement.
Notwithstanding anything to the contrary in the Agreement and/or in any agreement between the parties and to the
maximum extent permitted by law: (A) Tuvis’ (including Tuvis’ Affiliates) entire, total and aggregate liability, related to
personal data or information, privacy, or for breach of, this DPA and/or Data Protection Laws and Regulations,
including, without limitation, if any, any indemnification obligation under the Agreement or applicable law regarding
data protection or privacy, shall be limited to the amounts paid to Tuvis under the Agreement within twelve (12)
months preceding the event that gave rise to the claim. This limitation of liability is cumulative and not per incident;
(B) In no event will Tuvis and/or Tuvis Affiliates and/or their third-party providers, be liable under, or otherwise in
connection with this DPA for: (i) any indirect, exemplary, special, consequential, incidental or punitive damages; (ii) any
loss of profits, business, or anticipated savings; (iii) any loss of, or damage to data, reputation, revenue or goodwill;
and/or (iv) the cost of procuring any substitute goods or services; and (C) The foregoing exclusions and limitations on
liability set forth in this Section shall apply: (i) even if Tuvis, Tuvis Affiliates or third-party providers, have been advised,
or should have been aware, of the possibility of losses or damages; (ii) even if any remedy in this DPA fails of its
essential purpose; and (iii) regardless of the form, theory or basis of liability (such as, but not limited to, breach of
contract or tort).
13. CCPA. To the extent that the Personal Data is subject to the CCPA, Tuvis shall not sell or share Client's Personal Data.
Tuvis acknowledges that when processing Personal Data in the context of the provision of the Services, Client is not
selling or sharing Personal Data to Tuvis. Tuvis agrees not to retain, use or disclose Client Personal Data: (i) for any
purpose other than the Business Purpose (as defined below); (ii) for no other commercial or Business Purpose; or (iii)
outside the direct business relationship between Tuvis and Client. Notwithstanding the foregoing, Tuvis may use,
disclose, or retain Client Personal Data to: (i) transfer the Personal Data to other Tuvis’ entities (including, without
limitation, affiliates and subsidiaries), service providers, third parties and vendors, in order to provide the Services to
Client; (ii) to comply with, or as allowed by, applicable laws; (iii) to defend legal claims or comply with a law
enforcement investigation; (ii) for internal use by Tuvis to build or improve the quality of its services and/or for any
other purpose permitted under the CCPA; (iii) to detect data security incidents, or protect against fraudulent or illegal
activity; and (iv) collect and analyse anonymous information. Tuvis shall use commercially reasonable efforts to comply
with its obligations under CCPA. If Tuvis becomes aware of any material applicable requirement (to Tuvis as a service
provider) under CCPA that Tuvis cannot comply with, Tuvis shall use commercially reasonable efforts to notify Client.
Upon written Client’s notice, Tuvis shall use commercial reasonable and appropriate steps to stop and remediate Tuvis’
alleged unauthorized use of Personal Data; provided that Client must explain and demonstrate in the written notice
which processing activity of Personal Data it considers to be unauthorized and the applicable reasons. Tuvis shall use
commercially reasonable efforts to enable Client to comply with consumer requests made pursuant CCPA.
Notwithstanding anything to the contrary, Client shall be fully and solely responsible for complying with its own
requirements under CCPA. “Business purpose” means the Processing activities that Tuvis will perform to provide
Services (as described in the Agreement), this DPA and any other instruction from Client, as otherwise permitted by
applicable law, including, CCPA and the applicable regulations, or as otherwise necessary to provide the Services to
Client.
14. AMENDMENTS
This DPA may be amended at any time by a written instrument duly signed by each of the Parties.
15. LEGAL EFFECT
This DPA shall only become legally binding between Client and Tuvis when the formalities steps set out in the Section
“INSTRUCTIONS ON HOW TO EXECUTE THIS DPA” below have been fully completed. Tuvis may assign this
DPA or its rights or obligations hereunder to any Affiliate thereof, or to a successor or any Affiliate thereof, in
connection with a merger, consolidation or acquisition of all or substantially all of its shares, assets or business relating
to this DPA or the Agreement. Any Tuvis obligation hereunder may be performed (in whole or in part), and any Tuvis
right (including invoice and payment rights) or remedy may be exercised (in whole or in part), by an Affiliate of Tuvis.
