Discover the revenue potential of your data with AI insights — calculate your data’s value.
This Data Processing Addendum (“DPA”) is entered into as of the Effective Date of the applicable SaaS Services Agreement (“Agreement”) between Vendia, Inc. (“Vendia”) and the party designated as (“CUSTOMER”) in said Agreement (each, a “Party”, and collectively, the “Parties”), and is made part of, and incorporated into, said Agreement between the Parties.
Vendia has entered into one or more purchase orders, contracts and/or agreements with CUSTOMER and/or CUSTOMER Affiliates. In delivering Services under the Agreement, under Instruction by CUSTOMER Vendia will Process Personal Data controlled by CUSTOMER, a CUSTOMER Affiliate and/or their respective customers, contacts or partners. For the avoidance of doubt, “partners” shall mean any third-parties who are invited into the Vendia Offerings by CUSTOMER, to act in a capacity as Controller (as defined below) with respect to their specific Personal Data.
For the avoidance of doubt, CUSTOMER acknowledges and agrees that CUSTOMER shall remain the custodian of Controller Data Processed under the Agreement and therefore, CUSTOMER (in their capacity as Controller) will explicitly provide Instruction (as defined below) to Vendia as to the requested location for the Processing and Data Location of Controller Data with respect to the Agreement.
“Affiliate” means any entity which owns or controls, is owned or controlled by, or is under common ownership or control with respect to either Party.
“Applicable Privacy Law(s)” means all worldwide data protection and privacy laws and regulations applicable to the Personal Data in question, including, where applicable, EU Data Protection Law, European Union General Data Protection Regulation (EU GDPR) and the California Consumer Privacy Act of 2018 (CCPA).
“Authorized Person(s)” means any person who Processes Personal Data on Vendia’s behalf.
“California Personal Information” means Personal Data that is subject to the protection of the CCPA.
“CCPA” means California Civil Code Sec. 1798.100 et seq. (also known as the California Consumer Privacy Act of 2018).
“Consumer”, “Business”, “Sell” and “Service Provider” each will have the meanings given to them in the CCPA.
“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. In the event of an Instruction that involves multiple Controllers, an originating Controller (“Sender or Sending Controller”) shall issue the Instruction to Vendia; any such Instruction shall necessitate the Processing of Personal Data on behalf of a single or multiple recipient Controllers (“Receiver or Receiving Controller(s)”). The Sending Controller and Receiving Controller are defined by Instruction and may or may not be CUSTOMER Affiliates.
“Controller Data” means any data owned and under CUSTOMER’s custodianship. CUSTOMER shall own all rights, title, interest and responsibility in and to Controller Data, as well as any and all intellectual property rights. Controller Data may or may not include Personal Data. The Services under Agreement may be used to Process Controller Data. For clarity, Controller Data does not include resource identifiers, attributes, or other data labels.
“Data Location” means the geographical location in which data resides at rest. Controllers Instruct Vendia on the region where the Services will store Controller Data. Unless Instructed, the Services do not limit the location from which Controller may access Controller Data.
“Data Protection Laws” means all applicable worldwide legislation relating to data protection and privacy which applies to the respective party in the role of Processing Personal Data in question under the Agreement and/or DPA, including without limitation European Data Protection Laws, the CCPA, and the data protection and privacy laws of Australia and Singapore; in each case as amended, repealed, consolidated or replaced from time to time.
“Data Subject” means the individual to whom Personal Data relates.
“Europe” means the European Union, the European Economic Area (EEA) and/or their member states, Switzerland, and the United Kingdom.
“European Data” means Personal Data that is subject to the protection of European Data Protection Laws.
“European Data Protection Laws” means data protection laws applicable in Europe, including: (i) Regulation 2016/679 (including all updated revisions of the same) of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (“GDPR”); (ii) Directive 2002/58/EC concerning the Processing of Personal Data and the protection of privacy in the electronic communications sector; and (iii) applicable national implementations of (i) and (ii); or (iii) GDPR as it forms parts of the United Kingdom domestic law by virtue of Section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR”); and (iv) Swiss Federal Data Protection Act on 19 June 1992 and its Ordinance (“Swiss DPA”); in each case, as may be amended, superseded or replaced.
