Data Protection Addendum
This Data Protection Addendum (“DPA”) is made a part of your Subscriber Terms of Use (“Terms”), and governs solely to the extent that: (a) you, or any person (“Person”) from whom CP collects Personal Data (defined below), is located in the European Economic Area (“EEA”) or the United Kingdom ("UK"); (b) you and/or such Person is subject to Data Protection Laws (defined below); and (c) your access and use of the CP Platform involve the collection or processing of the Personal Data of an individual located in the EEA or the UK. To the extent this DPA applies, and in consideration of the mutual obligations set out in this DPA, you and CP agree that this DPA is a binding part of the Terms.
Except as modified in this DPA, the terms and conditions of the Terms shall remain in full force and effect. If there is any conflict between this DPA and the Terms regarding CP’s privacy or security obligations, the provisions of this DPA shall control. Unless expressly defined in the DPA, all capitalized terms used herein will have the meaning assigned to them in the Terms.
Purpose: The purpose of compliance with Data Protection Laws concerning the processing of Personal Data on behalf of CP Platform users located in European Union (“EU”) Member States or members of the European Economic Area and incorporates (to the extent applicable) the terms of the EU Standard Contractual Clauses where the GDPR applies (“EU SCCs”), and where the UK GDPR applies, the ICO's International Data Transfer Addendum to EU Commission Standard Contractual Clauses, available at: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/ (“UK Addendum,” and collectively with EU SCCs, the “SCCs”). “Data Protection Law” means, where applicable, the European General Data Protection Regulation (EU 2016/679) (“GDPR”), including applicable laws implementing or supplementing the GDPR and as transposed into domestic legislation of Member States, as amended, replaced or superseded from time to time) and the UK Data Protection Act of 2018 (“UK GDPR”). The terms Processor, Controller, processing (and process), personal data breach, data protection impact assessment and Personal Data shall have the meanings set out in Data Protection Laws. The term “Personal Data” includes: first and last name, email address, telephone number, mailing address, and other information necessary to identify an individual for purposes of assisting CP with providing use of the CP Platform.
Context and Scope of Personal Data Processing: In order to provide the Vendors or Subscribers with access and use of the CP Platform, it may be necessary for CP to collect Personal Data of such an individual or an employee or other representative of the Vendor or Subscriber (each, a “Customer Representative”). Such data is collected when Customer Representatives provide their Personal Data directly to CP as an account holder or a designated point of contact between Vendor or Subscriber and CP. That data is subsequently used by CP solely to provide access to the CP Platform and the CP Content and Services under the Terms, or as may be necessary to assist with any requests regarding use and proper operation of the CP Platform. Obligations under Data Protection Laws:
a. Processing as a Controller. Generally, CP shall act as the Controller of the Personal Data of each Customer Representative. As a Controller, CP will comply with all data protection requirements under the Data Protection Laws applicable to the Personal Data. Without limiting the foregoing, as a controller of the Personal Data, CP shall be responsible for providing notifications to, and respond to inquiries and requests from, the Customer Representatives; provided, however, that to the extent necessary, the Vendor or Subscriber, as applicable, shall reasonably cooperate with CP for the purpose of responding to requests by Customer Representatives or any government authorities and of generally complying with CP's obligations under the Data Protection Laws. To the extent applicable, nothing herein relieves the Vendor or Subscriber of their own obligations under the applicable Data Protection Laws. The parties are not entering a relationship of joint controllership.
b. Processing as a Processor. In the event any personal data is processed by CP as a Processor, the parties shall specifically identify such personal data and the purposes of processing, as well as the measures undertaken to protect such data, by completing Appendix B (Controller-to-Processor). As a Processor, CP shall only process Personal Data in accordance with the Customer Representative’s documented instructions. As required under Data Protection Laws, CP shall assist the Customer Representative, where appropriate, in ensuring compliance with the Customer Representative’s obligations pursuant to Data Protection Laws, taking into account the nature and scope of CP’s Personal Data processing, which may include providing commercially reasonable cooperation and assistance with: (a) data subject requests (see below); (b) notifications or communications regarding personal data breaches; (c) data protection impact assessments; and (d) prior consultations with supervisory authorities.