16. SIGNATURE
The Parties represent and warrant that they each have the power to enter into, execute, perform and be bound by this
DPA.
You, as the signing person on behalf of Client, represent and warrant that you have, or you were granted, full authority
to bind the Organization and, as applicable, its Authorized Affiliates to this DPA. If you cannot, or do not have authority
to, bind the Organization and/or its Authorized Affiliates, you shall not supply or provide Personal Data to Tuvis.
By signing this DPA, Client enters into this DPA on behalf of itself and, to the extent required or permitted under
applicable Data Protection Laws and Regulations, in the name and on behalf of its Authorized Affiliates, if and to the
extent that Tuvis processes Personal Data for which such Authorized Affiliates qualify as the/a “data controller”.
This DPA has been pre-signed on behalf of Tuvis.
Instructions on how to execute this DPA.
1. To complete this DPA, you must complete the missing information; and
2. Send the completed and signed DPA to us by email, indicating the Client’s name, to privacy@tuvis.com
List of Schedules
● SCHEDULE 1 - DETAILS OF THE PROCESSING
● SCHEDULE 2 – SECURITY MEASURES
● SCHEDULE 3 – SUB-PROCESSOR LIST
● SCHEDULE 4 - STANDARD CONTRACTUAL CLAUSES
The parties’ authorized signatories have duly executed this Agreement:
CLIENT / VENDOR:
Signature:
Client/Vendor Legal Name:
Print Name:
Title:
Date:
TUVIS SOLUTIONS LTD.
Signature:
Legal Name:
Print Name:
Title:
Date:
SCHEDULE 1 - DETAILS OF THE PROCESSING
Subject matter
Tuvis will Process Personal Data as necessary to perform the Services pursuant to the Agreement, as further instructed
by Client in its use of the Services.
Nature and Purpose of Processing
1. Performing the Agreement, this DPA and/or other contracts executed by the Parties, including, providing the
Service(s) to Client and providing support and technical maintenance, if agreed in the Agreement
2. For Tuvis to comply with documented reasonable instructions provided by Client where such instructions are
consistent with the terms of the Agreement.
Duration of Processing
Subject to any Section of the DPA and/or the Agreement dealing with the duration of the Processing and the
consequences of the expiration or termination thereof, Tuvis will Process Personal Data for the duration of the
Agreement, unless otherwise agreed upon in writing.
Type of Personal Data
Client may submit Personal Data to the Services, the extent of which is determined and controlled by Client in its sole
discretion, and which may include, but is not limited to the following categories of Personal Data: The Personal Data or
information that the Client decides to provide to the Tuvis in the context of the Services.
The Client and the Data Subjects shall provide the Personal Data to Tuvis by supplying the Personal data to Tuvis’ Service.
For the avoidance of doubt, the data detailed in Tuvis’ privacy policy available here: https://tuvis.com/privacy/ shall not be
subject to this DPA.
Special categories of data (if appropriate)
The personal data transferred concern the following special categories of data:
NONE - No special categories of data are applicable in the data processing.
Categories of Data Subjects
Client may submit Personal Data to the Services, the extent of which is determined and controlled by Client in its sole
discretion, and which may include, but is not limited to Personal Data relating to the following categories of data
subjects:
● Client’s customers and/or clients
● Employees, agents, advisors, freelancers of Client (who are natural persons)
● Prospects, Clients, business partners and vendors of Client (who are natural persons)
● Employees or contact persons of Client’s prospects, Clients, business partners and vendors
SCHEDULE 2 – SECURITY MEASURES
Trust Commitment
We take the protection of your data very seriously and treat it confidentially and in accordance with the statutory data protection
regulations. We do not collect or store any of your leads, prospects, contacts or customers data. We do collect and store the
minimum data on our (Tuvis) users we need for the agreed purpose and use secured databases hosted on Amazon AWS servers.
Same servers we run all other operations on. Any third-party API integrations are leveraging standard encryption techniques (such
as SSL) over HTTPS. Our Chrome Extension goes through Google's automated and manual security review to assure it is aligned with
their security and data privacy terms. Also, as a certified Salesforce AppExchange partner, we have successfully passed their ISV
Security Review and Microsoft Dynamics partners, and successfully completed their Security and governance considerations..