“Instruction” means a binding order issued by a Controller to a Processor and directing the same to perform a specific action with respect to the Processing of Personal Data and/or Controller Data. Example Instructions include, but are not limited to: (a) modelling and representation of data; (b) establishing Data Location (c) data anonymization and redaction; (d) data access controls, freezing, blocking or otherwise making data temporarily or permanently unavailable; (e) data modification or deletion; (f) transferring data from a Sending Controller to Receiving Controller(s). Instructions may be issued through Graphical User Interfaces (GUI), Application Programming Interfaces (API), Command Line Interfaces (CLI), Software Development Kits (SDK) and/or other tools provided by Vendia Agreement. The terms “Instruct”, “Instructions” and “Instructed” will be construed accordingly.
“Personal Data” means information relating to an identified or identifiable natural person (“Data Subject”) where such information is contained within Controller Data. For the avoidance of doubt, Personal Data includes personally identifiable information under applicable Data Protection Laws.
“Personal Data Breach” means any unauthorized or unlawful breach of security leading to, or reasonably believed to have led to, the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed. Personal Data Breach will not include unsuccessful attempts or activities that do not compromise the security of Personal Data.
“Processing” means any operation or set of operations which is performed on Personal Data, encompassing the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or erasure of Personal Data. Processing an Instruction may result in Personal Data being transferred from a Sending Controller to a Receiving Controller. The terms “Process”, “Processing”, “Processes” and “Processed” will be construed accordingly.
“Processor” means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.
“Standard Contractual Clauses (SCCs)” means European Commission pre-approved contractual clauses ensuring compliance with the General Data Protection Regulation (GDPR).
“Services” means the services made available by Vendia, including those services described in the Service Terms of the Agreement, including associated APIs and Vendia Content (as defined in the Agreement).
“Sub-Processor” means any third party (including any Vendia affiliates) engaged directly or indirectly by Vendia to Process any Personal Data. This definition shall also include any third party appointed by a Sub-Processor to Process any Personal Data.
Within the scope of the Agreement and the DPA and in their use of Services, CUSTOMER will be responsible for complying with all requirements that apply to it under applicable Data Protection Laws with respect to its Processing of Personal Data and the Instructions it issues to Vendia.
CUSTOMER agrees and acknowledges that under Instruction, Vendia will Process (e.g. transfer) data between a Sending Controller and a Receiving Controller(s). Such transferred data is now subject to the Agreement, DPA and other contracted relationship between Vendia and the Receiving Controller(s). Furthermore, the Receiving Controller(s) may be subject to different Data Protection Laws, and may not be in the same geographic region or use the same Sub-Processors as the Sending Controller and that the Agreement and any applicable laws governing Sending Controller may or may not apply to the Receiving Controller. It is the sole responsibility of the Sending Controller to determine whether such sharing is permitted under any applicable laws governing the Sending and Receiving Controller(s).
In particular but without prejudice to the generality of the foregoing, CUSTOMER acknowledges and agrees that it will be solely responsible for: (a) the accuracy, quality, and legality of Controller Data and the means by which it acquired Personal Data; (b) complying with all necessary transparency and lawfulness requirements under applicable Data Protection Laws for the collection and use of the Personal Data, including obtaining any necessary consents and authorizations (particularly for use by CUSTOMER for marketing purposes); (c) ensuring it has the right to transfer, or provide access to, the Personal Data to Vendia for Processing in accordance with the terms of the Agreement (including this DPA); (d) ensuring that its Instructions to Vendia regarding the Processing of Personal Data comply with applicable laws, including Data Protection Laws; and (e) complying with all laws (including Data Protection Laws) applicable to any emails or other content created, sent or managed through Services, including those related to obtaining consent (where required) to send emails or other forms of data transmission, the content of the emails and transmissions, and its email and data transmission deployment practices. CUSTOMER will inform Vendia without undue delay if it is not able to comply with its responsibilities under this Section 3 – CUSTOMER Obligations or applicable Data Protection Laws.
The Parties agree that the Agreement (including this DPA), together with CUSTOMER’s use of Services in accordance with the Agreement, constitute Controller’s complete Instructions to Vendia in relation to the Processing of Personal Data; Controller shall provide additional Instructions that are consistent with the Agreement (including this DPA), the nature and lawful use of services provided by Vendia. In particular but without prejudice to the generality of the foregoing, CUSTOMER acknowledges and agrees that it will be solely responsible for following the currently documented best practices and procedures provided by Services regarding the controls and Instructions under Agreement, including: (a) agreeing to prerequisites that Personal Data be modelled appropriately; (b) agreeing to specify the Data Location of Controller Data; (c) agreeing that certain Instructions shall result in the Processing (e.g. transfer) of Data from a Sending Controller to a Receiving Controller(s); and (d) agreeing to utilize Instructions to modify or restrict the Processing of Personal Data to comply with the terms of the Agreement and the DPA.
