ClickGUARD
Data Processing Agreement

Effective Date: May 1st, 2022

URL: https://www.clickguard.com/terms-of-service

Overview

This Data Processing Agreement (“DPA”) reflects the requirements of the European Data Protection Regulation (“GDPR”). ClickGUARD´s services (“Services”) offered in the European Union are GDPR ready and this DPA provides you as a customer ("Customer") with the necessary documentation on this readiness. The DPA is an addendum to the Terms of Service (“Terms”) between ClickGUARD, Inc (“ClickGUARD”) and the Customer. All capitalized terms not defined in this DPA shall have the meanings set forth in the Terms. Customer enters into this DPA on behalf of itself and, to the extent required under Data Protection Laws, in the name and on behalf of its Authorized Affiliates (defined below).

The parties agree as follows:

1. Definitions

1.1. “Affiliate” means an entity that directly or indirectly Controls, is Controlled by or is under common Control with an entity.
‍
1.2. “Alternative Transfer Solution” means a solution, other than the Model Contract Clauses, that enables the lawful transfer of personal data to a third country in accordance with Data Protection Law.

1.3. “Authorized Affiliate” means any of Customer Affiliate(s) permitted to or otherwise receiving the benefit of the Services pursuant to the Terms.

1.4. “Control” means an ownership, voting or similar interest representing fifty percent (50%) or more of the total interests then outstanding of the entity in question. The term “Controlled” shall be construed accordingly.

1.5. “Controller” means an entity that determines the purposes and means of the processing of Personal Data.

1.6. “Customer Data” means any data that ClickGUARD and/or its Affiliates processes on behalf of Customer in the course of providing the Services under the Terms.

1.7. “Data Protection Laws” means all data protection and privacy laws and regulations applicable to the processing of Personal Data under the Terms, including, where applicable, Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (“GDPR”); (ii) Directive 2002/58/EC concerning the processing of Personal Data and the protection of privacy in the electronic communications sector and applicable national implementations of it (in each case, as may be amended, superseded or replaced); (iii) the Federal Data Protection Act of 19 June 1992 (Switzerland); (iv) EU or EU Member State law; (v) the law of the UK or a part of the UK; and the GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018, if in force.

1.8. “Personal Data” means any Customer Data relating to an identified or identifiable natural person to the extent that such information is protected as personal data under applicable Data Protection Law.

1.9. "Model Contract Clauses" mean standard data protection clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, as described in Article 46 of the EU GDPR and set out at Appendix

1.1.10. “Processor” means an entity that processes Personal Data on behalf of the Controller.

1.11. “Processing” has the meaning given to it in the GDPR and “process”, “processes” and “processed” shall be interpreted accordingly.

1.12. “Security Incident” means any unauthorized or unlawful breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Personal Data.

1.13. “Services” means any product or service provided by ClickGUARD to Customer pursuant to and as more particularly described in the Terms.

1.14. “Sub-processor” means any Processor engaged by ClickGUARD or its Affiliates to assist in fulfilling its obligations with respect to providing the Services pursuant to the Terms or this DPA. Sub-processors may include third parties or any ClickGUARD Affiliate.

2. Scope and Applicability of this DPA

2.1 Application

This DPA applies where and only to the extent that ClickGUARD processes Personal Data on behalf of the Customer in the course of providing the Services and such Personal Data is subject to Data Protection Laws of the European Union, the European Economic Area and/or their member states, Switzerland and/or the United Kingdom. The parties agree to comply with the terms and conditions in this DPA in connection with such Personal Data.

2.2 Role of the Parties

As between ClickGUARD and Customer, Customer is the Controller of Personal Data and ClickGUARD shall process Personal Data only as a Processor on behalf of Customer. Nothing in the Terms or this DPA shall prevent ClickGUARD from using or sharing any data that ClickGUARD would otherwise collect and process independently of Customer’s use of the Services.

2.3 Customer Obligations

Customer agrees that (i) it shall comply with its obligations as a Controller under Data Protection Laws in respect of its processing of Personal Data and any processing instructions it issues to ClickGUARD; and (ii) it has provided notice and obtained (or shall obtain) all consents and rights necessary under Data Protection Laws for ClickGUARD to process Personal Data and provide the Services pursuant to the Terms and this DPA.

2.4 ClickGUARD Processing of Personal Data

2.5 Nature of the Data

ClickGUARD handles Customer Data provided by Customer. Such Customer Data may contain special categories of data depending on how the Services are used by Customer. The Customer Data may be subject to the following process activities: (i) storage and other processing necessary to provide, maintain and improve the Services provided to Customer; (ii) to provide customer and technical support to Customer; and (iii) disclosures as required by law or otherwise set forth in the Terms.

2.6 ClickGUARD Data

Notwithstanding anything to the contrary in the Terms (including this DPA), Customer acknowledges that ClickGUARD shall have a right to use and disclose data relating to and/or obtained in connection with the operation, support and/or use of the Services for its legitimate business purposes, such as billing, account management, technical support, product development and sales and marketing. To the extent any such data is considered personal data under Data Protection Laws, ClickGUARD is the Controller of such data and accordingly shall process such data in compliance with Data Protection Laws.

3. Sub-processing

ClickGUARD uses certain third party sub-processors, subcontractors and content delivery networks to assist it in providing the Services as described in the Terms.

Prior to engaging any third party sub-processor, ClickGUARD performs diligence to evaluate their privacy, security and confidentiality practices, and executes an agreement implementing its applicable obligations.

3.1 Authorized Sub-processors

Customer agrees that ClickGUARD may engage Sub-processors to process Personal Data on Customer’s behalf. The Sub-processors currently engaged by ClickGUARD and authorized by Customer are available here: https://www.clickguard.com/sub-processors.

If Customer has entered into the Model Contract Clauses, the above authorizations constitute Customer’s prior written consent to the subcontracting by ClickGUARD of the processing of Customer Data.

3.2 Sub-processor Obligations

ClickGUARD shall: (i) enter into a written agreement with the Sub-processor imposing data protection terms that require the Sub-processor to protect the Personal Data to the standard required by Data Protection Laws; and (ii) remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Sub-processor that cause ClickGUARD to breach any of its obligations under this DPA.

The Sub-processor only accesses and uses Customer Data to the extent required to perform the obligations subcontracted to it, and does so in accordance with the DPA and the Model Contract Clauses or Alternative Transfer Solution; and if the GDPR applies to the processing of Customer Personal Data, the data protection obligations described in Article 28(3) of the GDPR, as described in the DPA, are imposed on the Subprocessor.

3.3 Changes to Sub-processors

ClickGUARD shall update this DPA if it adds or removes sub-processors. Customers are advised to occasionally re-visit the list of sub-processors available at https://www.clickguard.com/sub-processors to check for changes.

3.4 Objection to Sub-processors

Customer may object in writing to ClickGUARD’s appointment of a new Sub-processor on reasonable grounds relating to data protection by notifying ClickGUARD. Such notice shall explain the reasonable grounds for the objection. In such an event, the parties shall discuss such concerns in good faith with a view to achieving a commercially reasonable resolution. If this is not possible, either party may terminate the applicable Services that cannot be provided by ClickGUARD without the use of the objected-to-new Sub-processor.

4. Security

4.1 Security Measures

ClickGUARD shall implement and maintain appropriate technical and organizational security measures to protect Personal Data from Security Incidents and to preserve the security and confidentiality of the Personal Data, in accordance with ClickGUARD’s security standards described in ClickGUARD’s Security Policy.

4.2 Confidentiality of Processing

ClickGUARD shall ensure that any person who is authorized by ClickGUARD to process Personal Data (including its staff, agents and sub-contractors) shall be under an appropriate obligation of confidentiality (whether a contractual or statutory duty).

4.3 Security Incident Response

Upon becoming aware of a Security Incident, ClickGUARD shall notify Customer without undue delay and shall provide timely information relating to the Security Incident as it becomes known or as is reasonably requested by Customer.

