This Data Processing Addendum (this "DPA") is incorporated into the Terms of Service located at http://metafieldsmanager.thebestagency.com/terms (the "Agreement") between the undersigned customer ("Customer") and Argonautic Labs, LLC.
Capitalized but undefined terms used in this DPA will have the meanings assigned to those terms in the Agreement.
In the course of providing the Service to Customer pursuant to the Agreement, the Company may Process Personal Data on behalf of Customer. The Company agrees to comply with the following provisions with respect to its Processing of Customer Personal Data (as such term is defined herein).
"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. "Control," for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
"Controller" means the entity which determines the purposes and means of the Processing of Personal Data.
"Customer Data" means any data, information or material originated by Customer that Customer submits, collects or provides in the course of using the Services, including any Customer Personal Data.
"Customer Personal Data" means Personal Data submitted by or for Customer, or at Customer’s direction, to the Company in connection with Customer’s use of the Services, and to which Data Protection Laws apply.
"Data Protection Laws" means all laws and regulations, including laws and regulations of the European Union, the European Economic Area and their member states, and the United Kingdom, applicable to the Processing of Customer Personal Data by the Company under the Agreement.
"Data Subject" means an identified or identifiable natural person about whom the Company Processes Personal Data in connection with the Services.
"DPA Effective Date" means, as applicable, (a) 25 May 2018, if the parties agreed to this DPA prior to or on such date; or (b) the date on which the parties agreed to this DPA, if such date is after 25 May 2018.
"GDPR" means the EU General Data Protection Regulation 2016/679.
"Personal Data" means any information which relates to an identified or identifiable natural person, and to which Data Protection Laws apply.
"Personal Data Breach" means a breach of the Company’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data in the Company’s possession, custody or control. "Personal Data Breaches" will not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.
"Process/Processing" shall have the same meaning as "processing" as defined in the GDPR.
"Processor" means the entity which Processes Personal Data on behalf of the Controller.
"Security and Privacy Measures" appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR, that the Company generally makes available to its customers as updated from time to time, or otherwise made reasonably available by the Company.
"Standard Contractual Clauses" means the agreement executed by and between Customer and the Company and attached to this Addendum as Annex 2 pursuant to European Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council.
"Sub-processor" means any entity that the Company engages to Process Customer’s Personal Data on behalf of the Company.
2.1 Roles of the Parties; Purpose. The parties acknowledge and agree that with regard to the Processing of Customer Personal Data, Customer is the Controller, the Company is a Processor and that the Company may engage Sub-processors pursuant to the requirements set forth herein. The subject matter and details of the processing are described in Annex 1.
2.2 Company’s Processing of Personal Data. The Company shall only Process Customer Personal Data on behalf of and in accordance with Customer’s instructions. Customer instructs the Company to Process Customer Personal Data for the following purposes: (i) Processing in accordance with the Agreement; (ii) Processing initiated by Users in their use of the Services; and (iii) Processing to comply with other reasonable instructions provided by Customer (e.g., via email) where such instructions are consistent with the terms of the Agreement and this DPA. This DPA and the Agreement are Customer’s complete and final instructions to the Company for the Processing of Customer Personal Data. Any additional or alternate instructions must be agreed upon separately in writing signed by authorized representatives of both parties.
2.3 Customer’s Processing of Personal Data. Customer shall, in its use of the Services, Process Customer Personal Data in accordance with the requirements of Data Protection Laws. Customer’s instructions for the Processing of Personal Data by the Company shall comply with all Data Protection Laws. Customer shall have sole responsibility for the accuracy, quality, and legality of Customer Personal Data and the means by which Customer acquired Personal Data.
2.4 Security of Processing. The Company will secure Customer Personal Data by implementing the Security and Privacy Measures. The Company will not materially decrease the overall security of the Services during the term of the Agreement.
2.5 Company’s Security Assistance. The Company will (taking into account the nature of the processing of Customer Personal Data and the information available to the Company) provide Customer with reasonable assistance necessary for Customer to comply with its obligations in respect of Customer Personal Data under Data Protection Laws, including Articles 32 to 34 (inclusive) of the GDPR, by (a) implementing the security measures in accordance with Section 2.4 (Security of Processing); and (b) complying with the terms of Section 2.8 (Personal Data Breach Notification).
