By entering into this Agreement, CUSTOMER accepts the Data Processing Agreement as binding between the parties.
SUPPLIER shall notify CUSTOMER of any material changes to the Data Processing Agreement with at least thirty (30) days' advance written notice. If CUSTOMER does not accept the proposed changes, CUSTOMER may terminate this Agreement in accordance with the notice period set out in Appendix 3. Continued use of the Service after the effective date of the changes constitutes acceptance of the updated Data Processing Agreement.
Customer-specific processing instructions are set out in Appendix 6a.
Background
The CUSTOMER and the SUPPLIER have entered into a Master Subscription Agreement regarding the SUPPLIER's provision of the Services to the CUSTOMER (the "Agreement"). If the SUPPLIER, in execution of the Agreement, processes personal data on behalf of the CUSTOMER, the CUSTOMER is the personal data controller (or the CUSTOMER's customer is the data controller and the CUSTOMER a processor), and the SUPPLIER is the personal data processor (or sub-processor, as the case may be).
This Data Processing Agreement ("DPA") constitutes Appendix 6 to the Agreement.
Definitions
"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
"Data Protection Law" means, from time to time, applicable laws and regulations relating to the processing of personal data, including the GDPR and applicable national implementing legislation.
Other terms used in this DPA shall have the same meaning as set out in Data Protection Law and the Agreement, unless otherwise stated.
1. Personal Data Processing
The SUPPLIER shall only process personal data in accordance with the Agreement, this DPA, the Data Processing Instructions set out in Appendix 6a, and written instructions dispatched by the CUSTOMER from time to time. The SUPPLIER shall comply with the obligations of a personal data processor as set out in Data Protection Law and shall not take any action contrary to Data Protection Law.
The CUSTOMER shall ensure that its processing of personal data is carried out in accordance with Data Protection Law, that the SUPPLIER is entitled to process personal data pursuant to the Agreement for the purpose of providing the Services, that all personal data provided to the SUPPLIER is necessary, accurate and up-to-date, and that all processing instructions are provided in writing and in accordance with Data Protection Law.
If the SUPPLIER receives an instruction from the CUSTOMER that the SUPPLIER believes violates Data Protection Law, the SUPPLIER shall immediately notify the CUSTOMER in writing.
2. Security
The SUPPLIER shall ensure that personnel authorized to process personal data have committed to confidentiality, and that access to personal data is limited to those personnel who require it to fulfil the SUPPLIER's obligations under the Agreement.
The SUPPLIER shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including as applicable:
- pseudonymization and encryption of personal data;
- the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
- the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and
- a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.
3. Sub-processors
The CUSTOMER hereby gives general authorization to the SUPPLIER to engage sub-processors for the processing of personal data under this Agreement. An updated list of approved sub-processors is maintained at doneinvestments.com/legal/sub-processors.
The SUPPLIER shall notify the CUSTOMER of any intended addition, replacement, or removal of a sub-processor by updating the sub-processor list and providing the CUSTOMER with written notice at least thirty (30) days in advance of the change taking effect. If the CUSTOMER objects to the proposed change, the CUSTOMER must notify the SUPPLIER in writing within thirty (30) days of receiving such notice, specifying reasonable grounds for the objection directly related to the sub-processor's ability to meet the data protection requirements of this DPA. If the CUSTOMER does not object within this period, the change shall be deemed accepted.
If a valid objection is made and the parties cannot reach a mutually acceptable solution, the CUSTOMER may terminate the Agreement in accordance with the notice period set out in Appendix 3. For the avoidance of doubt, disagreement over commercial terms shall not constitute valid grounds for objection under this clause.
The SUPPLIER shall engage sub-processors on terms that impose equivalent data protection obligations to those set out in this DPA. The SUPPLIER shall remain fully liable to the CUSTOMER for the performance of sub-processors' obligations under this DPA.
