In the course of providing the Services to Customer pursuant to the Agreement, Screen Magic may Process Personal Data on behalf of Customer and the Parties agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.
HOW TO EXECUTE THIS DPA:
- This Data Processing addendum (DPA) consists of two parts: the main body of the DPA, and including Appendices 1 and 2.
- This DPA has been pre-signed on behalf of processor.
- To complete this DPA, Customer must complete the information in the signature box and sign on Page 11 and 12.
- Send the completed and signed DPA to processor by email, indicating the Customer’s Account Number to email@example.com.
Upon receipt of the validly completed DPA by processor at this email address, this DPA will become legally binding.
HOW THIS DPA APPLIES:
If the Customer entity signing this DPA is a party to the Agreement, this DPA is an addendum to and forms part of the Agreement. In such case, the processor entity that is party to the Agreement is party to this DPA.
If the Customer entity signing this DPA has executed an Master Service Agreement with processor or its Affiliate pursuant to the Agreement, but is not itself a party to the Agreement, this DPA is an addendum to that Order Form and applicable renewal Order Forms, and the processor entity that is party to such Order Form is party to this DPA.
If the Customer entity signing this DPA is neither a party to an Order Form nor the Agreement, this DPA is not valid and is not legally binding. Such entity should request that the Customer entity who is a party to the Agreement executes this DPA.
This DPA shall not replace any comparable or additional rights relating to Processing of Customer Data contained in Customer’s Agreement (including any existing data processing addendum to the Agreement).
“Applicable Laws” means (a) European Union or Member State laws with respect to any Company Personal Data in respect of which any Company Group Member is subject to EU Data Protection Laws; and (b) any other applicable law with respect to any Company Personal Data in respect of which any Company Group Member is subject to any other Data Protection Laws;
“Controller(s)” is the natural or legal person, authority, organization or other agency that makes decisions individually or together with other parties regarding the purposes and means for processing Personal Data.
“Control” means (a) the legal or beneficial ownership, directly or indirectly, of more than 50% of the issued share capital or similar right of ownership; or (b) the power to direct or cause the direction of the affairs and/or general management of the company, partnership, statutory body or other entity in question, whether through the ownership of voting capital, by contract or otherwise, and “Controls” and “Controlled” shall be construed accordingly;
“Customer” means the contracting party any other Group Company or Group Companies to which the processor provides services from time to time;
“CCPA” means the California Consumer Privacy Act of 2018, Cal. Civ. Code §§ 1798.100 et. seq.
The terms, “Controller”, “Data Subject”, “Member State”, “Processor”, “Processing” and “Supervisory Authority” shall have the same meaning as in the GDPR. The terms “Business”, “Business Purpose”, “Consumer” and “Service Provider” shall have the same meaning as in the CCPA.
“Data Protection Legislation” means all applicable privacy or data protection laws and regulations (as amended, consolidated or re-enacted from time-to-time) which relate to the protection of individuals with regards to the processing of personal data to which a party is subject, including the Data Protection Act 1998 (as may be superseded) and GDPR (on and from 25 May 2018) for as long as any of the above are incorporated into Applicable Law and then any successor legislation to GDPR or the Data Protection Act 1998 together with any guidance and/or codes of practice issued from time-to-time by the Information Commissioner;
“Data Subject Access Request” means a request made by, or on behalf of, a Data Subject in accordance with rights granted pursuant to the Data Protection Legislation to access their Personal Data;
“Data Subject” has the meaning set out in the Data Protection Legislation;
“EEA” means the European Economic Area;
“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and repealing Directive 95/46/EC (General Data Protection Regulation) OJ L 119/1, 4.5.2016;
“Group Company” means (a) any company which from time to time Controls the Customer, including (but not limited to) as a holding company as defined in section 1159 of the Companies Act 2006; and (b) any company which from time to time Controlled by is or is under common Control with the Customer, including (but not limited to) as a subsidiary or holding company as defined in section 1159 of the Companies Act 2006;
“Original Agreement” the terms and conditions and service specification currently in force between the parties including Master service agreement;
“Personal Data Breach” has the meaning set out in the Data Protection Legislation;
“Personal Data” has the meaning set out in the Data Protection Legislation and includes (but is not limited to) special categories of personal data which reveal racial or ethnic origin, political opinions, religious beliefs, sex life, sexual orientation, trade union membership, health or the processing of genetic or biometric data, for the purpose of uniquely identifying a natural person;
“Processor” has the meaning set out in the Data Protection Legislation;
“Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“Affiliate” means an entity that owns or controls, is owned or controlled by or is or under common control or ownership with Vendor, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise.