2.6 Customer’s Security Responsibilities. Customer agrees that, without prejudice to the Company’s obligations under Section 4 (Company Personnel) and Section 2.8 (Personal Data Breach Notification), Customer is solely responsible for its use of the Services, including (a) making appropriate use of the Services to ensure a level of security appropriate to the risk in respect of the Customer Personal Data; (b) securing the account authentication credentials, systems and devices Customer uses to access the Services; and (c) backing up its Customer Personal Data. Customer agrees that, without prejudice to the Company’s obligations under Section 4 (Company Personnel) and Section 2.8 (Personal Data Breach Notification), the Company has no obligation to protect Customer Personal Data that Customer elects to store or transfer outside of the Company’s and its Sub-processors’ systems (for example, offline or on-premises storage).
2.7 Personal Data Breach Notification. The Company will notify Customer without undue delay after becoming aware of a Personal Data Breach. To the extent such Personal Data Breach is caused by a violation of the requirements of this DPA by the Company, the Company shall make reasonable efforts to identify and remediate the cause of such Personal Data Breach. Customer is solely responsible for complying with incident notification laws applicable to Customer and fulfilling any third-party notification obligations related to any Personal Data Breach. The Company’s notification of or response to a Personal Data Breach under this Section 2.8 will not be construed as an acknowledgement by the Company of any fault or liability with respect to the Personal Data Breach. To the extent that the Standard Contractual Clauses apply, Customer agrees that the provisions of this Section 2.8 satisfy the requirements of Clause 5(d)(2).
2.8 Impact Assessments and Consultations. The Company will (taking into account the nature of the processing and the information available to the Company) reasonably assist Customer in complying with its obligations under Data Protection Laws in respect of data protection impact assessments and prior consultation, including, if applicable, Customer’s obligations pursuant to Articles 35 and 36 of the GDPR, by (a) making available for review copies of the the third-party certifications and audits set forth in the Security, Privacy and Architecture Documentation or other documentation describing relevant aspects of the Company’s information security program and the security measures applied in connection therewith; (b) providing the information contained in the Agreement, including this DPA, and (c) providing a description of the processing of Customer Personal Data undertaken by the Company.
2.9 Data Subject Rights. During the term of the Agreement, if the Company receives any request from a Data Subject in relation to Customer Personal Data, the Company will advise the Data Subject to submit their request to Customer and Customer will be responsible for responding to any such request. Upon request from Customer, the Company shall provide commercially reasonable assistance to Customer in relation to the handling of a Data Subject’s request for exercising the Data Subject’s rights laid down in Chapter III of the GDPR, taking into account the nature of the Company’s Processing of Customer Personal Data and solely to the extent Customer is unable to fulfill such requests through the Services. Customer shall be responsible for any costs arising from the Company’s provision of such assistance.
2.10 Deletion of Customer Personal Data. The Company shall delete all Customer Personal Data and copies thereof upon request of Customer or upon termination or expiration of the Agreement, unless otherwise required by the applicable Data Protection Laws, provided, however, that the Company shall delete backup data and operational or system log data in the ordinary course of business. In the event applicable law does not permit the Company to delete the Personal Data, the Company warrants that it shall ensure the confidentiality of the Personal Data and that it shall not use or disclose any Personal Data after termination of the Agreement, except as required by law.
2.11 Data Storage and Processing Facilities. The Company may, subject to Section 2.13 (Company’s Data Transfer Obligations), store and process Customer Personal Data anywhere the Company or its Sub-processors maintains facilities.
2.12 Data Transfers. With respect to Customer Personal Data transferred from the European Economic Area (“EEA”) to outside the EEA in conjunction with Customer’s use of the Services, either directly or via onward transfer, the Company will provide at least the same level of protection for such Customer Personal Data as is required by the Standard Contractual Clauses.
2.13 Audits. Company shall allow Customer and its respective auditors or authorized agents to conduct audits or inspections during the term of the Agreement, which shall include providing reasonable access to the premises, resources and personnel used by Company in connection with the provision of the Services and provide all reasonable assistance in order to assist Customer in exercising its audit rights under this section. The purposes of an audit pursuant to this section include to verify that Company is processing personal data in accordance with its obligations under the DPA and applicable Data Protection Laws. Notwithstanding the foregoing, such audit shall consist solely of: (i) the provision by Comapny of written information (including, without limitation, questionnaires and information about security policies) that may include information relating to subcontractors; and (ii) interviews with Company’s IT personnel. Such audit may be carried out by Customer or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality. For the avoidance of doubt no access to any part of Company’s IT system, data hosting sites or centers, or infrastructure will be permitted.
2.14 Processing Records. Customer acknowledges that the Company is required under the GDPR to: (a) collect and maintain records of certain information, including the name and contact details of each processor and/or controller on behalf of which the Company is acting and, where applicable, of such processor’s or controller's local representative and data protection officer; and (b) make such information available to the supervisory authorities. Accordingly, if the GDPR applies to the processing of Customer Personal Data, Customer will, where requested, provide such information to the Company, and will ensure that all information provided is kept accurate and up-to-date.