Please review our Terms of Use for more information.
Services Covered
This documentation describes the architecture of, the security- and privacy-related audits, and the administrative, technical and
physical controls applicable to,
(1) Tuvis Chrome Extension, (2) Tuvis Desktop App, (3) Tuvis Cloud Listener (Sidecar), (4) Tuvis Salesforce AppExchange managed
package, (5) Tuvis Microsoft Dynamics 365 managed package, (6) Tuvis admin web platform (collectively, for the purposes of this
document only, the “Covered Services”).
Architecture and Data Segregation
The Covered Services are designed and operated with an architecture to segregate and restrict Customer Data access based on
business needs. The architecture provides an effective logical data separation for different customers via customer-specific
"Organization ID" and “User ID” and allows the use of customer and user role-based access privileges. Additional data segregation is
ensured by providing separate environments for different functions, especially for testing and production. This specific
infrastructure used to host the customer data (we do not store any of your customers’ data on our servers at any time) is described
in the below section “Infrastructure and Sub processors”.
Control of Processing
Tuvis has implemented procedures designed to ensure that customer data is processed securely, throughout the entire chain of
secured processing methods by Tuvis and its subprocessors. In particular, Tuvis and its affiliates have entered into written
agreements with their sub-processors containing privacy, data protection and data security obligations that provide a level of
protection appropriate to their data processing. Compliance with such obligations as well as the technical and organizational data
security measures implemented by Tuvis and its sub-processors are subject to regular audits. The “Infrastructure and
Sub-processors” section describes the sub-processors and certain other entities material to Tuvis’ provision of the Covered Services.
Infrastructure and Sub processors
Tuvis uses infrastructure provided by Amazon Web Services, Inc. (“AWS”) to host or process the customer data. Information about
security and privacy-related audits and certifications received by AWS, including ISO 27001 certification and SOC reports, is
available from the AWS Security website and the AWS Compliance website.
Please note that in some cases, the abovementioned customer data will be used for fraud detection and prevention, and for
security purposes. Also, we may use anonymous, aggregated or de-identified information and/or disclose it to third parties without
restrictions (for example, in order to improve our services and enhance your experience with them).
Security Policies and Procedures
The Services are operated in accordance with the following policies and procedures to enhance security:
• We do not store any passwords on our servers.
• We do not store or log any API credentials or access tokens on our servers.
• We do store user access log entries, including date, time, user ID, URL executed or entity.
• We do store ID operated on, operation performed and source IP address.
• If there is suspicion of inappropriate access, Tuvis can provide customers log entry records and/or analysis of such records to
assist in forensic analysis when available.
Incident Management
Tuvis maintains security incident management policies and procedures. Tuvis will notify the customer in accordance with the terms
of this DPA.
User Authentication
Access to the Services requires authentication using Salesforce’s OAuth 2.0 and/or Microsoft’s OAuth 2.0 AND/OR Google’s OAuth
2.0, or custom SSO. Following successful authentication, an encrypted ID is generated and stored in the user's browser to preserve
and track session state.
Disaster Recovery
Production data centers are designed to mitigate the risk of single points of failure and provide a resilient environment to support
service continuity and performance. The Services utilize secondary facilities that are geographically diverse from their primary data
centers.
Viruses
The Services do not scan for viruses that could be included in attachments or other customer data uploaded into the Services by the
customer. Uploaded attachments or malicious code/SQL injection, however, are not executed in the Services and therefore will not
damage or compromise the Services by virtue of containing a virus.
Data Encryption
The Services use industry-accepted encryption products to protect customer data and communications during transmissions
between a customer's network and the Services, including through Transport Layer Encryption (TLS) leveraging at least 2048-bit RSA
server certificates and 128 bit symmetric encryption keys at a minimum. Additionally, all data, including customer data, is
transmitted between data centers for replication purposes across a dedicated, encrypted link utilizing AES-256 encryption.
Return of Customer Data
Within 30 days post contract termination, customers may request return of their respective customer data submitted to the
Services (to the extent such data has not been deleted by Customer, or if Customer has not already removed the managed package
in which the Customer Data was stored). Tuvis shall provide such customer data via downloadable files in comma separated value
(.csv) format and attachments in their native format, in accordance with the terms of this DPA.