“Processing“ means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“Personal Data” or “Personal Information” means any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to or with an identified or identifiable natural person or Consumer (as defined in the CCPA), which is processed by Screen Magic solely on behalf of Customer, under this DPA and the Agreement between Customer and Processor.
“Security Measures” means appropriate technical and organizational measures which may include, where appropriate, pseudonymization and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organizational measures adopted by it;
“Sub-processor” means any third party appointed to process Personal Data on behalf of The Provider related to the Original Agreement.
2. SUBJECT MATTER OF THIS DP AGREEMENT
2.1 This DP Agreement governs the processing of Personal Data by SCREEN-MAGIC MOBILE MEDIA INC as a Processor for and on behalf of the CLIENT as a Controller, according to the Controller’s instructions, in connection with the provision of the Services defined in the Main Agreement.
2.2 This DP Agreement serves to supplement the Main Agreement and forms its integral part. If there is a conflict between this DP Agreement and the Main Agreement, the provisions of this DP Agreement will prevail.
3. PROCESSING OF PERSONAL DATA
3.1 Roles of the Parties. The Parties acknowledge and agree that with regard to the Processing of Personal Data performed solely on behalf of Customer, (i) Customer is the Controller of its Users’ Account Data and Profile Data, and of Customer Data (as defined in the Agreement), (ii) SCREEN-MAGIC MOBILE MEDIA is the Processor of Customer Data, and of such Users’ Account Data and Profile Data; (iii) for the purposes of the CCPA (and to the extent applicable), Customer is the “Business” and SCREEN-MAGIC MOBILE MEDIA is the “Service Provider” (as such terms are defined in the CCPA), with respect to Processing of Personal Data described in this Section 3.1. The terms “Controller” and “Processor” below hereby signify Customer and SCREEN-MAGIC MOBILE MEDIA, respectively.
3.2 Customer’s Processing of Personal Data. Customer, in its use of the Services, and Customer’s instructions to the Processor, shall comply with Data Protection Laws. Customer shall establish and have any and all required legal bases in order to collect, Process and transfer to Processor the Personal Data, and to authorize the Processing by Processor, and for Processor’s Processing activities on Customer’s behalf, including the pursuit of ‘business purposes’ as under the CCPA.
3.3 Client’s Processing of Personal Data. Processor shall treat Personal Data as Confidential Information and shall only Process Personal Data on behalf of and in accordance with Customer’s documented instructions for the following purposes: (i) Processing in accordance with the Agreement and applicable Order Form(s); (ii) Processing initiated by Users in their use of the Services; and (iii) Processing to comply with other documented reasonable instructions provided by Customer (e.g., via email) where such instructions are consistent with the terms of the Agreement.
3.4 Details of the Processing. The subject-matter of Processing of Personal Data by processor is the performance of the Services pursuant to the Agreement. The duration of the Processing, the nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects Processed under this DPA are further specified in to this DPA
3.5 CCPA Standard of Care; No Sale of Personal Information. SCREEN-MAGIC MOBILE MEDIA acknowledges and confirms that it does not receive or process any Personal Information as consideration for any services or other items that SCREEN-MAGIC MOBILE MEDIA provides to Customer under the Agreement. SCREEN-MAGIC MOBILE MEDIA shall not have, derive, or exercise any rights or benefits regarding Personal Information Processed on Customer’s behalf, and may use and disclose Personal Information solely for the purposes for which such Personal Information was provided to it, as stipulated in the Agreement and this DPA. SCREEN-MAGIC MOBILE MEDIA represents and warrants that it understands the rules, requirements and definitions of the CCPA and agrees to refrain from selling (as such term is defined in the CCPA) any Personal Information Processed hereunder, without Customer’s prior written consent, nor taking any action that would cause any transfer of Personal Information to or from SCREEN-MAGIC MOBILE MEDIA under the Agreement or this DPA to qualify as “selling” such Personal Information under the CCPA.