With respect to any Personal Data processed by CP as a Processor pursuant to this DPA, CP shall: (a) in the event CP engages trusted third parties to process Personal Data (“Trusted Parties”), seek the prior specific or general written authorization of the Controller, which is hereby given in respect of any Trusted Parties expressly listed below (and in the case of general written authorization, the Processor shall inform the Controller of any intended changes concerning the addition or replacement of Trusted Parties, thereby giving the Controller the opportunity to object to such changes); (b) unless prohibited under applicable law, upon termination of the Services, at its option, either return or destroy the Personal Data (including all copies of it); (c) ensure that all persons authorized by CP to access the Personal Data on CP’s behalf, are subject to obligations of confidentiality in accordance with confidentiality obligations set forth in the Terms; (d) remain fully liable to the Customer Representative, Vendor, or Subscriber for the failure of those persons authorized by CP to access the Personal Data on CP’s behalf; and, (e) make available such information as may be necessary to demonstrate compliance with its obligations under Article 28 of the GDPR and will (at the Customer Representative’s cost and expense) contribute to and allow for appropriate reasonable audits.
The Trusted Parties currently engaged to process Personal Data on behalf of CP include HubSpot, Google (Google Analytics), and YouTube, Inc.
Security: CP limits its collection of Personal Data to only that which is relevant for purpose of providing the services under the Terms and retains Personal Data in a form that permits identification of data subjects (defined below) for no longer than is necessary to serve that purpose. CP maintains a retention register documenting the regulatory, statutory and business retention periods which it applies to its records. Where no defined or legal retention period exists, the default standard retention period is six (6) years plus the year in which the record was created. CP shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. CP currently employs multi-factor authentication as a technical and an organizational measure.
Data Subject Rights: Within the scope of Data Protection Laws, Customer Representatives located in the EEA or the UK (“data subjects”) have certain rights that they may exercise, based on jurisdiction, in relation to the processing of their Personal Data. Where applicable, these rights include: the right to access, correct, update, and delete that data subject’s Personal Data, to withdraw any consent to processing, to opt out of communications, to restrict processing of Personal Data, and to make any claim or complaint in relation to their rights under Data Protection Laws, CP shall respond to and offer reasonable assistance in responding to data subjects’ requests to exercise their data protection rights in accordance with applicable Data Protection Laws.
Cross Border Data Transfer Mechanisms: To the extent your access and use of the CP Platform requires an onward transfer mechanism to lawfully transfer personal data from a jurisdiction to CP outside of that jurisdiction, the terms set forth in this section will apply. In the event your access and use of the CP Platform is covered by more than one transfer mechanism, the transfer of Personal Data will be subject to a single transfer mechanism in accordance with the following order of precedence: (a) the applicable SCCs as set forth in this section; and, if not applicable, then (b) other applicable data transfer mechanisms permitted under Data Protection Laws.
EU Standard Contractual Clauses
a. Controller-to-Controller: Generally, and unless otherwise specifically identified in Appendix B (Controller to Processor) of this Addendum, all transfers of Personal Data from Vendor or Subscriber to CP shall be deemed a controller-to-controller transfer and shall be made pursuant to Module 1 of the Standard Contractual Clauses adopted by the European Commission on June 4, 2021, as currently set out at in the Annex at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en (collectively, the “ Controller SCCs”).
b. Controller-to-Processor: Where Personal Data is transferred from Vendor or Subscriber to CP on a controller-to-processor basis as specifically set forth in Appendix B (Controller to Processor) of this Addendum, the transfer shall be made pursuant to Module 2 of the Standard Contractual Clauses adopted by the European Commission on June 4, 2021, as currently set out in the Annex at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en (collectively, the “ Processor SCCs”).
