This Data Processing Addendum (“DPA”) is effective as of ______________ and is incorporated by reference into and made a part of the [Master Subscription Agreement] entered into between [client name] (“[RELAYTO LIMITED]”) and [customer name] (“Customer”) dated [date of MSA] (“Agreement”). This DPA sets forth certain duties and obligations of the parties with respect to the protection, security, processing, and privacy of personal data provided or made available to RELAYTO LIMITED by Customer as part of the Services provided by RELAYTO LIMITED for Customer under the Agreement. This DPA shall supplement (and not supersede) the Agreement, and shall take precedence solely to the extent of any conflict between this DPA and the Agreement. All capitalized terms used and not expressly defined in this Addendum shall have the meanings given to them in the Agreement.
In the course of providing the Services to Customer pursuant to the Agreement, RELAYTO LIMITED may Process certain Personal Data provided or made available to RELAYTO LIMITED by Customer on behalf of Customer and the parties agree to comply with the following provisions with respect to any such Personal Data, each acting reasonably and in good faith.
1. Definitions
1.1 “Controller” and “Processor” each have the meaning given to it in the GDPR.
1.2 “Customer Data” is defined in the Agreement as “[Customer Data]” or “[Your Data].”]
1.3 “Data Protection Laws and Regulations” means all laws and regulations, including laws and regulations of the European Union, the European Economic Area and their member states, Switzerland and the United Kingdom, applicable to the Processing of Personal Data under the Agreement.
1.4 “Data Subject” means the identified or identifiable person to whom Personal Data relates.
1.5 “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
1.6 “Personal Data” means personal data (as defined in the GDPR) that is uploaded or submitted to the Services by Customer.
1.7 “Processing” has the meaning given in the GDPR.
1.8 “Security Documentation” means RELAYTO LIMITED’s security documentation applicable to the Services, as updated from time to time, and accessible via http://rla.to/yzi57, or as otherwise made reasonably available by RELAYTO LIMITED.
1.9 “Standard Contractual Clauses” means the agreement executed by and between Customer and Service Provider. and attached hereto pursuant to the European Commission’s decision (C(2010)593) of 5 February 2010 on Standard Contractual Clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection.
1.10 “Sub-processor” means any Processor engaged by RELAYTO LIMITED.
1.11 “Supervisory Authority” means an independent public authority which is established by an EU Member State pursuant to the GDPR.
2. Processing of personal data
2.1 Roles. Customer is the Controller and RELAYTO LIMITED is the Processor with regard to the Processing of Personal Data under the Agreement.
2.2 Customer’s Processing of Personal Data. Customer shall
(a) collect and Process Personal Data,
(b) use the Services, and
(c) give RELAYTO LIMITED instructions regarding the Processing of Personal Data for Customer, in all cases, in accordance with all applicable laws, rules, and regulations, including the Data Protection Laws and Regulations. The customer is solely liable and responsible for the accuracy, quality, and legality of Personal Data.
2.3 Service Provider’s Processing of Personal Data. Effective as of 25 May 2018, RELAYTO LIMITED shall Process Personal Data in accordance with the GDPR requirements directly applicable to RELAYTO LIMITED’s provision of its Services. Personal Data shall be considered Customer’s Confidential Information under the Agreement. RELAYTO LIMITED shall only Process Personal Data on behalf of and in accordance with Customer’s instructions set forth in this DPA and the Agreement for the following purposes:
(a) Processing in accordance with the Agreement and applicable Order Form(s);
(b) Processing initiated by Users in their use of the Services; and
(c) Processing to comply with other documented reasonable instructions provided by Customer (e.g., via email) where such instructions are consistent with the terms of the Agreement. The subject-matter and purpose of Processing of Personal Data by RELAYTO LIMITED is solely so RELAYTO LIMITED can provide the Services to Customer pursuant to the Agreement.
2.4 Personnel. RELAYTO LIMITED shall ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities and have executed written industry standard confidentiality agreements. RELAYTO LIMITED shall ensure that RELAYTO LIMITED’s access to Personal Data is limited to those personnel performing Services in accordance with the Agreement.
2.5 Data Protection Officer. RELAYTO LIMITED has appointed a data protection officer. The appointed person may be reached at support@relayto.com
3. Rights of data subjects
RELAYTO LIMITED shall, to the extent legally permitted, promptly notify Customer if RELAYTO LIMITED receives a request from a Data Subject to exercise the Data Subject’s under the GDPR (“Data Subject Request”). Taking into account the nature of the Processing, RELAYTO LIMITED shall assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to a Data Subject Request under Data Protection Laws and Regulations. In addition, to the extent Customer, in its use of the Services, does not have the ability to address a Data Subject Request, RELAYTO LIMITED shall upon Customer’s request provide commercially reasonable efforts to assist Customer in responding to such Data Subject Request, to the extent RELAYTO LIMITED is legally permitted to do so and the response to such Data Subject Request is required under Data Protection Laws and Regulations. To the extent legally permitted, Customer shall be responsible for any costs arising from RELAYTO LIMITED’s provision of such assistance.
4. Sub-processors
4.1 Appointment of Sub-processors. Customer acknowledges and agrees that RELAYTO LIMITED may engage third-party Sub-processors in connection with the provision of the Services. RELAYTO LIMITED has entered into a written agreement with each Sub-processor containing data protection obligations not less protective than those in this Agreement with respect to the protection of Customer Data to the extent applicable to the nature of the Services provided by such Sub-processor.