4.4 Updates to Security Measures

Customer acknowledges that the Security Measures are subject to technical progress and development and that ClickGUARD may update or modify the Security Measures from time to time provided that such updates and modifications do not result in the degradation of the overall security of the Services purchased by the Customer.

5. Security Reports and Audits

5.1. Security Documentation

ClickGUARD shall maintain records of its security standards. Upon Customer’s written request, ClickGUARD shall provide (on a confidential basis) copies of relevant external certifications, audit report summaries and/or other documentation reasonably required by Customer to verify ClickGUARD’s compliance with this DPA. ClickGUARD shall further provide written responses (on a confidential basis) to all reasonable requests for information made by Customer, including responses to information security and audit questionnaires, that Customer (acting reasonably) considers necessary to confirm ClickGUARD’s compliance with this DPA, provided that Customer shall not exercise this right more than once per year.

5.2. Model Contract Clauses

If Customer has entered into the Model Contract Clauses, ClickGUARD will allow Customer or an independent auditor appointed by Customer to conduct audits as described in the Model Contract Clauses

6. International Transfers

6.1 Processing Locations

ClickGUARD stores and processes Personal Data under this DPA from the European Union, the European Economic Area and/or their member states and Switzerland (“EU Data”) in data centers located in the United States and therefore outside the European Union. ClickGUARD shall implement appropriate safeguards to protect the Personal Data, wherever it is processed, in accordance with the requirements of Data Protection Laws.

6.2 Transfers of Data

If the storage and/or processing of Customer Personal Data involves transfers of Customer Personal Data from the EEA, Switzerland or the UK to any third country that does not ensure an adequate level of protection under Data Protection Laws, and Data Protection Laws apply to those transfers, then the transfers will be subject to the Model Contract Clauses; and ClickGUARD will ensure that ClickGUARD complies with its obligations under the Model Contract Clauses in respect of those transfers. If Customer does not enter into the Model Contract Clauses, Customer shall apply an Alternative Transfer Solution and notify ClickGUARD about it.

6.3 Disclosure of Confidential Information Containing Personal Data

If Customer has entered into the Model Contract Clauses, ClickGUARD will, notwithstanding any term to the contrary in the DPA, ensure that any disclosure of Customer’s Confidential Information containing personal data, and any notifications relating to any such disclosures, will be made in accordance with such Model Contract Clauses.

7. Return or Deletion of Data

7.1 Data Retention

Upon deactivation of the Services, all Personal Data shall be deleted, save that this requirement shall not apply to the extent ClickGUARD is required by applicable law to retain some or all of the Personal Data, or to Personal Data it has archived on back-up systems, which such Personal Data ClickGUARD shall securely isolate and protect from any further processing, except to the extent required by applicable law.

8. Cooperation

8.1 Reasonable Cooperation

To the extent that Customer is unable to independently access the relevant Personal Data within the Services, ClickGUARD shall (at Customer’s expense) taking into account the nature of the processing, provide reasonable cooperation to assist Customer by appropriate technical and organizational measures, in so far as is possible, to respond to any requests from individuals or applicable data protection authorities relating to the processing of Personal Data under the Terms. In the event that any such request is made directly to ClickGUARD, ClickGUARD shall not respond to such communication directly without Customer’s prior authorization, unless legally compelled to do so. If ClickGUARD is required to respond to such a request, ClickGUARD shall promptly notify Customer and provide it with a copy of the request unless legally prohibited from doing so.

8.2 Data Protection Authority

To the extent ClickGUARD is required under Data Protection Law, ClickGUARD shall (at Customer’s expense) provide reasonably requested information regarding ClickGUARD’s processing of Personal Data under the Terms to enable the Customer to carry out data protection impact assessments or prior consultations with data protection authorities as required by law.

9. Miscellaneous

9.1 Terms of Service Prevalence

Except for the changes made by this DPA, the Terms remain unchanged and in full force and effect. If there is any conflict between this DPA and the Terms, this DPA shall prevail to the extent of that conflict.

9.2 Integral to Terms

This DPA is a part of and incorporated into the Terms so references to “Terms” in the Terms shall include this DPA.

9.3 Liability

In no event shall any party limit its liability with respect to any individual’s data protection rights under this DPA or otherwise.

9.4 Governing

This DPA shall be governed by and construed in accordance with governing law and jurisdiction provisions in the Terms, unless required otherwise by Data Protection Laws.

