Last updated: March 2024
This Data Processing Addendum ("DPA") supplements the Terms of Service (the "Agreement") entered into by and between the customer signing this DPA ("Customer") and SupAgent ("Company"). By executing the DPA in accordance with Section 11 herein, Customer enters into this DPA on behalf of itself and, to the extent required under applicable Data Protection Laws (defined below), in the name and on behalf of its Affiliates (defined below), if any. This DPA incorporates the terms of the Agreement, and any terms not defined in this DPA shall have the meaning set forth in the Agreement.
The parties acknowledge and agree that with regard to the processing of Personal Data, Customer may act either as a controller or processor and, except as expressly set forth in this DPA or the Agreement, Company is a processor. Customer shall, in its use of the Services, at all times process Personal Data, and provide instructions for the processing of Personal Data, in compliance with Data Protection Laws.
Customer is solely responsible for the accuracy, quality, and legality of (i) the Personal Data provided to Company by or on behalf of Customer, (ii) the means by which Customer acquired any such Personal Data, and (iii) the instructions it provides to Company regarding the processing of such Personal Data.
Company shall process Personal Data only for the purposes described in this DPA and only in accordance with Customer's documented lawful instructions. The parties agree that this DPA and the Agreement set out the Customer's complete and final instructions to Company in relation to the processing of Personal Data.
Company shall implement and maintain appropriate technical and organizational security measures to protect Personal Data from Security Incidents and to preserve the security and confidentiality of the Personal Data, in accordance with Company's security standards and in accordance with Data Protection Laws.
Customer is responsible for reviewing the information made available by Company relating to data security and making an independent determination as to whether the Services meet Customer's requirements and legal obligations under Data Protection Laws.
Customer agrees that Company may engage Sub-processors to process Personal Data on Customer's behalf. The Sub-processors currently engaged by Company and authorized by Customer are listed in Exhibit B.
Company shall: (i) enter into a written agreement with the Sub-processor imposing data protection terms that require the Sub-processor to protect the Personal Data to the standard required by Data Protection Laws; and (ii) remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Sub-processor that cause Company to breach any of its obligations under this DPA.
Company shall provide written responses (on a confidential basis) to all reasonable requests for information made by Customer, including responses to information security and audit questionnaires that are necessary to confirm Company's compliance with this DPA, provided that Customer shall not exercise this right more than once per year.
Company may transfer and process Personal Data to and in other locations around the world where Company or its Sub-processors maintain data processing operations. Company shall ensure such transfers are made in compliance with the requirements of Data Protection Laws.
Upon termination or expiration of the Agreement, Company shall (at Customer's election) delete or return to Customer all Personal Data in its possession or control, except for Personal Data Company retains in accordance with applicable laws.
Company shall, to the extent legally permitted, promptly notify Customer if Company receives a request from a Data Subject to exercise their Data Subject rights in relation to Personal Data. Company shall provide Customer with commercially reasonable cooperation and assistance in relation to handling of a Data Subject Request.
If Company receives a binding request from a public authority, including judicial authorities, for access to Personal Data, Company shall attempt to redirect the public authority to request that data directly from Customer.
Company may amend this DPA from time to time by posting an updated version on its website, provided that such amendments shall not reduce the level of protection provided for Personal Data.
If any provision of this DPA is invalid or unenforceable, the remaining provisions shall remain in effect. Upon such determination that any term or provision is invalid or unenforceable, the parties shall negotiate in good faith to modify this DPA to effect the original intent of the parties as closely as possible.