Deletion of Customer Data
After termination of all subscriptions associated with an environment, customer data submitted to the Services is retained in
inactive status within the Services for 120 days, after which it is securely overwritten or deleted from production within 90 days,
and from backups within 180 days.
SCHEDULE 3 – SUB-PROCESSOR LIST
Entity Name Sub-Processing Hosting Country More security details
Activities
Hubspot Sales and United States https://www.hubspot.com/security
Support Services SOC 2 Type II and ISO 27001 certified and
Marketing automation provide N+1 redundancy to all power, network,
and HVAC services
Make Sales and Czech Republic https://support.integromat.com/hc/en
Support Services - us/articles/360001988174
ISO 9001 and ISO 27001
Amazon (AWS) Data Storage United States https://aws.amazon.com/certification/certified
Cloud - security-specialty/
infrastructure hosting (ISO 9001, 27001, 27008, 27017 Certified;
Service Distribution SOC 1, SOC 2, SOC 3 audited)
Microsoft Azure Data Storage United States https://learn.microsoft.com/en-us/azure/co
Cloud mpliance/
infrastructure hosting
Service Distribution
Salesforce Solution for Customer UK https://compliance.salesforce.com/en/iso-270
Support 01
https://compliance.salesforce.com/en
Intercom Solution for Customer United States https://www.intercom.com/legal/data-processi
Support ng-agreement
Logz.io logging system for United Sates https://logz.io/platform/features/soc-2-com
product related errors, pliance/
exceptions and
troubleshooting purposes
Confluence Solution for Support Europe (Frankfurt and Understand data residency | Atlassian Support
Escalation Management Ireland)
Google Cloud Data Storage United States and https://cloud.google.com/docs/security/overvie
Cloud Europe w/whitepaper
infrastructure hosting
Data API
SCHEDULE 4 – STANDARD CONTRACTUAL CLAUSES
a. If the Processing of Personal Data includes transfers from the EU to countries outside the EEA which do not offer adequate
level of data protection or which have not been subject to an Adequacy Decision, the Parties shall comply with Chapter V of
the GDPR. The Parties hereby agree to execute the Standard Contractual Clauses as follows:
b. The Standard Contractual Clauses (Controller-to-Processor and Processor to Processor) if applicable, will apply, with respect
to restricted transfers between Client and Tuvis that are subject to the EU GDPR.
c. The Parties agree that for the purpose of transfer of Personal Data between Client (as Data Exporter) and Tuvis (as Data
Importer), the following shall apply: (i) Clause 7 of the Standard Contractual Clauses shall not be applicable; (ii) In Clause 9,
option 1 shall apply and the method described in Section 5 of the DPA (Authorization Regarding Sub-Processors) shall apply;
(iii) Clause 11 of the Standard Contractual Clauses shall not be applicable; (iv) In Clause 13: the relevant option applicable to
the Client, as informed by Client to Tuvis; (v) In Clause 17, option 1 shall apply. The Parties agree that the Standard
Contractual Clauses shall be governed by the laws of Ireland; and (vi) In Clause 18(b) the Parties choose the courts of
Ireland, as their choice of forum and jurisdiction.
d. Annex I.A: With respect to Module Two: (i) Data Exporter is Client as a data controller and (ii) the Data Importer is Tuvis as a
data processor. With respect to Module Three: (i) Data Exporter is Client as a data processor and (ii) the Data Importer is
Tuvis as a data processor (sub-processor). Data Exporter and Data Importer Contact details: As detailed in the Agreement.
Signature and Date: By entering into the Agreement and this DPA, each Party is deemed to have signed these Standard
Contractual Clauses incorporated herein, including their Annexes, as of the Effective Date of the DPA.
e. Annex I.B of the Standard Contractual Clauses shall be completed as described in Schedule 1 (Details of the Processing) of
this DPA.
f. Annex I.C of the Standard Contractual Clauses shall be completed as follows: The competent supervisory authority is the
Irish supervisory authority.
g. Annex II of the Standard Contractual Clauses shall be completed as described and agreed between the parties in the
Agreement and/or this DPA.
h. Annex III of the Standard Contractual Clauses shall be completed with the authorized sub-processors detailed in Schedule 3
(Sub-processor list) of this DPA.