Obligations of processor
Compliance with Instructions. The parties acknowledge and agree that Customer is the Controller of Personal Data and Zapflow is the Processor of that data. Processor shall collect, process, and use Personal Data only within the scope of Controller’s Instructions. If Processor cannot process Personal Data in accordance with the Instructions due to a legal requirement under any applicable Data Protection Law, Processor will (i) promptly notify the Controller of that legal requirement before the relevant Processing to the extent permitted by the Data Protection Law; and (ii) cease all Processing (other than merely storing and maintaining the security of the affected Personal Data) until such time as the Controller issues new instructions with which Processor is able to comply. If this provision is invoked, Processor will not be liable to the Controller under the Agreement for any failure to perform the applicable services until the Controller issues new instructions regarding the Processing.
Personal Data Breaches. Processor will notify the Controller without undue delay after it becomes aware of any of any Personal Data Breach affecting any Personal Data. At the Controller’s request, Processor will promptly provide the Controller with all reasonable assistance necessary to enable the Controller to notify relevant Personal Data Breaches to competent authorities and/or affected Data Subjects, if Controller is required to do so under the Data Protection Law.
Data Subject Requests. Processor will provide reasonable assistance, including by appropriate technical and organizational measures and considering the nature of the Processing, to enable Controller to respond to any request from Data Subjects seeking to exercise their rights under the Data Protection Law with respect to Personal Data (including access, rectification, restriction, deletion or portability of Personal Data, as applicable), to the extent permitted by the law. If such request is made directly to Processor, Processor will promptly inform Controller and will advise Data Subjects to submit their request to the Controller. Controller shall be solely responsible for responding to any Data Subjects’ requests. Controller shall reimburse Processor for the costs arising from this assistance.
Sub-Processors. Processor shall be entitled to engage sub-Processors to fulfill Processor’s obligations defined in the Agreement only with Controller’s written consent. For these purposes, Controller consents to the engagement as sub-Processors of Processor’s affiliated companies and the third parties listed in Appendix 2. For the avoidance of doubt, the above authorization constitutes Controller’s prior written consent to the sub-Processing by Processor for purposes of Clause 11 of the Standard Contractual Clauses.
If the Processor intends to instruct sub-Processors other than the companies listed in Appendix 2, the Processor will notify the Controller thereof in writing (email to the email address(es) on record in Processor’s account information for Controller is sufficient) and will give the Controller the opportunity to object to the engagement of the new sub-Processors within 30 days after being notified. The objection must be based on reasonable grounds (e.g. if the Controller proves that significant risks for the protection of its Personal Data exist at the sub-Processor). If the Processor and Controller are unable to resolve such objection, either party may terminate the Agreement by providing written notice to the other party. Controller shall receive a refund of any prepaid but unused fees for the period following the effective date of termination.
Where Processor engages sub-Processors, Processor will enter into a contract with the sub-Processor that imposes on the sub-Processor the same obligations that apply to Processor under this DPA. Where the sub-Processor fails to fulfil its data protection obligations, Processor will remain liable to the Controller for the performance of such sub-Processors obligations.
Where a sub-Processor is engaged, the Controller must be granted the right to monitor and inspect the sub-Processor’s activities in accordance with this DPA and the Data Protection Law, including to obtain information from the Processor, upon written request, on the substance of the contract and the implementation of the data protection obligations under the sub-Processing contract, where necessary by inspecting the relevant contract documents.
The provisions of this Section 4 f shall mutually apply if the Processor engages a sub-Processor in a country outside the European Economic Area (“EEA”) not recognized by the European Commission as providing an adequate level of protection for personal data. If, in the performance of this DPA, Zapflow transfers any Personal Data to a sub-processor located outside of the EEA, Zapflow shall, in advance of any such transfer, ensure that a legal mechanism to achieve adequacy in respect of that processing is in place.
- 1. Data Transfers. Controller acknowledges and agrees that, relating to the performance of the services under the Agreement, Personal Data will be transferred to Zapflow Ltd in Finland and to sub-processors within the EEA.
- 2. Deletion or Retrieval of Personal Data. Other than to the extent required to comply with Data Protection Law, following termination or expiry of the Agreement or written request from the Controller, Processor will delete all Personal Data (including copies thereof) processed pursuant to this DPA. If Processor is unable to delete Personal Data for technical or other reasons, Processor will apply measures to ensure that Personal Data is blocked from any further Processing.
Controller shall, upon termination or expiration of the Agreement and by way of issuing an Instruction, stipulate, within a period set by Processor, the reasonable measures to return data or to delete stored data. Any additional cost arising relating to the return or deletion of Personal Data after the termination or expiration of the Agreement shall be borne by Controller.
Controller may, prior to the commencement of Processing, and at regular intervals thereafter, audit the technical and organizational measures taken by Processor. For such purpose, Controller may, e.g., a) obtain information from the Processor and b) upon reasonable and timely advance agreement, during regular business hours and without interrupting Processor’s business operations, conduct an on-site inspection of Processor’s business operations or have the same conducted by a qualified third party which shall not be a competitor of Processor.
Processor shall, upon Controller’s written request and within a reasonable period of time, provide Controller with information necessary for such audit, to the extent that such information is not a Processors trade secret, is within Processor’s control and Processor is not precluded from disclosing it by applicable law, a duty of confidentiality, or any other obligation owed to a third party. Processor shall have the right to limit access to certain business and security critical information and instead give a summary overview of such information. Any auditor conducting the audit shall executive a non-disclosure agreement binding all auditors as well as the companies they represent.
The terms and conditions of Agreement shall apply to this DPA. In case of any conflict, this DPA shall take precedence over the regulations of the Agreement. Where individual provisions of this DPA are invalid or unenforceable, the validity and enforceability of the other provisions of this DPA shall not be affected. Effective 25 May 2018 Zapflow will process Personal Data in accordance with the GDPR requirements contained herein which are directly applicable to Zapflow's provision of the Subscription Services.