ANNEX STANDARD CONTRACTUAL CLAUSES

SECTION I
Clause 1
Purpose and scope
The purpose of these standard contractual clauses is to ensure compliance withthe requirements of Regulation (EU) 2016/679 of the European Parliament and ofthe Council of 27 April 2016 on the protection of natural persons with regardto the processing of personal data and on the free movement of such data(General Data Protection Regulation) for the transfer of personal data to athird country.
The Parties:
the natural or legal person(s), public authority/ies, agency/ies or otherbody/ies (hereinafter “entity/ies”) transferring the personal data, as listedin Annex I.A. (hereinafter each “data exporter”), and
the entity/ies in a third country receiving the personal data from the dataexporter, directly or indirectly via another entity also Party to these Clauses,as listed in Annex I.A. (hereinafter each “data importer”)
have agreed to these standard contractual clauses (hereinafter: “Clauses”).
These Clauses apply with respect to the transfer of personal data as specifiedin Annex I.B.
The Appendix to these Clauses containing the Annexes referred to therein formsan integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses
These Clauses set out appropriate safeguards, including enforceable datasubject rights and effective legal remedies, pursuant to Article 46(1) andArticle 46 (2)(c) of Regulation (EU) 2016/679 and, with respect to datatransfers from controllers to processors and/or processors to processors,standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679,provided they are not modified, except to select the appropriate Module(s) orto add or update information in the Appendix. This does not prevent the Partiesfrom including the standard contractual clauses laid down in these Clauses in awider contract and/or to add other clauses or additional safeguards, providedthat they do not contradict, directly or indirectly, these Clauses or prejudicethe fundamental rights or freedoms of data subjects.
These Clauses are without prejudice to obligations to which the data exporteris subject by virtue of Regulation (EU) 2016/679.
Clause 3
Third-party beneficiaries
Data subjects may invoke and enforce these Clauses, as third-partybeneficiaries, against the data exporter and/or data importer, with thefollowing exceptions:
Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
Clause 8 - Module One: Clause 8.5 (e) and Clause 8.9(b); Module Two: Clause8.1(b), 8.9(a), (c), (d) and (e); Module Three: Clause 8.1(a), (c) and (d) andClause 8.9(a), (c), (d), (e), (f) and (g); Module Four: Clause 8.1 (b) andClause 8.3(b);
Clause 9 - Module Two: Clause 9(a), (c), (d) and (e); Module Three: Clause9(a), (c), (d) and (e);
Clause 12 - Module One: Clause 12(a) and (d); Modules Two and Three: Clause12(a), (d) and (f);
Clause 13;
Clause 15.1(c), (d) and (e);
Clause 16(e);
Clause 18 - Modules One, Two and Three: Clause 18(a) and (b); Module Four:Clause 18.
Paragraph (a) is without prejudice to rights of data subjects under Regulation(EU) 2016/679.
Clause 4
Interpretation
Where these Clauses use terms that are defined in Regulation (EU) 2016/679,those terms shall have the same meaning as in that Regulation.
These Clauses shall be read and interpreted in the light of the provisions ofRegulation (EU) 2016/679.
These Clauses shall not be interpreted in a way that conflicts with rights andobligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions ofrelated agreements between the Parties, existing at the time these Clauses areagreed or entered into thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personaldata that are transferred and the purpose(s) for which they are transferred,are specified in Annex I.B.
Clause 7 - Optional
Docking clause
An entity that is not a Party to these Clauses may, with the agreement of theParties, accede to these Clauses at any time, either as a data exporter or as adata importer, by completing the Appendix and signing Annex I.A.
Once it has completed the Appendix and signed Annex I.A, the acceding entityshall become a Party to these Clauses and have the rights and obligations of adata exporter or data importer in accordance with its designation in Annex I.A.
The acceding entity shall have no rights or obligations arising under theseClauses from the period prior to becoming a Party.
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determinethat the data importer is able, through the implementation of appropriatetechnical and organizational measures, to satisfy its obligations under theseClauses.
MODULE TWO: Transfer controller to processor
8.1 Instructions
The data importer shall process the personal data only on documentedinstructions from the data exporter. The data exporter may give suchinstructions throughout the duration of the contract.
The data importer shall immediately inform the data exporter if it is unable tofollow those instructions.
8.2 Purpose limitation
The data importer shall process the personal data only for the specificpurpose(s) of the transfer, as set out in Annex I.B, unless on furtherinstructions from the data exporter.
8.3 Transparency
On request, the data exporter shall make a copy of these Clauses, including theAppendix as completed by the Parties, available to the data subject free ofcharge. To the extent necessary to protect business secrets or otherconfidential information, including the measures described in Annex II andpersonal data, the data exporter may redact part of the text of the Appendix tothese Clauses prior to sharing a copy, but shall provide a meaningful summarywhere the data subject would otherwise not be able to understand the itscontent or exercise his/her rights. On request, the Parties shall provide thedata subject with the reasons for the redactions, to the extent possiblewithout revealing the redacted information. This Clause is without prejudice tothe obligations of the data exporter under Articles 13 and 14 of Regulation(EU) 2016/679.
8.4 Accuracy
If the data importer becomes aware that the personal data it has received isinaccurate, or has become outdated, it shall inform the data exporter withoutundue delay. In this case, the data importer shall cooperate with the dataexporter to erase or rectify the data.
8.5 Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the durationspecified in Annex I.B. After the end of the provision of the processingservices, the data importer shall, at the choice of the data exporter, deleteall personal data processed on behalf of the data exporter and certify to the dataexporter that it has done so, or return to the data exporter all personal dataprocessed on its behalf and delete existing copies. Until the data is deletedor returned, the data importer shall continue to ensure compliance with theseClauses. In case of local laws applicable to the data importer that prohibitreturn or deletion of the personal data, the data importer warrants that itwill continue to ensure compliance with these Clauses and will only process itto the extent and for as long as required under that local law. This is withoutprejudice to Clause 14, in particular the requirement for the data importerunder Clause 14(e) to notify the data exporter throughout the duration of thecontract if it has reason to believe that it is or has become subject to lawsor practices not in line with the requirements under Clause 14(a).
8.6 Security of processing
The data importer and, during transmission, also the data exporter shallimplement appropriate technical and organizational measures to ensure the securityof the data, including protection against a breach of security leading toaccidental or unlawful destruction, loss, alteration, unauthorized disclosureor access to that data (hereinafter “personal data breach”). In assessing theappropriate level of security, the Parties shall take due account of the stateof the art, the costs of implementation, the nature, scope, context andpurpose(s) of processing and the risks involved in the processing for the datasubjects. The Parties shall in particular consider having recourse toencryption or pseudonymisation, including during transmission, where thepurpose of processing can be fulfilled in that manner. In case ofpseudonymisation, the additional information for attributing the personal datato a specific data subject shall, where possible, remain under the exclusivecontrol of the data exporter. In complying with its obligations under thisparagraph, the data importer shall at least implement the technical andorganizational measures specified in Annex II. The data importer shall carryout regular checks to ensure that these measures continue to provide anappropriate level of security.
The data importer shall grant access to the personal data to members of itspersonnel only to the extent strictly necessary for the implementation,management and monitoring of the contract. It shall ensure that personsauthorized to process the personal data have committed themselves toconfidentiality or are under an appropriate statutory obligation ofconfidentiality.
In the event of a personal data breach concerning personal data processed bythe data importer under these Clauses, the data importer shall take appropriatemeasures to address the breach, including measures to mitigate its adverseeffects. The data importer shall also notify the data exporter without unduedelay after having become aware of the breach. Such notification shall containthe details of a contact point where more information can be obtained, adescription of the nature of the breach (including, where possible, categoriesand approximate number of data subjects and personal data records concerned),its likely consequences and the measures taken or proposed to address thebreach including, where appropriate, measures to mitigate its possible adverse effects.Where, and in so far as, it is not possible to provide all information at thesame time, the initial notification shall contain the information thenavailable and further information shall, as it becomes available, subsequentlybe provided without undue delay.
The data importer shall cooperate with and assist the data exporter to enablethe data exporter to comply with its obligations under Regulation (EU)2016/679, in particular to notify the competent supervisory authority and theaffected data subjects, taking into account the nature of processing and theinformation available to the data importer.
8.7 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin,political opinions, religious or philosophical beliefs, or trade unionmembership, genetic data, or biometric data for the purpose of uniquelyidentifying a natural person, data concerning health or a person’s sex life orsexual orientation, or data relating to criminal convictions and offences(hereinafter “sensitive data”), the data importer shall apply the specificrestrictions and/or additional safeguards described in Annex I.B.
8.8 Onward transfers
The data importer shall only disclose the personal data to a third party ondocumented instructions from the data exporter. In addition, the data may onlybe disclosed to a third party located outside the European Union (in the samecountry as the data importer or in another third country, hereinafter “onwardtransfer”) if the third party is or agrees to be bound by these Clauses, underthe appropriate Module, or if:
the onward transfer is to a country benefiting from an adequacy decisionpursuant to Article 45 of Regulation (EU) 2016/679 that covers the onwardtransfer;
the third party otherwise ensures appropriate safeguards pursuant to Articles46 or 47 Regulation of (EU) 2016/679 with respect to the processing inquestion;
the onward transfer is necessary for the establishment, exercise or defense oflegal claims in the context of specific administrative, regulatory or judicialproceedings; or
the onward transfer is necessary in order to protect the vital interests of thedata subject or of another natural person.
Any onward transfer is subject to compliance by the data importer with all theother safeguards under these Clauses, in particular purpose limitation.
8.9 Documentation and compliance
The data importer shall promptly and adequately deal with enquiries from thedata exporter that relate to the processing under these Clauses.
The Parties shall be able to demonstrate compliance with these Clauses. Inparticular, the data importer shall keep appropriate documentation on theprocessing activities carried out on behalf of the data exporter.
The data importer shall make available to the data exporter all informationnecessary to demonstrate compliance with the obligations set out in theseClauses and at the data exporter’s request, allow for and contribute to auditsof the processing activities covered by these Clauses, at reasonable intervalsor if there are indications of non-compliance. In deciding on a review oraudit, the data exporter may take into account relevant certifications held bythe data importer.
The data exporter may choose to conduct the audit by itself or mandate anindependent auditor. Audits may include inspections at the premises or physicalfacilities of the data importer and shall, where appropriate, be carried outwith reasonable notice.
The Parties shall make the information referred to in paragraphs (b) and (c),including the results of any audits, available to the competent supervisoryauthority on request.