CUSTOMER is responsible for independently determining whether the data security provided for Services adequately meets CUSTOMER’s and CUSTOMER Affiliate(s) obligations under Data Protection Laws. For more information on how Vendia protects Controller Data, please see Annex III to this DPA (“Security Measures”). CUSTOMER is also responsible for its secure use of Services, including protecting the security of Controller Data and Personal Data in transit to and from Services.
Vendia will only Process Controller Data and Personal Data subject to the Agreement for the purposes described in this DPA.
CUSTOMER agrees and acknowledges that under Instruction, Vendia will Process Personal Data between a Sending Controller and a Receiving Controller(s). Vendia’s sole responsibility shall be Processing Personal Data as Instructed by the Sending Controller and not to independently confirm whether such sharing is permitted under either the Sending Controller or Receiving Controller(s) applicable Data Protection Laws.
If Vendia becomes aware that it cannot Process Personal Data in accordance with Controller’s Instructions due to a legal requirement under any applicable law, Vendia will: (a) promptly notify Controller of that legal requirement to the extent permitted by the applicable law; and (b) where necessary, cease all Processing (other than merely storing and maintaining the security of the affected Personal Data) until such time as Controller issues new Instructions with which Vendia is able to comply. In any such event , Vendia will not be liable to Controller under the Agreement for any failure to perform the Services until such time as Controller issues new lawful Instructions to Vendia with respect to the Processing of Personal Data.
Vendia will implement and maintain appropriate technical and organizational measures to protect Personal Data from Personal Data Breaches, as described under Annex III. Notwithstanding any provision to the contrary, Vendia may modify or update the Security Measures at its discretion provided that such modification or update does not result in a material degradation in the protection offered by the Security Measures.
Vendia will ensure that any personnel whom Vendia authorizes to Process Personal Data on its behalf is subject to appropriate confidentiality obligations (whether a contractual or statutory duty) with respect to that Personal Data.
Vendia will notify CUSTOMER without undue delay after Vendia becomes aware of any Personal Data Breach and will provide timely information relating to the Personal Data Breach as it becomes known or as reasonably requested by CUSTOMER. At CUSTOMER’s request, Vendia will promptly provide CUSTOMER with such reasonable assistance as necessary to enable CUSTOMER to notify competent authorities and affected Data Subjects of relevant Personal Data Breaches, if CUSTOMER is required to do so under Data Protection Laws.
Upon CUSTOMER’s Instruction, or upon termination or expiration of this DPA and/or Agreement, Vendia shall in a timely fashion destroy or return to CUSTOMER all Controller Data (including copies) in its possession or control (including any Personal Data Processed by its Sub-Processors). This requirement shall not apply to the extent that Vendia is required by any applicable law to retain some or all of the Personal Data, in which event Vendia shall isolate and protect the Personal Data from any further Processing except to the extent required by such law. This provision shall not apply to data transferred (copied) to Receiving Controller(s) that are no longer subject to the Sending Controller’s Agreement.
5.1. Services provide CUSTOMER with a number of controls that it can use to issue Instructions to Vendia to Process Personal Data (including but not limited to, retrieval, correction, deletion or restriction). CUSTOMER agrees to the use of Services for issuing Instructions to meet their obligations under Data Protection Laws, including CUSTOMER’s obligations relating to responding to requests from Data Subjects to exercise their rights under applicable Data Protection Laws (“Data Subject Requests”).
5.2. To the extent that CUSTOMER is unable to independently address a Data Subject Request through Services, then upon CUSTOMER’s written request Vendia will provide reasonable assistance to CUSTOMER to respond to any Data Subject Requests or requests from data protection authorities relating to the Processing of Personal Data under the Agreement. CUSTOMER agrees to reimburse Vendia for any commercially reasonable costs arising from such assistance.
5.3. If a Data Subject Request or other communication regarding the Processing of Personal Data under the Agreement is made directly to Vendia, Vendia will promptly inform CUSTOMER and will advise the Data Subject to submit their request to CUSTOMER. CUSTOMER will be solely responsible for responding substantively to any such Data Subject Requests or communications involving Personal Data.
6.1. CUSTOMER acknowledges and agrees to Vendia’s use of Sub-Processors to Process Personal Data under this Agreement as outlined in Annex IV (“Sub-Processors”).