4. RIGHTS OF DATA SUBJECTS
4.1 Data Subject Request. Processor shall, to the extent legally permitted, promptly notify Customer if Processor receives a request from a Data Subject or Consumer to exercise their rights (to the extent available to them under applicable law) of access, right to rectification, restriction of Processing, erasure (“right to be forgotten”), data portability, object to the Processing, its right not to be subject to an automated individual decision making, to opt-out of the sale of Personal Information, or the right not to be discriminated against for exercising any CCPA Consumer rights (“Data Subject Request”). Taking into account the nature of the Processing, Processor shall assist Customer by appropriate technical and organizational measures, insofar as this is possible and reasonable, for the fulfilment of Customer’s obligation to respond to a Data Subject Request under Data Protection Laws. Processor may refer Data Subject Requests received, and the Data Subjects making them, directly to the Customer for its treatment of such requests.
5. PROCESSOR PERSONNEL
5.1 Confidentiality. Processor shall ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities and have executed written confidentiality agreements. processor shall ensure that such confidentiality obligations survive the termination of the personnel engagement.
5.2 The Controller shall be solely responsible for assessing whether Personal Data can be processed lawfully and for safeguarding the rights of the Data Subjects. The Controller shall ensure in its area of responsibility that the necessary legal requirements are met (for example by collecting declarations of consent) so that the Processor can provide the agreed Services in a way that does not violate any legal regulations.
5.3 Reliability. Processor shall take commercially reasonable steps to ensure the reliability of any processor personnel engaged in the Processing of Personal Data.
5.4 Limitation of Access. Processor shall ensure that processor’s access to Personal Data is limited to those personnel performing Services in accordance with the Agreement.
5.5 Data Protection Officer. Members of the processor Group have appointed a data protection officer. The appointed person may be reached at firstname.lastname@example.org
6.1 Appointment of Sub-processors. Customer acknowledges and agrees that (a) processor’s Affiliates may be retained as Sub processors, (b) processor and processor’s Affiliates respectively may engage third-party Sub-processors in connection with the provision of the Services. processor or a processor Affiliate has entered into a written agreement with each Sub-processor containing data protection obligations not less protective than those in this Agreement with respect to the protection of Customer Data to the extent applicable to the nature of the Services provided by such Sub-processor.
6.2 Objection Right for New Sub-processors. Customer may object to processor’s use of a new Sub-processor by notifying processor promptly in writing within ten (10) business days after receipt of processor’s notice in accordance with the mechanism set out in Section 6.1. In the event Customer objects to a new Sub-processor, as permitted in the preceding sentence, processor will use reasonable efforts to make available to Customer a change in the Services or recommend a commercially reasonable change to Customer’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new Sub processor without unreasonably burdening the Customer. If processor is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may terminate the applicable Master service agreement with respect only to those Services which cannot be provided by processor without the use of the objected-to new Sub-processor by providing written notice to processor. processor will refund Customer any prepaid fees covering the remainder of the term of such Order Form(s) following the effective date of termination with respect to such terminated Services, without imposing a penalty for such termination on Customer.
6.3 As of the May 25th 2018 the Processor shall maintain an up-to-date list of its sub-processors at https://trust.sms-magic.com/compliance/gdpr/, and the Controller will have the possibility to subscribe to notifications of changes within the sub-processors list. If the Controller subscribes, the Processor shall notify the Controller of any intended changes concerning the addition or replacement of sub-processors that affects the Controller at least 10 days before change, thereby giving the Controller the opportunity to object to such changes within the mentioned period of time.
6.4 Liability. processor shall be liable for the acts and omissions of its Sub-processors to the same extent processor would be liable if performing the services of each Sub-processor directly under the terms of this DPA, except as otherwise set forth in the Agreement.
7.1 Controls for the Protection of Customer Data. processor shall maintain appropriate technical and organizational measures for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Customer Data), confidentiality and integrity of Customer Data, as set forth in the master service agreement. processor regularly monitors compliance with these measures. processor will not materially decrease the overall security of the Services during a subscription term.