MODULE THREE: Transfer processor to processor
8.1 Instructions
The data exporter has informed the data importer that it acts as processorunder the instructions of its controller(s), which the data exporter shall makeavailable to the data importer prior to processing.
The data importer shall process the personal data only on documentedinstructions from the controller, as communicated to the data importer by thedata exporter, and any additional documented instructions from the dataexporter. Such additional instructions shall not conflict with the instructionsfrom the controller. The controller or data exporter may give furtherdocumented instructions regarding the data processing throughout the durationof the contract.
The data importer shall immediately inform the data exporter if it is unable tofollow those instructions. Where the data importer is unable to follow theinstructions from the controller, the data exporter shall immediately notifythe controller.
The data exporter warrants that it has imposed the same data protectionobligations on the data importer as set out in the contract or other legal actunder Union or Member State law between the controller and the data exporter.
8.2 Purpose limitation
The data importer shall process the personal data only for the specificpurpose(s) of the transfer, as set out in Annex I.B., unless on furtherinstructions from the controller, as communicated to the data importer by thedata exporter, or from the data exporter.
8.3 Transparency
On request, the data exporter shall make a copy of these Clauses, including theAppendix as completed by the Parties, available to the data subject free ofcharge. To the extent necessary to protect business secrets or otherconfidential information, including personal data, the data exporter may redactpart of the text of the Appendix prior to sharing a copy, but shall provide ameaningful summary where the data subject would otherwise not be able to understandits content or exercise his/her rights. On request, the Parties shall providethe data subject with the reasons for the redactions, to the extent possiblewithout revealing the redacted information.
8.4 Accuracy
If the data importer becomes aware that the personal data it has received isinaccurate, or has become outdated, it shall inform the data exporter withoutundue delay. In this case, the data importer shall cooperate with the dataexporter to rectify or erase the data.
8.5 Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the durationspecified in Annex I.B. After the end of the provision of the processingservices, the data importer shall, at the choice of the data exporter, delete allpersonal data processed on behalf of the controller and certify to the dataexporter that it has done so, or return to the data exporter all personal dataprocessed on its behalf and delete existing copies. Until the data is deletedor returned, the data importer shall continue to ensure compliance with theseClauses. In case of local laws applicable to the data importer that prohibitreturn or deletion of the personal data, the data importer warrants that itwill continue to ensure compliance with these Clauses and will only process itto the extent and for as long as required under that local law. This is withoutprejudice to Clause 14, in particular the requirement for the data importerunder Clause 14(e) to notify the data exporter throughout the duration of thecontract if it has reason to believe that it is or has become subject to lawsor practices not in line with the requirements under Clause 14(a).
8.6 Security of processing
The data importer and, during transmission, also the data exporter shallimplement appropriate technical and organizational measures to ensure thesecurity of the data, including protection against a breach of security leadingto accidental or unlawful destruction, loss, alteration, unauthorizeddisclosure or access to that data (hereinafter “personal data breach”). Inassessing the appropriate level of security, they shall take due account of thestate of the art, the costs of implementation, the nature, scope, context andpurpose(s) of processing and the risks involved in the processing for the datasubject. The Parties shall in particular consider having recourse to encryptionor pseudonymisation, including during transmission, where the purpose ofprocessing can be fulfilled in that manner. In case of pseudonymisation, the additionalinformation for attributing the personal data to a specific data subject shall,where possible, remain under the exclusive control of the data exporter or thecontroller. In complying with its obligations under this paragraph, the dataimporter shall at least implement the technical and organizational measuresspecified in Annex II. The data importer shall carry out regular checks toensure that these measures continue to provide an appropriate level ofsecurity.
The data importer shall grant access to the data to members of its personnelonly to the extent strictly necessary for the implementation, management andmonitoring of the contract. It shall ensure that persons authorized to processthe personal data have committed themselves to confidentiality or are under anappropriate statutory obligation of confidentiality.
In the event of a personal data breach concerning personal data processed bythe data importer under these Clauses, the data importer shall take appropriatemeasures to address the breach, including measures to mitigate its adverseeffects. The data importer shall also notify, without undue delay, the dataexporter and, where appropriate and feasible, the controller after havingbecome aware of the breach. Such notification shall contain the details of acontact point where more information can be obtained, a description of thenature of the breach (including, where possible, categories and approximatenumber of data subjects and personal data records concerned), its likelyconsequences and the measures taken or proposed to address the data breach,including measures to mitigate its possible adverse effects. Where, and in sofar as, it is not possible to provide all information at the same time, theinitial notification shall contain the information then available and furtherinformation shall, as it becomes available, subsequently be provided withoutundue delay.
The data importer shall cooperate with and assist the data exporter to enablethe data exporter to comply with its obligations under Regulation (EU)2016/679, in particular to notify its controller so that the latter may in turnnotify the competent supervisory authority and the affected data subjects,taking into account the nature of processing and the information available tothe data importer.
8.7 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin,political opinions, religious or philosophical beliefs, or trade unionmembership, genetic data, or biometric data for the purpose of uniquelyidentifying a natural person, data concerning health or a person’s sex life orsexual orientation, or data relating to criminal convictions and offences(hereinafter “sensitive data”), the data importer shall apply the specificrestrictions and/or additional safeguards set out in Annex I.B.
8.8 Onward transfers
The data importer shall only disclose the personal data to a third party ondocumented instructions from the controller, as communicated to the dataimporter by the data exporter. In addition, the data may only be disclosed to athird party located outside the European Union (in the same country as the dataimporter or in another third country, hereinafter “onward transfer”) if thethird party is or agrees to be bound by these Clauses, under the appropriateModule, or if:
the onward transfer is to a country benefiting from an adequacy decisionpursuant to Article 45 of Regulation (EU) 2016/679 that covers the onwardtransfer;
the third party otherwise ensures appropriate safeguards pursuant to Articles46 or 47 of Regulation (EU) 2016/679;
the onward transfer is necessary for the establishment, exercise or defense oflegal claims in the context of specific administrative, regulatory or judicial proceedings; or
the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.
Any onward transfer is subject to compliance by the data importer with all theother safeguards under these Clauses, in particular purpose limitation.
8.9 Documentation and compliance
The data importer shall promptly and adequately deal with enquiries from the data exporter or the controller that relate to the processing under these Clauses.
The Parties shall be able to demonstrate compliance with these Clauses. Inparticular, the data importer shall keep appropriate documentation on theprocessing activities carried out on behalf of the controller.
The data importer shall make all information necessary to demonstratecompliance with the obligations set out in these Clauses available to the dataexporter, which shall provide it to the controller.
The data importer shall allow for and contribute to audits by the data exporterof the processing activities covered by these Clauses, at reasonable intervalsor if there are indications of non-compliance. The same shall apply where thedata exporter requests an audit on instructions of the controller. In decidingon an audit, the data exporter may take into account relevant certificationsheld by the data importer.
Where the audit is carried out on the instructions of the controller, the dataexporter shall make the results available to the controller.
The data exporter may choose to conduct the audit by itself or mandate anindependent auditor. Audits may include inspections at the premises or physicalfacilities of the data importer and shall, where appropriate, be carried outwith reasonable notice.
The Parties shall make the information referred to in paragraphs (b) and (c),including the results of any audits, available to the competent supervisoryauthority on request.
Clause 9
Use of sub-processors
MODULE TWO: Transfer controller to processor
OPTION 2: GENERAL WRITTEN AUTHORISATION The data importer has the dataexporter’s general authorisation for the engagement of sub-processor(s) from anagreed list. The data importer shall specifically inform the data exporter inwriting of any intended changes to that list through the addition orreplacement of sub-processors at least seven days in advance, thereby givingthe data exporter sufficient time to be able to object to such changes prior tothe engagement of the sub-processor(s). The data importer shall provide thedata exporter with the information necessary to enable the data exporter toexercise its right to object.
Where the data importer engages a sub-processor to carry out specificprocessing activities (on behalf of the data exporter), it shall do so by wayof a written contract that provides for, in substance, the same data protectionobligations as those binding the data importer under these Clauses, includingin terms of third-party beneficiary rights for data subjects. The Parties agreethat, by complying with this Clause, the data importer fulfills its obligationsunder Clause 8.8. The data importer shall ensure that the sub-processorcomplies with the obligations to which the data importer is subject pursuant tothese Clauses.
The data importer shall provide, at the data exporter’s request, a copy of sucha sub-processor agreement and any subsequent amendments to the data exporter.To the extent necessary to protect business secrets or other confidentialinformation, including personal data, the data importer may redact the text ofthe agreement prior to sharing a copy.
The data importer shall remain fully responsible to the data exporter for theperformance of the sub-processor’s obligations under its contract with the dataimporter. The data importer shall notify the data exporter of any failure bythe sub-processor to fulfill its obligations under that contract.
The data importer shall agree a third-party beneficiary clause with thesub-processor whereby - in the event the data importer has factuallydisappeared, ceased to exist in law or has become insolvent - the data exportershall have the right to terminate the sub-processor contract and to instructthe sub-processor to erase or return the personal data.
MODULE THREE: Transfer processor to processor
The data importer has the controller’s general authorisation for the engagementof sub-processor(s) from an agreed list. The data importer shall specificallyinform the controller in writing of any intended changes to that list throughthe addition or replacement of sub-processors at least 15 days in advance,thereby giving the controller sufficient time to be able to object to suchchanges prior to the engagement of the sub-processor(s). The data importershall provide the controller with the information necessary to enable thecontroller to exercise its right to object. The data importer shall inform thedata exporter of the engagement of the sub-processor(s).
Where the data importer engages a sub-processor to carry out specificprocessing activities (on behalf of the controller), it shall do so by way of awritten contract that provides for, in substance, the same data protectionobligations as those binding the data importer under these Clauses, includingin terms of third-party beneficiary rights for data subjects. The Parties agreethat, by complying with this Clause, the data importer fulfills its obligationsunder Clause 8.8. The data importer shall ensure that the sub-processorcomplies with the obligations to which the data importer is subject pursuant tothese Clauses.