6.2. Vendia shall not delegate any Processing of Personal Data to additional Sub-Processor without the prior written consent of CUSTOMER. Notwithstanding this, CUSTOMER consents to Vendia engaging Sub-Processors to Process the Personal Data provided that:
6.3. If CUSTOMER objects to the engagement of additional Sub-Processor as defined in Section 6.2 on data protection grounds, then either Vendia will not engage the Sub-Processor to Process the Personal Data or CUSTOMER shall elect to suspend or terminate the affected Services in accordance with the termination provisions of the Agreement without liability to either party (but without prejudice to any fees incurred by CUSTOMER prior to suspension or termination). The Parties agree that by complying with this subsection, Vendia fulfils its obligations under Section 9 of the SCCs.
7.1. Vendia, through Services under Agreement, provides CUSTOMER with self-service controls to respond to any requests, complaints or other communications from Data Subjects and regulatory or judicial bodies relating to the Processing of Personal Data under the Agreement, including requests from Data Subjects seeking to exercise their rights under Applicable Privacy Laws. To the extent CUSTOMER is unable to independently address a Data Subject Request, Vendia will provide reasonable assistance in exchange for reasonable costs arising from this assistance. In the event that any such request, complaint or communication is made directly to Vendia, Vendia shall promptly pass this onto CUSTOMER; CUSTOMER shall be solely responsible for responding to any such request.
7.2. If Vendia receives a subpoena, court order, warrant or other legal demand from a third party (including law enforcement or other public or judicial authorities) seeking the disclosure of Personal Data, Vendia shall not disclose any information but shall immediately notify CUSTOMER in writing of such request, and reasonably cooperate with CUSTOMER if it wishes to limit, challenge or protect against such disclosure, to the extent permitted by applicable laws, or as directed by a court or official with appropriate jurisdiction.
7.3. To the extent Vendia is required under Applicable Privacy Laws, Vendia will assist CUSTOMER to conduct a data protection impact assessment and, where legally required, consult with applicable data protection authorities in respect of any proposed Processing activity that present a high risk to Data Subjects.
7.4. Nothing in this Section shall be construed to limit or contravene Section 5.1.
8.1. Vendia shall ensure that any Authorized Person is subject to a strict duty of confidentiality (whether a contractual or statutory duty) and that they Process the Personal Data only for the purpose of delivering Services under the Agreement to CUSTOMER.
8.2. Vendia will implement and maintain all appropriate technical and organizational security measures to protect from Security Incidents and to preserve the security, integrity and confidentiality of Personal Data (“Security Measures”). Such measures shall have regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. At a minimum, Vendia agrees to the Security Measures identified at Annex III.
9.1. In the event of a Personal Data Breach, without undue delay, Vendia shall inform CUSTOMER and provide written details of the Security Incident, including the type of data affected and the identity of affected person(s) as soon as such information becomes known or available to Vendia.
9.2. Furthermore, in the event of a Security Incident, Vendia shall:
(a) Provide timely information and cooperation as CUSTOMER may require to fulfil CUSTOMER’s data breach reporting obligations under Applicable Privacy Laws; and
(b) Take such measures and actions as are appropriate to remedy or mitigate the effects of the Security Incident and shall keep CUSTOMER up-to-date about all developments in connection with the Security Incident.
9.3. The content and provision of any notification, public/regulatory communication or press release concerning the Security Incident with respect to CUSTOMER’s data shall be solely at CUSTOMER’s discretion, except as otherwise required by applicable laws.
CUSTOMER acknowledges and agrees that CUSTOMER will Instruct Vendia on the Data Location of Controller Data and jurisdiction for Processing mechanisms as outlined in Section 3. Vendia will only store Controller Data at rest in the Instructed Data Location.
Notwithstanding the foregoing, CUSTOMER acknowledges and agrees that Vendia may Process Controller Data in any country in which Vendia or its Affiliates have operations only as necessary to provide Services in accordance with the Agreement. In particular, Vendia may temporarily transfer and Process Controller Data when such measures are required for the continuance of Vendia Offerings; such measures (without limitation) may be required in the event of: (i) emergency efforts to restore Services in the event of a Service disruption; (ii) the implementation of remedies of Section 9 – Personal Data Breach; (iii) vital operational or technical support; (iv) written Instruction by CUSTOMER. Wherever Controller Data is transferred outside its country of origin, each Party will ensure such transfers are made in compliance with the requirements of Data Protection Laws and Vendia will promptly destroy or remove such data once normal operations have been restored.
This Section in its entirety will apply only with respect to European Data.
When Processing European Data in accordance with Controller’s Instructions, the Parties acknowledge and agree that CUSTOMER is the Controller of European Data and Vendia is the Processor.