7.2 Upon Customer’s written request at reasonable intervals, the data processor shall provide a copy of data processor’s most recent third-party audits or certifications, as applicable, or any summaries thereof, related to the Processing of Personal Data of Customer. The date of the third-party audit or certification shall be less than 12 months from the data of such written request. The data processor shall make available to Customer, upon reasonable written request, such information necessary to demonstrate compliance with this Addendum, and shall allow for written audit requests by Customer or an independent auditor in relation to the Processing of Personal Data to verify that data processor employs reasonable procedures in compliance with this Addendum, not more than once per year. Any information provided by Data Processor and/or audits performed pursuant to this section are subject to the confidentiality obligations set forth in the Agreement.
8. INTERNATIONAL DATA TRANSFER
8.1 Unless otherwise agreed with the Controller in writing (including e-mail), the Processor shall ensure that Personal Data is stored and processed at the processing systems located in its data centers within European Economic Area (EEA), and any transfer of Personal Data to the Processor’s data centers located outside the European Union or European Economic Area (EEA) can be made only upon such an instruction of the Controller.
8.2 Where the performance of the Services involves a transfer of Personal Data outside the European Economic Area (EEA), the Processor will take such a steps as may be required to ensure there is adequate protection for such Personal Data in accordance with the Applicable Data Protection Laws (especially Articles 44 to 49 of the GDPR), which may include entering into the Standard Contractual Clauses set out in the European Commission’s Decision 2010/87/EU.
8.3 The Controller hereby grants its consent to the Processor to enter into any agreement or take any measures, including on behalf of the Controller, to establish and ensure an adequate level of data protection in the transfer of Personal Data to a sub-processing party outside the EEA. In the event of an application of the EU standard contractual clauses, the Processor is entitled to conclude such clauses on behalf of the Controller. The power of authority for this purpose is hereby granted by the Controller.
9. PERSONAL DATA BREACH NOTIFICATION
9.1 In respect of any Personal Data breach, the Processor shall notify the Controller of such a breach immediately, but in no event later than 48 h (forty-eight hours) after becoming aware of the Personal Data breach and provide reasonable details pertaining the subject Personal Data breach.
10. RETURN AND DELETION OF CUSTOMER DATA
Processor shall return Customer Data to Customer and, to the extent allowed by applicable law. The parties agree that on the termination of the provision of data processing services, the data importer and the sub processor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore
11. AUTHORIZED AFFILIATES
11.1 Communication. The Client that is the contracting party to the Agreement shall remain responsible for coordinating all communication with processor under this DPA and be entitled to make and receive any communication in relation to this DPA on behalf of its Authorized Affiliates
12. LIMITATIONS OF LIABILITY
Each party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to this DPA, and all DPAs between Authorized Affiliates and processor, whether in contract, tort or under any other theory of liability, is subject to the ‘Limitation of Liability’ section of the Agreement, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and all DPAs together.
For the avoidance of doubt, processor ‘s and its Affiliates’ total liability for all claims from the Customer and all of its Authorized Affiliates arising out of or related to the Agreement and each DPA shall apply in the aggregate for all claims under both the Agreement and all DPAs established under this Agreement, including by Customer and all Authorized Affiliates, and, in particular, shall not be understood to apply individually and severally to Customer and/or to any Authorized Affiliate that is a contractual party to any such DPA.
The data subject should be entitled to take action and, where appropriate, receive compensation from the data exporter who is the data controller of the personal data transferred.
13. EUROPEAN SPECIFIC PROVISIONS
13.1 With effect from 25 May 2018, processor will Process Personal Data in accordance with the GDPR requirements directly applicable to processor’s provision of its Services.
13.2 With effect from 25 May 2018, upon Customer’s request, processor shall provide Customer with reasonable cooperation and assistance needed to fulfil Customer’s obligation under the GDPR to carry out a data protection impact assessment related to Customer’s use of the Services, to the extent Customer does not otherwise have access to the relevant information, and to the extent such information is available to processor. processor shall provide reasonable assistance to Customer in the cooperation or prior consultation with the controller in the performance of its to the extent required under the GDPR
13.3 Assistance. Processor may assist Customer, at Customer’s request and cost, in ensuring compliance with Customer’s obligations pursuant to the GDPR, CCPA and other applicable Data Protection Laws.