The data importer shall provide, at the data exporter’s or controller’srequest, a copy of such a sub-processor agreement and any subsequentamendments. To the extent necessary to protect business secrets or otherconfidential information, including personal data, the data importer may redactthe text of the agreement prior to sharing a copy.
The data importer shall remain fully responsible to the data exporter for theperformance of the sub-processor’s obligations under its contract with the dataimporter. The data importer shall notify the data exporter of any failure bythe sub-processor to fulfill its obligations under that contract.
The data importer shall agree a third-party beneficiary clause with thesub-processor whereby - in the event the data importer has factuallydisappeared, ceased to exist in law or has become insolvent - the data exportershall have the right to terminate the sub-processor contract and to instructthe sub-processor to erase or return the personal data.
Clause 10
Data subject rights
MODULE TWO: Transfer controller to processor
The data importer shall promptly notify the data exporter of any request it hasreceived from a data subject. It shall not respond to that request itselfunless it has been authorized to do so by the data exporter.
The data importer shall assist the data exporter in fulfilling its obligationsto respond to data subjects’ requests for the exercise of their rights underRegulation (EU) 2016/679. In this regard, the Parties shall set out in Annex IIthe appropriate technical and organizational measures, taking into account thenature of the processing, by which the assistance shall be provided, as well asthe scope and the extent of the assistance required.
In fulfilling its obligations under paragraphs (a) and (b), the data importershall comply with the instructions from the data exporter.
MODULE THREE: Transfer processor to processor
The data importer shall promptly notify the data exporter and, whereappropriate, the controller of any request it has received from a data subject,without responding to that request unless it has been authorized to do so by thecontroller.
The data importer shall assist, where appropriate in cooperation with the dataexporter, the controller in fulfilling its obligations to respond to datasubjects’ requests for the exercise of their rights under Regulation (EU)2016/679 or Regulation (EU) 2018/1725, as applicable. In this regard, theParties shall set out in Annex II the appropriate technical and organizationalmeasures, taking into account the nature of the processing, by which theassistance shall be provided, as well as the scope and the extent of theassistance required.
In fulfilling its obligations under paragraphs (a) and (b), the data importershall comply with the instructions from the controller, as communicated by thedata exporter.
Clause 11
Redress
The data importer shall inform data subjects in a transparent and easilyaccessible format, through individual notice or on its website, of a contactpoint authorised to handle complaints. It shall deal promptly with anycomplaints it receives from a data subject.
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
In case of a dispute between a data subject and one of the Parties as regardscompliance with these Clauses, that Party shall use its best efforts to resolvethe issue amicably in a timely fashion. The Parties shall keep each otherinformed about such disputes and, where appropriate, cooperate in resolvingthem.
Where the data subject invokes a third-party beneficiary right pursuant toClause 3, the data importer shall accept the decision of the data subject to:
lodge a complaint with the supervisory authority in the Member State of his/herhabitual residence or place of work, or the competent supervisory authoritypursuant to Clause 13;
refer the dispute to the competent courts within the meaning of Clause 18.
The Parties accept that the data subject may be represented by a not-for-profitbody, organization or association under the conditions set out in Article 80(1)of Regulation (EU) 2016/679.
The data importer shall abide by a decision that is binding under theapplicable EU or Member State law.
The data importer agrees that the choice made by the data subject will notprejudice his/her substantive and procedural rights to seek remedies inaccordance with applicable laws.
Clause 12
Liability
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
Each Party shall be liable to the other Party/ies for any damages it causes theother Party/ies by any breach of these Clauses.
The data importer shall be liable to the data subject, and the data subjectshall be entitled to receive compensation, for any material or non-materialdamages the data importer or its sub-processor causes the data subject bybreaching the third-party beneficiary rights under these Clauses.
Notwithstanding paragraph (b), the data exporter shall be liable to the datasubject, and the data subject shall be entitled to receive compensation, forany material or non-material damages the data exporter or the data importer (orits sub-processor) causes the data subject by breaching the third-partybeneficiary rights under these Clauses. This is without prejudice to theliability of the data exporter and, where the data exporter is a processoracting on behalf of a controller, to the liability of the controller underRegulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
The Parties agree that if the data exporter is held liable under paragraph (c)for damages caused by the data importer (or its sub-processor), it shall beentitled to claim back from the data importer that part of the compensationcorresponding to the data importer’s responsibility for the damage.
Where more than one Party is responsible for any damage caused to the datasubject as a result of a breach of these Clauses, all responsible Parties shallbe jointly and severally liable and the data subject is entitled to bring anaction in court against any of these Parties.
The Parties agree that if one Party is held liable under paragraph (e), itshall be entitled to claim back from the other Party/ies that part of thecompensation corresponding to its / their responsibility for the damage.
The data importer may not invoke the conduct of a sub-processor to avoid itsown liability.
Clause 13
Supervision
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
[Where the data exporter is established in an EU Member State:] The supervisoryauthority with responsibility for ensuring compliance by the data exporter withRegulation (EU) 2016/679 as regards the data transfer, as indicated in AnnexI.C, shall act as competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but fallswithin the territorial scope of application of Regulation (EU) 2016/679 inaccordance with its Article 3(2) and has appointed a representative pursuant toArticle 27(1) of Regulation (EU) 2016/679:] The supervisory authority of theMember State in which the representative within the meaning of Article 27(1) ofRegulation (EU) 2016/679 is established, as indicated in Annex I.C, shall actas competent supervisory authority.
[Where the data exporter is not established in an EU Member State, but fallswithin the territorial scope of application of Regulation (EU) 2016/679 inaccordance with its Article 3(2) without however having to appoint arepresentative pursuant to Article 27(2) of Regulation (EU) 2016/679:] Thesupervisory authority of one of the Member States in which the data subjectswhose personal data is transferred under these Clauses in relation to theoffering of goods or services to them, or whose behavior is monitored, arelocated, as indicated in Annex I.C, shall act as competent supervisoryauthority.
The data importer agrees to submit itself to the jurisdiction of and cooperatewith the competent supervisory authority in any procedures aimed at ensuringcompliance with these Clauses. In particular, the data importer agrees torespond to enquiries, submit to audits and comply with the measures adopted bythe supervisory authority, including remedial and compensatory measures. Itshall provide the supervisory authority with written confirmation that thenecessary actions have been taken.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14
Local laws and practices affecting compliance with the Clauses
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
The Parties warrant that they have no reason to believe that the laws andpractices in the third country of destination applicable to the processing ofthe personal data by the data importer, including any requirements to disclosepersonal data or measures authorizing access by public authorities, prevent thedata importer from fulfilling its obligations under these Clauses. This isbased on the understanding that laws and practices that respect the essence ofthe fundamental rights and freedoms and do not exceed what is necessary andproportionate in a democratic society to safeguard one of the objectives listedin Article 23(1) of Regulation (EU) 2016/679, are not in contradiction withthese Clauses.
The Parties declare that in providing the warranty in paragraph (a), they havetaken due account in particular of the following elements:
the specific circumstances of the transfer, including the length of theprocessing chain, the number of actors involved and the transmission channelsused; intended onward transfers; the type of recipient; the purpose ofprocessing; the categories and format of the transferred personal data; theeconomic sector in which the transfer occurs; the storage location of the datatransferred;
the laws and practices of the third country of destination– including thoserequiring the disclosure of data to public authorities or authorizing access bysuch authorities – relevant in light of the specific circumstances of thetransfer, and the applicable limitations and safeguards;
any relevant contractual, technical or organizational safeguards put in placeto supplement the safeguards under these Clauses, including measures appliedduring transmission and to the processing of the personal data in the countryof destination.
The data importer warrants that, in carrying out the assessment under paragraph(b), it has made its best efforts to provide the data exporter with relevantinformation and agrees that it will continue to cooperate with the dataexporter in ensuring compliance with these Clauses.
The Parties agree to document the assessment under paragraph (b) and make it availableto the competent supervisory authority on request.
The data importer agrees to notify the data exporter promptly if, after havingagreed to these Clauses and for the duration of the contract, it has reason tobelieve that it is or has become subject to laws or practices not in line withthe requirements under paragraph (a), including following a change in the lawsof the third country or a measure (such as a disclosure request) indicating anapplication of such laws in practice that is not in line with the requirementsin paragraph (a). [For Module Three: The data exporter shall forward thenotification to the controller.]
Following a notification pursuant to paragraph (e), or if the data exporterotherwise has reason to believe that the data importer can no longer fulfillits obligations under these Clauses, the data exporter shall promptly identifyappropriate measures (e.g. technical or organizational measures to ensuresecurity and confidentiality) to be adopted by the data exporter and/or data importerto address the situation [for Module Three: , if appropriate in consultationwith the controller]. The data exporter shall suspend the data transfer if itconsiders that no appropriate safeguards for such transfer can be ensured, orif instructed by [for Module Three: the controller or] the competentsupervisory authority to do so. In this case, the data exporter shall beentitled to terminate the contract, insofar as it concerns the processing ofpersonal data under these Clauses. If the contract involves more than twoParties, the data exporter may exercise this right to termination only withrespect to the relevant Party, unless the Parties have agreed otherwise. Wherethe contract is terminated pursuant to this Clause, Clause 16(d) and (e) shallapply.
Clause 15
Obligations of the data importer in case of access by public authorities
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
15.1 Notification
The data importer agrees to notify the data exporter and, where possible, thedata subject promptly (if necessary with the help of the data exporter) if it:
receives a legally binding request from a public authority, including judicialauthorities, under the laws of the country of destination for the disclosure ofpersonal data transferred pursuant to these Clauses; such notification shallinclude information about the personal data requested, the requestingauthority, the legal basis for the request and the response provided; or
