Reputation Data Processing Addendum: Data Hosted in EU

Updated on Aug. 25, 2020

1. Introduction

This Data Processing Addendum (the “Addendum”) is incorporated into the Order Form and Terms of Service (the “Agreement”) and applies in respect of the provision of the Services to the Customer if the Customer is subject to the European Data Protection Laws and only to the extent the Customer is a Controller of Customer Personal Data (as defined below) that Company Processes on behalf of the Customer. This Addendum shall be effective for the term of the Agreement.

2. Definitions

2.1. For the purposes of the Addendum:

  • “Customer Personal Data” means Personal Data submitted, stored, uploaded or otherwise provided by Customer through its use of the Services, in respect of which the Customer is the Controller, as further described under Section 3 of this Addendum;
  • “EEA” means the European Economic Area;
  • “European Data Protection Laws” means the GDPR together with any national implementing laws in any Member State of the EEA and, to the extent applicable, the UK Data Protection Act 2018, as amended, repealed, consolidated or replaced from time to time;
  • “GDPR” means the General Data Protection Regulation (EU) 2016/679; and
  • “Personal Data”, “Data Subject”, “Data Protection Authority”, “Data Protection Impact Assessment”, “Process”, “Processor” and “Controller” will each have the meaning given to them in the European Data Protection Laws.

2.2. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement.

3. Details Of The Processing

3.1. Categories of Data Subjects. This Addendum applies to the Processing of Customer Personal Data relating to Customer’s customers or patients or prospects and other end users, the extent of which is determined and controlled by Customer in its sole discretion.

3.2. Types of Personal Data. Customer Personal Data includes the following types of Personal Data: names, title, position, contact information (including email addresses and phone numbers), purchase or services information, and other data, the extent of which is determined and controlled by Customer in its sole discretion.

3.3. Subject-Matter and Nature of the Processing. The subject-matter of Processing of Customer Personal Data by Company is the provision of the Services to the Customer. Customer Personal Data will be subject to those Processing activities which Company needs to perform in order to provide the Services pursuant to the Agreement.

3.4. Purpose of the Processing. Customer Personal Data will be Processed by Company for purposes of providing the Services set out into the Agreement.

3.5. Duration of the Processing. Customer Personal Data will be Processed for the duration of the Agreement, subject to Section 11 of this Addendum.

4. Processing Of Customer Personal Data

4.1. Each of the Customer and the Company will comply with their respective obligations under the European Data Protection Laws, to the extent applicable to the Processing of any Customer Personal Data in the context of the provision of the Services.

4.2. Company will only Process Customer Personal Data as a Processor on behalf of and in accordance with the Customer’s prior written instructions and for no other purpose. Company is hereby instructed to Process Customer Personal Data to the extent necessary to enable Company to provide the Services in accordance with the Agreement.

4.3. If for any reason (including a change in applicable law) Company becomes unable to comply with any instructions of the Customer regarding the Processing of Customer Personal Data, Company will promptly:

  • notify the Customer of such inability, providing a reasonable level of detail as to the instructions with which it cannot comply and the reasons why it cannot comply, to the greatest extent permitted by applicable law; and
  • cease all Processing of the affected Customer Personal Data (other than merely storing and maintaining the security of the affected Customer Personal Data) until such time as the Customer issues new instructions with which Company is able to comply (and if this provision applies, Company will not be liable to the Customer under the Agreement in respect of any inability to perform the Services until such time as the Customer issues new instructions).

4.4. The parties agree that the Company’s reputation management SaaS platform used to perform the services under this Agreement (the “Platform”) shall be physically hosted within the EEA and that all Customer Personal Data shall be physically stored on servers within the EEA, currently in Germany. Company will not move or replicate the Customer Personal Data, or access it from, outside the EEA or the United Kingdom.

5. Confidentiality

5.1. Company will ensure that any person whom Company authorises to Process Customer Personal Data on its behalf is subject to confidentiality obligations in respect of that Customer Personal Data.