For the purposes of Clause 9(c) of the SCCs, CUSTOMER acknowledges that Vendia may be restricted from disclosing Sub-Processor agreements, but will use reasonable efforts to require any Sub-Processor that Vendia appoints to permit such Sub-Processor to disclose the Sub-Processor agreement to CUSTOMER and will provide (on a confidential basis) all information that Vendia reasonably can.
To the extent that the required information is reasonably available to Vendia, and CUSTOMER does not otherwise have access to the required information, Vendia will provide reasonable assistance to CUSTOMER with any data protection impact assessments, and prior consultations with supervisory authorities or other competent data privacy authorities to the extent required by European Data Protection Laws.
The Parties agree that Vendia will Process European Data as a Service Provider strictly for the purpose of performing Services under the Agreement or as otherwise permitted by GDPR, including as described in Vendia’s Privacy Policy, which resides at www.vendia.com/legal/privacy-policy.
CUSTOMER acknowledges that in connection with the performance of Services, Vendia may be a recipient of European Data in the United States. Subject to (C) under this Section, the Parties agree that the SCCs will be incorporated by reference and form part of the Agreement as follows:
(a) EEA Transfers. In relation to European Data that is subject to the GDPR: (i) CUSTOMER is the “data exporter” and Vendia, Inc. is the “data importer”; (ii) the Module Two and Module Four terms apply to the extent the CUSTOMER is a Controller of European Data and Vendia is a Processor of European Data; (iii) in Clause 7, the optional docking clause applies; (iv) in Clause 9, Option 2 applies and changes to Sub-Processors will be notified in accordance with the ‘Sub-Processing’ Section of this DPA; (v) in Clause 11, the optional language is deleted; (vi) in Clauses 17 and 18, the Parties agree that the governing law and forum for disputes for the SCCs will be determined in accordance with the Agreement or, if such Agreement do not specify an EU Member State, the Republic of Ireland (without reference to conflicts of law principles); (vii) the Annexes of the SCCs will be deemed completed with the information set out in the Annexes of this DPA; and (viii) if and to the extent the SCCs conflict with any provision of this DPA the SCCs will prevail to the extent of such conflict.
(b) UK Transfers. In relation to European Data that is subject to the UK GDPR, the SCCs will apply in accordance with subsection (ii) and the following modifications: (i) the SCCs will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part of the Agreement; (ii) Tables 1, 2 and 3 of the UK Addendum will be deemed completed with the information set out in the Annexes of this DPA and Table 4 will be deemed completed by selecting “neither Party”; and (iii) any conflict between the terms of the SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum.
(c) Swiss Transfers. In relation to European Data that is subject to the Swiss DPA, the SCCs will apply in accordance with subsection (a) and the following modifications (i) references to “Regulation (EU) 2016/679” will be interpreted as references to the Swiss DPA; (ii) references to “EU”, “Union” and “Member State law” will be interpreted as references to Swiss law; and (iii) references to the “competent supervisory authority” and “competent courts” will be replaced with the “the Swiss Federal Data Protection and Information Commissioner ” and the “relevant courts in Switzerland”
This Section of the DPA in its entirety will apply only with respect to California Personal Information.
When Processing California Personal Information in accordance with Controller’s Instructions, the Parties acknowledge and agree that CUSTOMER is a Business and Vendia is a Service Provider for the purposes of the CCPA.
The Parties agree that Vendia will Process California Personal Information as a Service Provider strictly for the purpose of performing Services under the Agreement (the “Business Purpose”) or as otherwise permitted by the CCPA, including as described in Vendia’s Privacy Policy, which resides at www.vendia.com/legal/privacy-policy.
Notwithstanding anything else to the contrary in the Agreement and without prejudice to Section 3.1 – Compliance with Instructions and Section(s) 2.3 / 3.3 – Security of this DPA, Vendia reserves the right to make any updates and changes to this DPA. This DPA will be updated periodically, to ensure compliance with Applicable Privacy Laws. Vendia will ensure the updated copy of DPA will reside at www.vendia.com/legal/dpa.
If any individual provisions of this DPA are determined to be invalid or unenforceable, the validity and enforceability of the other provisions of this DPA will not be affected.
Each Party and each of their Affiliates’ liability, taken in aggregate, arising out of or related to this DPA (and any other DPAs between the Parties) and the SCCs (where applicable), whether in contract, tort or under any other theory of liability, will be subject to the limitations and exclusions of liability set out in the _Limitation and Liability _section of the Agreement, and any reference in such section to the liability of a Party means aggregate liability of that Party and all of its Affiliates under the Agreement (including this DPA). In no event will either Party’s liability be limited with respect to any individual’s data protection rights under this DPA (including the SCCs) or otherwise.