becomes aware of any direct access by public authorities to personal datatransferred pursuant to these Clauses in accordance with the laws of thecountry of destination; such notification shall include all informationavailable to the importer.
[For Module Three: The data exporter shall forward the notification to thecontroller.]
If the data importer is prohibited from notifying the data exporter and/or thedata subject under the laws of the country of destination, the data importeragrees to use its best efforts to obtain a waiver of the prohibition, with aview to communicating as much information as possible, as soon as possible. Thedata importer agrees to document its best efforts in order to be able todemonstrate them on request of the data exporter.
Where permissible under the laws of the country of destination, the dataimporter agrees to provide the data exporter, at regular intervals for theduration of the contract, with as much relevant information as possible on therequests received (in particular, number of requests, type of data requested,requesting authority/ies, whether requests have been challenged and the outcomeof such challenges, etc.). [For Module Three: The data exporter shall forwardthe information to the controller.]
The data importer agrees to preserve the information pursuant to paragraphs (a)to (c) for the duration of the contract and make it available to the competentsupervisory authority on request.
Paragraphs (a) to (c) are without prejudice to the obligation of the dataimporter pursuant to Clause 14(e) and Clause 16 to inform the data exporterpromptly where it is unable to comply with these Clauses.
15.2 Review of legality and data minimisation
The data importer agrees to review the legality of the request for disclosure,in particular whether it remains within the powers granted to the requestingpublic authority, and to challenge the request if, after careful assessment, itconcludes that there are reasonable grounds to consider that the request isunlawful under the laws of the country of destination, applicable obligationsunder international law and principles of international comity. The dataimporter shall, under the same conditions, pursue possibilities of appeal. Whenchallenging a request, the data importer shall seek interim measures with a viewto suspending the effects of the request until the competent judicial authorityhas decided on its merits. It shall not disclose the personal data requesteduntil required to do so under the applicable procedural rules. Theserequirements are without prejudice to the obligations of the data importerunder Clause 14(e).
The data importer agrees to document its legal assessment and any challenge tothe request for disclosure and, to the extent permissible under the laws of thecountry of destination, make the documentation available to the data exporter.It shall also make it available to the competent supervisory authority onrequest. [For Module Three: The data exporter shall make the assessmentavailable to the controller.]
The data importer agrees to provide the minimum amount of informationpermissible when responding to a request for disclosure, based on a reasonableinterpretation of the request.
SECTION IV – FINAL PROVISIONS
Clause 16
Non-compliance with the Clauses and termination
The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
In the event that the data importer is in breach of these Clauses or unable tocomply with these Clauses, the data exporter shall suspend the transfer ofpersonal data to the data importer until compliance is again ensured or thecontract is terminated. This is without prejudice to Clause 14(f).
The data exporter shall be entitled to terminate the contract, insofar as itconcerns the processing of personal data under these Clauses, where:
the data exporter has suspended the transfer of personal data to the dataimporter pursuant to paragraph (b) and compliance with these Clauses is notrestored within a reasonable time and in any event within one month ofsuspension;
the data importer is in substantial or persistent breach of these Clauses; or
the data importer fails to comply with a binding decision of a competent courtor supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority [for ModuleThree: and the controller] of such non-compliance. Where the contract involvesmore than two Parties, the data exporter may exercise this right to terminationonly with respect to the relevant Party, unless the Parties have agreedotherwise.
[For Modules One, Two and Three: Personal data that has been transferred priorto the termination of the contract pursuant to paragraph (c) shall at thechoice of the data exporter immediately be returned to the data exporter ordeleted in its entirety. The same shall apply to any copies of the data.] [ForModule Four: Personal data collected by the data exporter in the EU that hasbeen transferred prior to the termination of the contract pursuant to paragraph(c) shall immediately be deleted in its entirety, including any copy thereof.]The data importer shall certify the deletion of the data to the data exporter.Until the data is deleted or returned, the data importer shall continue toensure compliance with these Clauses. In case of local laws applicable to thedata importer that prohibit the return or deletion of the transferred personaldata, the data importer warrants that it will continue to ensure compliancewith these Clauses and will only process the data to the extent and for as longas required under that local law.
Either Party may revoke its agreement to be bound by these Clauses where (i)the European Commission adopts a decision pursuant to Article 45(3) ofRegulation (EU) 2016/679 that covers the transfer of personal data to whichthese Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legalframework of the country to which the personal data is transferred. This iswithout prejudice to other obligations applying to the processing in questionunder Regulation (EU) 2016/679.
Clause 17
Governing law
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
These Clauses shall be governed by the law of one of the EU Member States,provided such law allows for third-party beneficiary rights. The Parties agreethat this shall be the law of Ireland.
Clause 18
Choice of forum and jurisdiction
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
Any dispute arising from these Clauses shall be resolved by the courts of an EUMember State.
The Parties agree that those shall be the courts of Ireland.
A data subject may also bring legal proceedings against the data exporterand/or data importer before the courts of the Member State in which he/she hashis/her habitual residence.
The Parties agree to submit themselves to the jurisdiction of such courts.
APPENDIX
EXPLANATORY NOTE:
It must be possible to clearly distinguish the information applicable to eachtransfer or category of transfers and, in this regard, to determine therespective role(s) of the Parties as data exporter(s) and/or data importer(s).This does not necessarily require completing and signing separate appendicesfor each transfer/category of transfers and/or contractual relationship, wherethis transparency can achieved through one appendix. However, where necessaryto ensure sufficient clarity, separate appendices should be used.
ANNEX I
A. LIST OF PARTIES
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
Data exporter(s):
Name:
Customer
Address:
As specified within the customer Account used with Services.
Contact person’s name, position and contact details:
Contact details for the data exporter are specified within the customer Accountused with Services. Details about the data exporter’s data protection officerare available to the data importer in the Admin Console (where such detailshave been provided by the data exporter).
Activities relevant to the data transferred under these Clauses:
The data importer provides the Services to the data exporter in accordance withthe Agreement.
Signature and date:
The parties agree that execution of the Terms and this DPA shall constituteexecution of these Clauses by both parties.
Role (controller/processor):
controller
Data importer(s):
Name:
ClickGuard
Address:
1931 CORDOVA RD #3114, Fort Lauderdale, FL 33316, United States of America
Contact person’s name, position and contact details:
The data importer’s data protection team can be contacted viahttps://www.clickguard.com/contact-us.
Activities relevant to the data transferred under these Clauses:
The data importer provides the Services to the data exporter in accordance withthe Terms and DPA.
Signature and date:
The parties agree that execution of the Terms and this DPA shall constituteexecution of these Clauses by both parties.
Role (controller/processor):
processor
B. DESCRIPTION OF TRANSFER
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
Categories of data subjects whose personal data is transferred
Data that Visitors / Customers provided to ClickGUARD via the Services of thedata exporter.
Categories of personal data transferred
Data relating to individuals provided to ClickGUARD via the Services by dataexporter.
Sensitive data transferred (if applicable) and applied restrictions orsafeguards that fully take into consideration the nature of the data and therisks involved, such as for instance strict purpose limitation, accessrestrictions (including access only for staff having followed specializedtraining), keeping a record of access to the data, restrictions for onwardtransfers or additional security measures.
No sensitive data is transferred.
The frequency of the transfer (e.g. whether the data is transferred on aone-off or continuous basis).
Data is transferred on a continuous basis.
Nature of the processing
Data is collected, organized, structured, stored and analyzed, disclosed bytransmission and made available to the data controller / data processor, aswell as deleted after its retention period expires.
Purpose(s) of the data transfer and further processing
The legitimate purpose is performance of a contract.
The period for which the personal data will be retained, or, if that is notpossible, the criteria used to determine that period
Term of data processing. Data processing will be for the period specified inthe DPA. Such period will automatically terminate upon the deletion by the DataImporter of all data as described in the DPA.
For transfers to (sub-) processors, also specify subject matter, nature andduration of the processing
As above.
C. COMPETENT SUPERVISORY AUTHORITY
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
Identify the competent supervisory authority/ies in accordance with Clause 13
The relevant supervisory authority shall be the one in the Customer’s place ofestablishment.
ANNEX II - TECHNICAL AND ORGANIZATIONAL MEASURES INCLUDING TECHNICAL AND ORGANIZATIONALMEASURES TO ENSURE THE SECURITY OF THE DATA
MODULE TWO: Transfer controller to processor
MODULE THREE: Transfer processor to processor
EXPLANATORY NOTE:
The technical and organizational measures must be described in specific (and not generic) terms. See also the general comment on the first page of the Appendix, in particular on the need to clearly indicate which measures apply to each transfer/set of transfers.
Description of the technical and organizational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, contextand purpose of the processing, and the risks for the rights and freedoms of natural persons.
physical access control to prevent unauthorized access to the data processingsystems available in premises and facilities (including databases, applicationservers and related hardware), including establishing access authorizations foremployees and third parties.
electronic access control to prevent data processing systems from being used byunauthorized persons including password requirements and procedures,identification and authentication procedures, encryption.
data access control to ensure that persons entitled to use a data processingsystem gain access only in accordance with their access rights, and that datacannot be read, copied, modified or deleted without authorization including,internal procedures, different roles, monitoring of activities, access, change,and deletion procedures.
disclosure control to ensure that data cannot be read, copied, modified ordeleted without authorization during electronic transmission or storage onmanual or electronic storage media, and that it can be verified to whichcompanies or other legal entities data are disclosed including encryption,logging.
entry control to monitor whether data have been entered, changed or deleted,and by whom, from data processing systems including logging and monitoring.
control of instructions to ensure that data are processed solely in accordancewith the instructions of the controller including audits.
availability control to ensure that data are protected against accidentaldestruction or loss (physical/logical) including backups, antivirus programs,disaster recovery and incident response plans.
separation control to ensure that data collected for different purposes can beprocessed separately including separate databases, limitation of use of data.
For transfers to (sub-) processors, also describe the specific technical andorganizational measures to be taken by the (sub-) processor to be able toprovide assistance to the controller and, for transfers from a processor to asub-processor, to the data exporter.