3.1 Confidentiality. The Company shall ensure that its personnel engaged in the Processing of Customer Personal Data are informed of the confidential nature of the Customer Personal Data, have received appropriate training on their responsibilities and have executed written confidentiality agreements or are under an appropriate statutory obligation of confidentiality. The Company shall ensure that such confidentiality obligations survive the termination of the personnel engagement.
3.2 Limitation of Access. The Company shall ensure that its personnel’s access to Customer Personal Data is limited to those personnel who require such access to perform under the Agreement.
4.1 General Authorization. Customer authorizes the Company to subcontract processing of Customer Personal Data under this DPA to Sub-processors, provided that the Company: (a) provides Customer with such details about the Sub-processor(s) it uses as may be reasonably requested by Customer from time to time; (b) flows down its obligations under this DPA to such Sub-processor, such that the data processing requirements of such Sub-processor with respect to Customer Personal Data are no less onerous than the data processing requirements of the Company as set out in this DPA; and (c) will be fully liable to Customer for the performance of the Sub-processor’s obligations under this DPA if such Sub-processor fails to fulfill its data protection obligations. Information about Subprocessors, including their functions and locations, is available below:
Stripe: payment processing and billing
Digital Ocean, MongoDB, & Amazon Web Services: used to host our web applications which include our databases
4.2 New Sub-Processors. The Company will inform Customer of any intended changes concerning the addition or replacement of Sub-processors. If Customer has a reasonable basis to object to the Company’s use of a new Sub-processor, Customer shall notify the Company promptly in writing within ten (10) days after the Company informs Customer of such change. If such objection is not unreasonable, the Company will use reasonable efforts to make available to Customer a change in the affected Services or recommend a commercially reasonable change to Customer’s configuration or use of the affected Services to avoid processing of Customer Personal Data by such new Sub-processor. If the Company is unable to make available such change within a reasonable period of time, which shall not exceed sixty (60) days, Customer may terminate the applicable portion of the Services that cannot be provided by the Company without the use of the objected-to new Sub-processor, by providing written notice to the Company. Customer shall receive a refund of any prepaid fees for the period following the effective date of termination in respect of such terminated Services.
4.3 Sub-Processor Agreements. The parties agree that if copies of the Sub-processor agreements must be sent by the Company to the Customer pursuant to this DPA or applicable Data Protection Laws, such copies may have all commercial information and clauses unrelated to this DPA removed by the Company beforehand; and, that such copies will be provided by the Company only upon reasonable request by Customer.
4.4 Customer Consent to Sub-processing; Access to Sub-processing Agreements. To the extent the Standard Contractual Clauses apply:
4.4.1 Customer consents to the Company’s transfer of Personal Data to Sub-processors as described in Sections 4.1 and 4.2 above, and agrees that Customer’s consent satisfies the requirements of Clauses 5(h) and 11.1; and
4.4.2 Upon Customer’s written request, the Company shall allow Customer to examine the data protection provisions of agreements between the Company and its subcontractors that access Customer Personal Data; provided that such agreements shall remain the Company’s Confidential Information. Customer agrees that this Section 4.4.2 satisfies the requirements of Clause 5(j) of the Standard Contractual Clauses.
5.1 Conflicting Terms. This DPA applies only between Customer and the Company and does not confer any rights to any third party. To the extent of any conflict or inconsistency between this DPA and the remaining terms of the Agreement, this DPA will govern. This DPA does not replace any additional rights related to the Company’s processing of Customer’s data as set forth in the Agreement.
5.2 Term and Termination. This DPA will become effective (a) 25 May 2018, if the parties agreed to this DPA prior to or on such date; or (b) the date on which the parties agreed to this DPA, if such date is after 25 May 2018. This DPA will terminate simultaneously and automatically upon the termination of the Agreement. The Company may terminate this DPA at any time upon notice to Customer if the Company offers alternative means to Customer that comply with all applicable Data Protection Laws. Customer may terminate this DPA at Customer’s discretion upon the Company’s receipt of Customer’s written notice of termination.
5.3 Liability. The total combined liability of either party and its Affiliates towards the other party and its Affiliates, whether in contract, tort or any other theory of liability, under or in connection with the Agreement, this DPA, combined will be limited to limitations on liability or other liability caps agreed to by the parties in the Agreement.
5.4 Governing Law. To the extent required by the applicable Data Protection Laws, this DPA shall be governed by the laws of the applicable jurisdiction. In all other cases, this DPA shall be governed by the laws of the jurisdiction stated in the Agreement.