This DPA will be governed by and construed in accordance with the laws of the State of California, unless required otherwise by Data Protection Laws.
The legal entity agreeing to this DPA as CUSTOMER represents that it is authorized to agree and enter into this DPA for and on behalf of itself, and as applicable, each of its Affiliates.
The Parties agree that: (a) CUSTOMER will exercise any right or seek any remedy any Affiliate may have under this DPA on behalf of its Affiliates, and (b) CUSTOMER will exercise any such rights under this DPA not separately for each Affiliate individually but in a combined manner for itself and all of its Affiliates together. The CUSTOMER shall remain responsible for coordinating all Instructions, authorizations, and communications with Vendia under this DPA and will be entitled to make and receive any communications related to this DPA on behalf of its Affiliates.
Vendia will make all information reasonably necessary to demonstrate compliance with this DPA available to CUSTOMER and allow for and contribute to audits, including inspections conducted by CUSTOMER or its auditor in order to assess compliance with this DPA. CUSTOMER acknowledges and agrees that it will exercise its audit rights under this DPA and Clause 8.9 of the SCCs by instructing Vendia to comply with the audit measures described in this ‘Demonstration of Compliance’ section. CUSTOMER acknowledges that Services are hosted by Vendia’s hosting Sub-Processors who maintain independently validated security programs (including SOC 2) and that Vendia’s systems are audited annually as part of SOC 2 compliance and regularly tested by independent third party penetration testing firms. Upon request, Vendia will supply (on a confidential basis) its SOC 2 report and summary copies of its penetration testing report(s) to CUSTOMER so that CUSTOMER can verify Vendia’s compliance with such DPA. Further, at CUSTOMER’s written request, Vendia will provide written responses (on a confidential basis) to all reasonable requests for information made by CUSTOMER necessary to confirm Vendia’s compliance with this DPA, provided that CUSTOMER will not exercise this right more than once per calendar year unless it has reasonable evidence to suspect non-compliance with the DPA.
The Parties agree that CUSTOMER will, when reviewing Vendia’s compliance with this DPA pursuant to Section 13.7 – Demonstration of Compliance, take all reasonable measures to limit any impact to Vendia by combining several audit requests carried out by CUSTOMER into one single audit. CUSTOMER acknowledges and agrees that any and all audits requested by CUSTOMER shall take place no more than once per calendar year, unless otherwise required by applicable law or by request of law enforcement.
If there is any conflict between any section in this DPA and any provision in the Agreement, this DPA controls and takes precedence. With effect from the effective date, this DPA is part of, and incorporated into the Agreement.
shall survive so long as Vendia and/or its Sub-Processors, Processes Personal Data on behalf of a CUSTOMER.
in the Agreement Vendia acknowledges and agrees that it shall be liable for any loss of data (including Personal Data) arising under or in connection with the Agreement and this DPA to the extent such loss results from any failure of Vendia (or its Sub-Processors) to comply with its obligations under this DPA and/or Applicable Privacy Laws.
Nothing in this Addendum is intended to modify or contradict any SCCs or prejudice the fundamental rights or freedoms of data subjects under European Data Protection Law.
(**MODULE 2: Transfer controller to processor; **MODULE 4: Transfer processor to controller)
Capitalized terms used but not defined in these Clauses have the meanings given to them in the agreement into which these Clauses are incorporated (the “Agreement”).
the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A. (hereinafter each “data exporter”), and
the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A. (hereinafter each “data importer”)
have agreed to these standard contractual clauses (hereinafter: “Clauses”).
(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
(ii) Clause 8 – Module Two: Clause 8.1(b), 8.9(a), (c), (d) and (e); Module Four: Clause 8.1 (b) and Clause 8.3(b);
(iii) Clause 9 – Module Two: Clause 9(a), (c), (d) and (e)
(iv) Clause 12 – Modules Two: Clause 12(a), (d) and (f);
(v) Clause 13;
(vi) Clause 15.1(c), (d) and (e);
(vii) Clause 16(e);
(viii) Clause 18 – Module Two: Clause 18(a) and (b); Module Four: Clause 18.
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex II.
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex II, unless on further instructions from the data exporter.
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex III and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.
Processing by the data importer shall only take place for the duration specified in Annex II. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter “sensitive data”), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex II.