4. International Data Transfers
If the SUPPLIER's processing of personal data involves a transfer of personal data to a country outside the European Economic Area (EEA), the SUPPLIER shall ensure that such transfer is carried out in accordance with Chapter V of the GDPR and is subject to appropriate safeguards, including one or more of the following:
- Standard Contractual Clauses (SCCs) as adopted by the European Commission, incorporated into the SUPPLIER's agreements with sub-processors;
- the EU-US Data Privacy Framework (DPF), where the recipient is certified under the DPF and the transfer falls within its scope; or
- another transfer mechanism recognized as providing an adequate level of protection under Data Protection Law.
The SUPPLIER shall inform the CUSTOMER of the countries and regions in which personal data is processed or stored, including through sub-processors, as set out in the sub-processor list at doneinvestments.com/legal/sub-processors.
5. Data Subject Rights
The SUPPLIER shall, taking into account the nature of the processing, assist the CUSTOMER by appropriate technical and organizational measures, insofar as possible, in fulfilling the CUSTOMER's obligation to respond to requests from data subjects exercising their rights under Chapter III of the GDPR. Such assistance shall be provided in accordance with the CUSTOMER's written instructions.
6. Security Incidents and Personal Data Breaches
The SUPPLIER shall notify the CUSTOMER without undue delay upon becoming aware of a personal data breach affecting personal data processed under this Agreement. Such notification shall include, to the extent available:
- a description of the nature of the breach, including the categories and approximate number of data subjects and personal data records concerned;
- the name and contact details of the data protection officer or relevant contact point;
- a description of the likely consequences of the breach; and
- a description of the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.
The SUPPLIER shall take all reasonable measures to assist the CUSTOMER in fulfilling its own notification obligations under applicable Data Protection Law.
7. Data Protection Impact Assessment and Prior Consultation
The SUPPLIER shall assist the CUSTOMER, upon request and in accordance with the CUSTOMER's written instructions, in fulfilling its obligations under Articles 32–36 of the GDPR, taking into account the nature of the processing and the information available to the SUPPLIER.
8. Audit and Information
Upon written request from the CUSTOMER at reasonable intervals, the SUPPLIER shall make available all information necessary to demonstrate compliance with the obligations set out in this DPA and shall allow for and contribute to audits, including inspections, conducted by the CUSTOMER or an auditor mandated by the CUSTOMER, subject to reasonable advance written notice.
Where the CUSTOMER engages a third-party auditor, a reasonable confidentiality agreement shall be entered into between the SUPPLIER and the third party prior to the audit. The SUPPLIER reserves the right to refuse audits by third parties engaged in competitive business.
Audit rights under this DPA shall be exercised in accordance with the conditions set out in section 12 of the Agreement.
9. Termination and Deletion
At the termination of this DPA or the Agreement, the SUPPLIER shall, depending on the CUSTOMER's written instruction, delete or return all personal data and delete all copies thereof, unless required by applicable law to retain such data. Customer Data shall be handled in accordance with section 6.7 of the Agreement.
Regular culling and deletion of personal data shall occur in accordance with the CUSTOMER's instructions to the SUPPLIER.
10. Remuneration
The SUPPLIER's remuneration follows from the Agreement. No additional remuneration shall be payable for the SUPPLIER's compliance with this DPA, unless compliance requires work that goes beyond the SUPPLIER's standard obligations under applicable Data Protection Law.
11. Term
This DPA shall remain valid for as long as the Agreement is in force or for as long as the SUPPLIER processes personal data on behalf of the CUSTOMER, whichever is longer. This DPA shall terminate automatically upon termination of the Agreement.
12. Governing Law and Amendments
This DPA shall be governed by the laws of Sweden.
If Data Protection Law is amended during the validity of this DPA, or if a competent authority issues guidelines, decisions, or regulations with the effect that this DPA no longer fulfils the obligations of a data processor, the parties shall in good faith negotiate and agree on any reasonable amendments required to ensure continued compliance.