Section I
‍
Clause 1: Purpose and Scope
The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons regarding the processing of personal data and the free movement of such data (General Data Protection Regulation), for the transfer of personal data to a third country.

The Parties:
The natural or legal person(s), public authority(ies), agency(ies), or other body(ies) (hereinafter “entity/ies”) transferring the personal data, as listed in Annex I.A (hereinafter each “data exporter”), and
The entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also party to these clauses, as listed in Annex I.A (hereinafter each “data importer”).

The parties have agreed to these standard contractual clauses (hereinafter: “Clauses”). These Clauses apply with respect to the transfer of personal data as specified in Annex I.B. The Appendix to these Clauses, containing the Annexes referred to therein, forms an integral part of these Clauses.

Clause 2: Effect and Invariability of the Clauses
These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects. These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.

Clause 3: Third-party Beneficiaries
Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
Clause 1, Clause 2, Clause 3, Clause 6, Clause 7;
Clause 8 - Module One: Clause 8.5(e) and Clause 8.9(b); Module Two: Clause 8.1(b), 8.9(a), (c), (d), and (e); Module Three: Clause 8.1(a), (c), and (d), and Clause 8.9(a), (c), (d), (e), (f), and (g); Module Four: Clause 8.1(b) and Clause 8.3(b);
Clause 9 - Module Two: Clause 9(a), (c), (d), and (e); Module Three: Clause 9(a), (c), (d), and (e);
Clause 12 - Module One: Clause 12(a) and (d); Modules Two and Three: Clause 12(a), (d), and (f);
Clause 13;
Clause 15.1(c), (d), and (e);
Clause 16(e);
Clause 18 - Modules One, Two, and Three: Clause 18(a) and (b); Module Four: Clause 18.

Paragraph (a) is without prejudice to the rights of data subjects under Regulation (EU) 2016/679.

Clause 4: Interpretation
Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation. These Clauses shall be read and interpreted in light of the provisions of Regulation (EU) 2016/679. These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.

Clause 5: Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.

Clause 6: Description of the Transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.

Clause 7 (Optional): Docking Clause
An entity that is not a party to these Clauses may, with the agreement of the parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A. Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A. The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a party.
‍

Section II – Obligations of the Parties
‍
Clause 8: Data Protection Safeguards
The data exporter warrants it has used reasonable efforts to determine that the data importer is capable, through the implementation of appropriate technical and organizational measures, to meet obligations under these Clauses.