The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union[4] (in the same country as the data importer or in another third country, hereinafter “onward transfer”) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
The Parties shall assist each other in responding to enquiries and requests made by data subjects under the local law applicable to the data importer or, for data processing by the data exporter in the EU, under Regulation (EU) 2016/679.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of Regulation (EU) 2016/679:] The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.B, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679:] The supervisory authority of one of the Member States in which the data subjects whose personal data is transferred under these Clauses in relation to the offering of goods or services to them, or whose behaviour is monitored, are located, as indicated in Annex I.B, shall act as competent supervisory authority.
These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of the EU Member State specified in the Agreement.
These Clauses shall be governed by the law of a country allowing for third-party beneficiary rights. The Parties agree that this shall be the law of the EU Member State specified in the Agreement).
Any dispute arising from these Clauses shall be resolved by the courts of the EU Member State specified in the Agreement.
[1] Where the data exporter is a processor subject to Regulation (EU) 2016/679 acting on behalf of a Union institution or body as controller, reliance on these Clauses when engaging another processor (sub-processing) not subject to Regulation (EU) 2016/679 also ensures compliance with Article 29(4) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295 of 21.11.2018, p. 39), to the extent these Clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) of Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision […].
[2] This requires rendering the data anonymous in such a way that the individual is no longer identifiable by anyone, in line with recital 26 of Regulation (EU) 2016/679, and that this process is irreversible.
[3] The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses.
[4] The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purpose of these Clauses.
[5] See Article 28(4) of Regulation (EU) 2016/679 and, where the controller is an EU institution or body, Article 29(4) of Regulation (EU) 2018/1725.
[6] The Agreement on the European Economic Area (EEA Agreement) provides for the extension of the European Union’s internal market to the three EEA States Iceland, Liechtenstein and Norway. The Union data protection legislation, including Regulation (EU) 2016/679, is covered by the EEA Agreement and has been incorporated into Annex XI thereto. Therefore, any disclosure by the data importer to a third party located in the EEA does not qualify as an onward transfer for the purposes of these Clauses.
[7] This includes whether the transfer and further processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions or offences.
[8] This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7.
[9] This requirement may be satisfied by the sub-processor acceding to these Clauses under the appropriate Module, in accordance with Clause 7.
[10] That period may be extended by a maximum of two more months, to the extent necessary taking into account the complexity and number of requests. The data importer shall duly and promptly inform the data subject of any such extension.
[11] The data importer may offer independent dispute resolution through an arbitration body only if it is established in a country that has ratified the New York Convention on Enforcement of Arbitration Awards.
[12] As regards the impact of such laws and practices on compliance with these Clauses, different elements may be considered as part of an overall assessment. Such elements may include relevant and documented practical experience with prior instances of requests for disclosure from public authorities, or the absence of such requests, covering a sufficiently representative time-frame. This refers in particular to internal records or other documentation, drawn up on a continuous basis in accordance with due diligence and certified at senior management level, provided that this information can be lawfully shared with third parties. Where this practical experience is relied upon to conclude that the data importer will not be prevented from complying with these Clauses, it needs to be supported by other relevant, objective elements, and it is for the Parties to consider carefully whether these elements together carry sufficient weight, in terms of their reliability and representativeness, to support this conclusion. In particular, the Parties have to take into account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.
Data exporter(s):
Name: CUSTOMER, as specified in the Agreement.
Address: As specified in the Agreement.
Contact person’s name, position and contact details: Contact details for the data exporter are specified in the Agreement.
Activities relevant to the data transferred under these Clauses: The data importer provides the Services, including any applicable Implementation Services, to the data exporter in accordance with the Agreement. Those Services may include advisory, consulting or implementation services if ordered by the data exporter.
Signature and date: The parties agree that execution of the Agreement and certification by the data exporter shall constitute execution of these Clauses by both parties.
Role (controller/processor): Processor
Data importer(s):
Address: As specified in the Agreement.
Contact person’s name, position and contact details: Contact details for the data importer are specified in the Agreement.
Activities relevant to the data transferred under these Clauses: The data importer provides the Services, including any applicable Implementation Services, to the data exporter in accordance with the Agreement.
Signature and date: The parties agree that execution of the Agreement and certification by the data exporter shall constitute execution of these Clauses by both parties.
Role (controller/processor): processor.
Identify the competent supervisory authority/ies in accordance with Clause 13.
The authority identified by the data exporter as its competent supervisory via the Agreement.