6. Security Measures

6.1. Company will implement appropriate technical and organisational measures to protect against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data.

7. Appointment of Subprocessors

7.1. Customer authorises Company to appoint Subprocessors to perform specific services on Company’s behalf which may require such Subprocessors to process Customer Personal Data. A current list of the Company Subprocessors may be found at https://www.reputation.com/legal/subprocessors (“Subprocessor Page”). Customer acknowledges and agrees to the engagement of the third parties listed on the Subprocessor Page as Subprocessors in connection with the provision of the Services under this Agreement.

Where Company engages a Subprocessor, Company will enter into a Data Processing Agreement with the Subprocessor that imposes on the Subprocessor at least the same level of protections that apply to Company under this DPA. Where a Subprocessor fails to fulfill its data protection obligations, Company will remain liable to the Customer for the performance of such Subprocessor’s obligations.

If the Company engages a Subprocessor in a country outside the European Economic Area (“EEA”) that is not recognized by the European Commission as providing an adequate level of protection for personal data, then Company shall, in advance of any transfer of personal data to Subprocessor, take steps to ensure that a legal mechanism to achieve adequacy in respect of that processing is in place.

7.2. Notification of New Subprocessors. If the Company retains new Subprocessors other than the companies listed on the Subprocessor Page, the Company will notify the Customer by updating the Subprocessor Page and will give the Customer the opportunity to object to the engagement of the new Subrocessors within 30 days after being notified. The objection must be based on reasonable legal grounds. If the Company and Customer are unable to resolve such objection, then either party may terminate the Agreement by providing written notice to the other party. If a Customer terminates, then Customer shall receive a refund of any prepaid but unused fees for the period following the effective date of termination.

8. Data Subject Rights

8.1. Company will, at the Customer’s request and subject to the Customer paying all of Company’s fees at prevailing rates, and all expenses, provide the Customer with assistance necessary for the fulfilment of the Customer’s obligation to respond to requests for the exercise of Data Subjects’ rights. Customer shall be solely responsible for responding to such requests.

9. Security Breaches

9.1. Company will:

  • notify the Customer as soon as practicable after it becomes aware of any loss, compromise or any unauthorised access to, or breach of the security of, any Customer Personal Data; and
  • at the Customer’s request and promptly provide the Customer with all reasonable assistance necessary to enable the Customer to notify relevant security breaches to the relevant Data Protection Authorities and/or affected Data Subjects.

10. Data Protection Impact Assessment; Prior Consultation

10.1. Company will, at the Customer’s request provide the Customer with reasonable assistance to facilitate:

  • conducting of Data Protection Impact Assessments if the Customer is required to do so under the European Data Protection Laws; and
  • consultation with Data Protection Authorities, if the Customer is required to engage in consultation under the European Data Protection Laws,

in each case solely to the extent that such assistance is necessary and relates to the Processing by the Company of the Customer Personal Data, taking into account the nature of the Processing and the information available to the Processor.

11. Return or Deletion of Customer Personal Data

11.1. Company will permanently and securely delete (or, at the election of the Customer, return, in such format as Company may reasonably elect and subject to the Customer paying all of Company’s fees at prevailing rates, and all expenses, for transferring the Customer Personal Data to such format) all Customer Personal Data in the possession or control of Company or any of its sub-Processors, within ninety (90) days after Company ceases to provide the Services, unless the applicable law of the EEA or EEA Member State or the UK requires otherwise. Company will procure that its sub-Processors do likewise.

12. Information

12.1. The Company will, at Customer’s request provide the Customer with all information necessary to enable the Customer to demonstrate compliance with its obligations under the European Data Protection Laws, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, to the extent that such information is within Company’s control and Company is not precluded from disclosing it by applicable law, a duty of confidentiality, or any other obligation owed to a third party. Company shall immediately inform the Customer if, in its opinion, an instruction infringes the European Data Protection Laws.

‍