Module Two: Transfer Controller to Processor
‍

8.1 Instructions
The data importer shall process personal data only on documented instructions from the data exporter and shall immediately inform the data exporter if it is unable to follow those instructions.
‍

8.2 Purpose Limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer as set out in Annex I.B, unless further instructed by the data exporter.
‍

8.3 Transparency
On request, the data exporter shall provide a copy of these Clauses, including the Appendix, to the data subject free of charge. To protect business secrets or confidential information, the data exporter may redact parts but must provide a meaningful summary.
‍

8.4 Accuracy
If the data importer becomes aware of inaccuracies in the received personal data, it shall inform the data exporter and cooperate to rectify or erase the data.
‍

8.5 Duration of Processing and Erasure or Return of Data
After the service provision ends, the data importer shall either delete or return all personal data as instructed by the data exporter. If prohibited by local laws from doing so, it will ensure compliance with these Clauses.
‍

8.6 Security of Processing
Both the data exporter and importer shall implement appropriate technical and organizational measures to ensure the security of the data. This includes encryption, pseudonymization, and regular security checks to prevent personal data breaches.
‍

8.7 Sensitive Data
If sensitive data (such as racial, political, or health data) is transferred, the data importer shall apply additional safeguards as described in Annex I.B.
‍

8.8 Onward Transfers
Personal data may only be disclosed to a third party on documented instructions from the data exporter and must adhere to specific conditions, including compliance with adequacy decisions or safeguards under Regulation (EU) 2016/679.
‍

8.9 Documentation and Compliance
The data importer shall handle enquiries from the data exporter and maintain documentation to demonstrate compliance with these Clauses. The importer must cooperate with audits or inspections carried out by the data exporter and provide the necessary information for the exporter to demonstrate compliance.

‍

‍
Module Three : Transfer processor to processor
‍

8.10 Instructions
The data exporter has informed the data importer that it acts as a processor under the controller's instructions. The data importer shall process personal data based on documented instructions from the controller and the data exporter. If the data importer is unable to follow these instructions, it must immediately notify the data exporter, which shall in turn notify the controller. The data exporter must impose the same data protection obligations on the data importer.
‍

8.11 Purpose Limitation
The data importer may process personal data only for the specific purpose(s) set out in Annex I.B, unless further instructed by the controller or the data exporter.
‍

8.12 Transparency
On request, the data exporter shall provide a copy of these Clauses, including the Appendix, to the data subject free of charge. Business secrets or confidential information may be redacted if necessary, but a meaningful summary must be provided.
‍

8.13 Accuracy
The data importer must inform the data exporter if the personal data received is inaccurate or outdated. The data importer shall cooperate with the data exporter to rectify or erase the data.
‍

8.14 Duration of Processing and Erasure or Return of Data
The data importer must process personal data only for the duration specified in Annex I.B. After the processing ends, the data importer must delete or return all personal data based on the data exporter’s instructions, ensuring compliance with these Clauses until the data is erased or returned.
‍

8.15 Security of Processing
The data importer and exporter must implement appropriate technical and organizational measures to ensure data security. These measures include encryption, pseudonymization, and regular security checks. Personal data must only be accessed by authorized personnel who are bound by confidentiality.
‍

8.16 Sensitive Data
If sensitive data is involved (e.g., racial, political, health data), the data importer must apply the specific restrictions and additional safeguards set out in Annex I.B.
‍

8.17 Onward Transfers
The data importer may only disclose personal data to third parties based on documented instructions from the controller. Onward transfers outside the EU must comply with specific conditions, such as adequacy decisions or appropriate safeguards.
‍

8.18 Documentation and Compliance
The data importer must document processing activities and cooperate with the data exporter regarding enquiries or audits. Information must be made available to the data exporter, which shall also provide it to the controller. Audits can be conducted by the data exporter or an independent auditor with reasonable notice.

‍

Clause 9 - Use of sub-processors
‍
Module Two: Transfer Controller to Processor
The data importer has the general authorization to engage sub-processors from an agreed list. The data exporter must be informed in writing of any changes at least seven days in advance, allowing time to object. Sub-processors must comply with the same obligations as the data importer, and the data importer remains fully responsible for the sub-processor’s performance. The sub-processor contract must include a third-party beneficiary clause allowing the data exporter to terminate the contract and request the deletion or return of personal data if necessary.
‍

Module Three: Transfer Processor to Processor
The data importer has the controller's general authorization to engage sub-processors. Changes must be communicated to the controller in writing at least 15 days in advance, with time to object. Sub-processors must adhere to the same obligations, and the data importer remains responsible for their performance. The sub-processor agreement must include provisions allowing termination and the deletion or return of personal data if the data importer ceases to exist or becomes insolvent.

Clause 10: Data Subject Rights
‍
Module Two: Transfer Controller to Processor
The data importer must notify the data exporter of any data subject request. It cannot respond directly unless authorized by the data exporter. Assistance is required to ensure the exporter can meet obligations, with technical and organizational measures defined in Annex II.
‍

Module Three: Transfer Processor to Processor
The data importer must notify the data exporter and controller of any data subject request. Assistance is required to enable compliance, following instructions from the controller.
‍

Clause 11: Redress
Data importers must provide a transparent contact point for complaints. Both parties should cooperate to resolve disputes and follow data subject decisions, such as referring disputes to courts or supervisory authorities.

‍
Clause 12: Liability
‍‍
‍Module Two & Three:

Transfer Controller to Processor/Processor to Processor
‍Each party is liable for damages caused by breaches. The data importer is liable to data subjects for damages caused by it or sub-processors. The data exporter also shares liability but can claim back compensation based on responsibility. All responsible parties may be jointly liable for damages. Sub-processors cannot be used to avoid liability.

‍
Clause 13: Supervision‍

Transfer Controller/Processor to Processor
‍The competent supervisory authority for ensuring compliance is indicated in Annex I.C. The data importer agrees to submit to the jurisdiction of the supervisory authority, cooperate with audits, and comply with any remedial actions required.

Clause 14: Local Laws and Practices Affecting Compliance
‍The parties warrant they have no reason to believe that local laws of the third country prevent compliance with these Clauses. The assessment must take into account factors such as transfer specifics, applicable laws, and safeguards in place. If conditions change, the data importer must promptly notify the data exporter, and data transfers may be suspended or terminated if safeguards cannot be ensured.

‍
Clause 15: Obligations of the Data Importer in Case of Access by Public Authorities
‍

Transfer Controller/Processor to Processor
The data importer must notify the data exporter, and where possible, the data subject, of any legally binding requests for disclosure from public authorities. If prohibited from notifying, the data importer must use best efforts to obtain a waiver and document those efforts. Additionally, the data importer must review the legality of any requests and challenge them if necessary.
‍

Clause 16: Non-Compliance with the Clauses and Termination
If the data importer cannot comply with these Clauses, the data exporter must suspend data transfers until compliance is ensured or terminate the contract. Non-compliance may lead to suspension, termination, and informing relevant authorities. Personal data transferred prior to termination must be deleted or returned, and the data importer must continue compliance until the data is erased or returned.

‍

Clause 17: Governing Law
‍
Module Two & Module Three: Transfer Controller/Processor to Processor
These Clauses are governed by the law of an EU Member State that allows for third-party beneficiary rights. The Parties agree to apply the law of Ireland.
‍

Clause 18: Choice of Forum and Jurisdiction
‍
Transfer Controller/Processor to Processor
Disputes arising from these Clauses will be resolved in the courts of Ireland. A data subject may bring legal proceedings against the data exporter or importer in the Member State of their habitual residence.
‍

Appendices & Annexes
The roles of parties (controller/processor) must be clearly defined in Annex I.A. The details of the data transfer, categories of data subjects, and other necessary safeguards are outlined in Annex I.B. Technical and organizational measures are specified in Annex II to ensure data security during the transfer process.

‍

ANNEX III – LIST OF SUB-PROCESSORS

Module Two: Transfer controller to processor
Module Three: Transfer processor to processor
‍
Explanatory Note:
This Annex must be completed for Modules Two and Three, in case of the specific authorization of sub-processors (Clause 9(a), Option 1).The controller has authorized the use of the following sub-processors: https://www.clickguard.com/sub-processors

Legal Docs

Affiliates Terms and Conditions

Data Security Policy

Data Processing Agreement

GDPR Information

CCPA Information

ClickGUARDData Processing Agreement

Table of contents