Description of Controller:
CUSTOMER shall be the data controller of certain Personal Data provided to Vendia to provide Services as agreed upon in the Agreement.
Vendia will offer its Software-as-a-Service (SaaS) platform which helps companies rapidly build real-time transaction services that connect data across applications, data stores and other silos. Vendia will host, manage, operate and maintain the software for remote electronic access and will incorporate mutually agreeable modifications into the software based on feedback from CUSTOMER.
CUSTOMER acknowledges and agrees that it will be solely responsible for defining, as appropriate, any and all Personal Data to be Processed by Vendia. All Personal Data must be identified as such, using Instructions provided by Vendia, prior to transfer to Vendia for Processing.
CUSTOMER acknowledges and agrees that it will be solely responsible for defining, as appropriate, any and all special categories of Personal Data to be Processed by Vendia. All special categories of Personal Data must be identified as such, using Instructions provided by Vendia, prior to transfer to Vendia for Processing.
CUSTOMER acknowledges and agrees that it will be solely responsible for defining, as appropriate, any and all categories of Data Subjects.
CUSTOMER acknowledges and agrees that it will be solely responsible for defining and maintaining, as appropriate, any and all data recipients of Personal Data by Instruction to Vendia. Data recipients may include, but are not limited too: (i) Vendia Service accounts consumed by natural persons or CUSTOMER services, created by CUSTOMER by Instruction, with sufficient privileges to access Personal Data; (ii) Receiving Controllers which CUSTOMER (i.e., Sending Controller) Instructs Vendia to Process (e.g. transmit) Personal Data; (iii) CUSTOMER as a Receiving Controller may also be a recipient of Personal Data by the nature of Vendia Processing Instructions issued by a Sending Controller.
The personal data processed by Vendia and/or its Sub-Processors will be subject to the Processing activities described in the agreement or purchase orders for Services subject to this DPA. Personal data shall be processed only to comply with CUSTOMER’s instructions issued in accordance with the DPA.
Such Processing activities include but are not limited too, providing storage of data, support and maintenance to CUSTOMER, CUSTOMER Affiliates, and/or their respective customers.
CUSTOMER agrees that Vendia will Process data on behalf of CUSTOMER until CUSTOMER provides Instruction to delete Personal Data, or upon termination of Agreement and/or this DPA.
Vendia hosts its production Services with outsourced public cloud infrastructure providers. The physical and environmental of these infrastructure providers’ security controls are audited for SOC 2 Type II compliance among other certifications. Data Processing systems must be prevented from being used without authorization. Vendia has (without limitation) implemented the following controls:
Persons entitled to use a data Processing system shall gain access only to the data to which they have a right of access, and Personal Data must not be read, copied, modified or removed without authorization in the course of Processing. Vendia has (without limitation) implemented the following controls:
Personal Data must not be read, copied, modified or removed without authorization during transfer or storage and it shall be possible to establish to whom Personal Data was transferred. All Personal Data is encrypted during any transmission.
Vendia shall be able retrospectively to examine and establish whether and by whom Personal Data have been entered into data Processing systems, modified, or removed. Vendia has (without limitation) implemented the following controls:
Personal Data being Processed in the performance of a service for CUSTOMER shall be Processed solely in accordance with the Agreement in place between CUSTOMER and Vendia and in accordance with the Instructions of CUSTOMER. Vendia has (without limitation) implemented the following controls:
Personal Data shall be protected against disclosure, accidental or unauthorized destruction or loss. Vendia has (without limitation) implemented the following controls:
The internal organization of the data importer shall meet the specific requirements of data protection. In particular, the data importer shall take technical and organizational measures to avoid the accidental mixing of Personal Data. Vendia has (without limitation) implemented the following controls:
| Name | Nature of processing | Territory(ies) |
| Amazon Web Services (AWS), Inc | Hosting & infrastructure. Used as an on-demand cloud computing and data hosting platform | As Instructed by the controller for the provisioning of Services in Agreement. |
| Google, Inc. | Domain name server services | United States; Local (traffic will be automatically routed to the nearest data centre) |
| Google Cloud Platform (GCP) | Hosting & infrastructure. Used as an on-demand cloud computing and data hosting platform | As Instructed by the controller for the provisioning of Services in Agreement. |
| Microsoft Azure | Hosting & infrastructure. Used as an on-demand cloud computing and data hosting platform. | As Instructed by the controller for the provisioning of services in agreement. |
| HubSpot | Customer relationship management system (CRM), containing all client information collected, governed, transformed, reported and shared across Vendia’s organisation. No Controller Data is stored here. | United States |