The parties agree to observe the terms of the Processor SCCs without modification, except as to the following selections: ·
In connection with Module 2, Option 2 of Clause 9(a) (Use of sub-processors) is selected and the applicable time period shall be 30 days.·
Clause 11(a) (Redress) does not select the Option.·
Clause 13(a): The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established, as indicated in Annex I.C, shall act as competent supervisory authority.·
In Clause 14 (Local laws and practices affecting compliance with the Clauses), the provisions for Module 3 shall have no effect, and are hereby deemed deleted.·
In Clause 15 (Obligations of the data importer in case of access by public authorities), the provisions for Module 3 shall have no effect, and are hereby deemed deleted.·
In Clause 16 (Non-compliance with the Clauses and termination), the provisions for Module 4 shall have no effect, and are hereby deemed deleted.·
In Clause 18 (Choice of forum and jurisdiction), the selection in subclause (b) shall be Ireland.
UK Standard Contractual Clauses
Where Personal Data of UK data subjects is transferred from Vendor or Subscriber to CP, the transfer shall be made pursuant to with this DPA and the UK Addendum. The EU SCCs will apply in accordance with the section titled “EU Standard Contractual Clauses” herein, and the following modifications (i) the EU SCCs will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part of the this DPA; (ii) Tables 1, 2 and 3 of the UK Addendum will be deemed completed with the information set out in this DPA and the Appendices to this DPA, as applicable, and Table 4 will be deemed completed by selecting “neither party”; and (iii) any conflict between the terms of the EU SCCs and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum.
In the event of inconsistencies between the provisions of the SCCs and this DPA or other agreements between the parties, the SCCs shall take precedence. The terms of the DPA shall not vary the SCCs in any way. The execution and delivery of this Addendum shall be deemed execution and delivery of the applicable SCCs. The governing law of any applicable SCCs shall be the Member State in which the Vendor or Subscriber (as Data Exporter) is established, or, if applicable, the UK. Each of the parties’ signatures, authentications, or consents to the Terms shall be considered applicable to the DPA and SCCs as well. If so required by the laws or regulatory procedures of any jurisdiction, the parties shall execute or re-execute the SCCs as separate documents setting out the proposed transfers of Personal Data in such manner as may be required.
**********************************************************
APPENDIX A (CONTROLLER-TO CONTROLLER)
ANNEX I
A. LIST OF PARTIES
Data exporter(s):
1. Name: …
Address: …
Contact person’s name, position and contact details: …
Activities relevant to the data transferred under these Clauses: …
Signature and date: …
Role (controller/processor): …
Data importer(s):
1. Name: Channel Program
Address: …
Contact person’s name, position and contact details: …
Activities relevant to the data transferred under these Clauses: …
Signature and date: …
Role (controller/processor): ….
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
Representatives of Data Exporter
Categories of personal data transferred
First and last name, email address, telephone number, mailing address, and other information necessary to identify an individual for purposes of assisting CP with providing use of the CP Platform
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
None
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).Continuous basis
Nature of the processing
Collection, recording, storage, backup and all other processing required for the functioning of the Data Importer's platform and the provision of Data Importer's services to the Data Exporter
Purpose(s) of the data transfer and further processing
To enable Data Exporter's Use of the Data Importer's service and platform
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that periodThe period will be for the duration of the services provided by Data Importer to Data Exporter and for any additional period necessary for Data Importer to maintain its backup data, to comply with legal requirements (including tax reporting purposes), and/or to assert or defend its legal rights in connection with Data Importer's business relationship with the Data Exporter
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
All processing required for collecting, handling, and otherwise processing personal data to enable Data Importer to provide the services and the platform to Data Exporter
C. COMPETENT SUPERVISORY AUTHORITYIdentify the competent supervisory authority/ies in accordance with Clause 13Ireland ANNEX IITECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Measures of pseudonymisation and encryption of personal data
Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services
Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing
Measures for user identification and authorisation
Measures for the protection of data during transmission
Measures for the protection of data during storage
Measures for ensuring physical security of locations at which personal data are processed
Measures for ensuring events logging Measures for ensuring system configuration, including default configuration
Measures for internal IT and IT security governance and management
Measures for certification/assurance of processes and products
Measures for ensuring data minimisation Measures for ensuring data quality
Measures for ensuring limited data retention
Measures for ensuring accountability Measures for allowing data portability and ensuring erasure
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter
All (sub-) processors are required to provide measures at least as protective as the measures provided by the Data Importer
APPENDIX B (CONTROLLER TO PROCESSOR)
[If applicable, complete duplicate information from Appendix A for Controller-to-Processor transfers]