4.2 List of Current Sub-processors and Notification of New Sub-processors. RELAYTO LIMITED’s current list of Sub-processors for the Services is available upon written request. Such Sub-processor lists shall include the identities of those Sub-processors and their country of location (“Sub- processor Lists”). RELAYTO LIMITED shall provide Customer notification of potential new Sub-processor(s) before authorizing any new Sub-processor(s) to Process Personal Data.
4.3 Objection Right for New Sub-processors. Customer may object to RELAYTO LIMITED’s use of a new Sub-processor by notifying RELAYTO LIMITED promptly in writing within ten (10) business days after receipt of RELAYTO LIMITED’s notice. In the event Customer objects to a new Sub-processor, as permitted in the preceding sentence, RELAYTO LIMITED will use reasonable efforts to make available to Customer a change in the Services or recommend a commercially reasonable change to Customer’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new Sub-processor without unreasonably burdening the Customer. If RELAYTO LIMITED is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may terminate the applicable Order Form(s) with respect only to those Services which cannot be provided by RELAYTO LIMITED without the use of the objected-to new Sub-processor by providing written notice to RELAYTO LIMITED. RELAYTO LIMITED will refund Customer any prepaid fees covering the remainder of the term of such Order Form(s) following the effective date of termination with respect to such terminated Services, without imposing a penalty for such termination on Customer.
4.4 Liability. RELAYTO LIMITED shall be liable for the acts and omissions of its Sub-processors to the same extent RELAYTO LIMITED would be liable if performing the services of each Sub-processor directly under the terms of this DPA, except as otherwise set forth in the Agreement.
5. Security
5.1 Controls for the Protection of Customer Data. RELAYTO LIMITED shall maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk posed by the Processing. RELAYTO LIMITED’s measures will include those set forth in the Security Documentation. RELAYTO LIMITED regularly monitors compliance with these measures. RELAYTO LIMITED will not materially decrease the overall security of the Services during a subscription term.
5.2 Third-Party Certifications and Audits. RELAYTO LIMITED has obtained the third-party certifications and audits set forth in the Security Documentation. Upon Customer’s written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, RELAYTO LIMITED shall make available to Customer that is not a competitor of RELAYTO LIMITED (or Customer’s independent, third-party auditor that is not a competitor of RELAYTO LIMITED) a copy of RELAYTO LIMITED’s then most recent third-party audits or certifications, as applicable.
6. Customer data incident management and notification
RELAYTO LIMITED maintains security incident management policies and procedures specified in the Security Documentation and shall, notify Customer without undue delay, but in no event in less than 48 hours, after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Data, including Personal Data, transmitted, stored or otherwise Processed by RELAYTO LIMITED or its Sub-processors of which RELAYTO LIMITED (a “Customer Data Incident”). RELAYTO LIMITED shall make reasonable efforts to identify the cause of such Customer Data Incident and take those steps as RELAYTO LIMITED deems necessary and reasonable in order to remediate the cause of such a Customer Data Incident to the extent the remediation is within RELAYTO LIMITED’s reasonable control. The obligations herein shall not apply to incidents that are caused by Customer or Customer’s Users.
7. Return and deletion of customer data
RELAYTO LIMITED shall return Customer Data to Customer or, to the extent allowed by applicable law, delete Customer Data in accordance with the procedures and timeframes specified in the Security Documentation, or as requested by Customer.
8. GDPR and Onward Transfer
8.1 Assistance. As required by the GDPR, RELAYTO LIMITED shall provide Customer with reasonable cooperation and assistance needed to fulfil Customer’s obligation under the GDPR.
8.2 Standard Contractual Clauses. The Standard Contractual Clauses apply to any transfers of Personal Data under this DPA from the European Union, the European Economic Area and/or their member states, Switzerland and the United Kingdom to RELAYTO LIMITED’s facilities in countries which do not ensure an adequate level of data protection within the meaning of Data Protection Laws and Regulations, to the extent such transfers are subject to such Data Protection Laws and Regulations. ”
(a) Instructions. For the purposes of Section 2 of the DPA, the following acts are deemed an instruction by the Customer to process Personal Data: (a) Customer’s entering into the Agreement and applicable Order Form(s) are deemed instructions to Process Personal Data as is necessary to perform services under the Agreement; (b) Users actions that initiate Processing while using the SCC Services; and (c) Customer’s other documented reasonable instructions provided by Customer (e.g., via email) where such instructions are consistent with the terms of the Agreement.
(b) Notification of New Sub-processors and Objection Right for new Sub-processors. Customer acknowledges and expressly agrees that Service Provider may engage new Sub- processors as described in the DPA.
(c) Copies of Sub-processor Agreements. The parties agree that RELAYTO LIMITED may redact the copies of the Sub-processor agreements that must be provided by RELAYTO LIMITED to Customer. RELAYTO LIMITED will provide copies of the Sub-processor agreements, only upon request by Customer.
(d) Audits and Certifications. The parties agree that the audits shall be carried out in accordance with the following specifications. Customer request an on-site audit of the procedures relevant to the protection of Personal Data, and Customer and RELAYTO LIMITED shall mutually agree upon the scope, timing, and duration of the audit in addition to the reimbursement rate for which Customer shall be responsible. Customer shall promptly notify RELAYTO LIMITED with information regarding any non-compliance discovered during the course of an audit.
8.3 Certification of Deletion. The parties agree that the certification of deletion of Personal Data that is described in Standard Contractual Clauses shall be provided by Service Provider to Customer only upon Customer’s request.
8.4 Conflict. In the event of any conflict or inconsistency between the body of this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.