DPA

Data Processing Addendum

LAST UPDATED: July 2021

Purpose of processing your personal data
This GDPR Data Processing Addendum (“DPA”) and the exhibits to this DPA apply to the Processing of Personal Data on behalf of Customer in order to provide the services Customer may have ordered from Trunomi. This DPA forms part of the Licensing Agreement or Terms of Service agreed the Customer has entered into with Trunomi pursuant to which Customer has accessed Trunomi’s services as defined in the applicable agreement (the “Agreement”). In the event of a conflict between the term of this DPA and the terms of the Agreement the terms of this DPA shall prevail, unless the Agreement explicitly provides otherwise identifying the relevant portion of the DPA that it is superseding.
If the Customer entity entering into this DPA has executed an order form or statement of work with Trunomi pursuant to the Agreement (an “Ordering Document”), but is not itself a party to the Agreement, this DPA is an addendum to that Ordering Document and applicable renewal Ordering Documents. If the Customer entity entering into this DPA is neither a party to an Ordering Document nor the Agreement, this DPA is not valid and is not legally binding.
In the course of providing Services to Customer pursuant to the Agreement, Trunomi may process personal data on behalf of Customer (or its end users). Trunomi agrees to comply with the following provisions with respect to any personal data submitted by or for Customer to the Services or collected and processed by or for Customer through the Services.
  1. INTERPRETATION
    1. Capitalized terms not defined in this DPA shall have the meaning ascribed to such terms in the applicable Agreement or in the applicable Data Protection Laws.
      1. “Anonymized Data” means Customer Personal Data which has been anonymized such that the Data Subject to whom it relates cannot be identified, directly or indirectly, by Processor or any third party.
      2. “Business Day” means any day which is not a Saturday, Sunday or public holiday in the United Kingdom and on which the banks are open for business in London.
      3. “Cessation Date” has the meaning given in Paragraph 1.
      4. “Customer Personal Data” means any Personal Data Processed by Processor on behalf of Customer pursuant to or in connection with the Agreement.
      5. “Data Protection Laws” means, until 24 May 2018, EU Directive 95/46/EC, as transposed into domestic legislation of each Member State and, with effect from 25 May 2018, the GDPR.
      6. “Data Subject Request” means the exercise of rights by Data Subjects of Customer Personal Data under Chapter III of the GDPR.
      7. “Delete” means to remove or obliterate Personal Data such that it cannot be recovered or reconstructed, and “Deletion” shall be construed accordingly.
      8. “Processor Services” means those services and activities to be supplied to or carried out by or on behalf of Processor for Customer pursuant to the Agreement.
      9. “GDPR” means the EU General Data Protection Regulation 2016/679 and to the extent the GDPR is no longer applicable in the United Kingdom, any implementing legislation or legislation having equivalent effect in the United Kingdom. References to “Articles” or “Chapters” of the GDPR shall be construed accordingly.
      10. “Transfer” means the transfer of Customer Personal Data outside the EU/EEA.
      11. “Personnel” means a Party’s employees, agents, consultants or contractors.
      12. “Standard Contractual Clauses” means the standard contractual clauses issued by the European Commission for the transfer of Personal Data from Data Controllers established in the EU/EEA to Data Processors established outside the EU/EEA, currently in the form annexed to the European Commission’s decision of 5 February 2010 on Standard Contractual Clauses for the transfer of personal data to processors established in third countries.
      13. “Subprocessor” means any third party appointed by or on behalf of Processor to Process Customer Personal Data.
    2. In this DPA Schedule the terms, “Data Controller”, “Data Processor”, “Data Subject”, “Member State”, “Personal Data”, “Personal Data Breach”, “Process/Processing” and “Supervisory Authority” shall have the meaning ascribed to such terms in the Data Protection Laws.
  2. PROCESSING OF COMPANY PERSONAL DATA
    1. Processor shall: (a) comply with all applicable Data Protection Laws in Processing Customer Personal Data; and (b) not Process Customer Personal Data other than: (i) on Customer’s instructions (subject always to Paragraph 9); and (ii) as required by applicable laws.
    2. To the extent permitted by applicable laws, Processor shall inform Customer of: (a) any Processing to be carried out under Paragraph 3; and (b) the relevant legal requirements that require it to carry out such Processing; before the relevant Processing of that Customer Personal Data by Processor.
    3. Customer instructs Processor to Process Customer Personal Data as necessary: (a) to provide the Processor Services to Customer (including, to improve and update the Processor Services and to carry out Processing initiated by Customer’s users in their use of the Processor Services); and (b) to perform Processor’s obligations and exercise Processor’s rights under the Agreement.
    4. The Appendix to this DPA sets out certain information regarding Processor’s Processing of Customer Personal Data as required by Article 28(3) of the GDPR.
    5. Either Party may amend Appendix 1 to this DPA on written notice from time-to-time as may be necessary to meet any applicable requirements of Data Protection Laws.
    6. Where Processor receives an instruction from Customer that, in its reasonable opinion, violates the GDPR, Processor shall inform Customer.
    7. Customer acknowledges and agrees that any instructions issued by Customer with regards to the Processing by Processor of Customer Personal Data pursuant to or in connection with the Agreement shall: (a) be strictly required for the sole purpose of ensuring compliance with Data Protection Laws; and (b) not relate to the scope of the Processor Services or otherwise materially change the services to be provided by Processor under the Agreement.
    8. Notwithstanding anything to the contrary herein, Processor may terminate the Agreement in its entirety upon written notice to Customer with immediate effect if Processor considers (in its absolute discretion) that: (a) it is unable to adhere to, perform or implement any instructions issued by Customer due to the technical limitations of its systems, equipment and/or facilities, and/or (b) to adhere to, perform or implement any such instructions would require disproportionate effort (whether in terms of time, cost, available technology, manpower or otherwise).
    9. Customer represents and warrants on an ongoing basis that, for the purposes of Article 6 of the GDPR, there is, and will be throughout the term of the Agreement, a legal basis for the Processing by Processor of Customer Personal Data in accordance with this DPA and the Agreement (including, any and all instructions issued by Customer from time to time in respect of such Processing).
  3. PROCESSOR PERSONNEL

    Processor shall take reasonable steps to ensure the reliability of any Processor Personnel who may Process Customer Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know or access the relevant Customer Personal Data for the purposes described in this DPA, and to comply with applicable laws, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.
  4. SECURITY
    1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Processor shall in relation to the Customer Personal Data implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.
    2. In assessing the appropriate level of security, Processor shall take account in particular of the risks presented by Processing, in particular from a Personal Data Breach.
  5. SUBPROCESSING
    1. Sub-processors. Customer agrees that Processor may engage Processor affiliates and third party sub-processors (collectively, “Sub-processors“) to process the Personal Data on Processor’s behalf in the EU and outside of the EU (e.g., the United States of America). The Sub-processors currently engaged by Processor and authorized by Customer are available at [Insert URL]. Prior to 25 May 2018, Processor shall update the URL of its online list of Sub-processors by posting such list on its website. Customer shall be notified by Processor in advance of any new Sub-processor being appointed by changes to this website.
    2. Objection to Sub-processors. Customer may object in writing to the appointment of an additional Sub-processor within five (5) calendar days after receipt of Processor’s notice in accordance with the mechanism set out at Section 5.1 above. In the event that Customer objects on reasonable grounds relating to the protection of the Personal Data, then the parties shall discuss commercially reasonable alternative solutions in good faith. If no resolution can be reached, Processor will, at its sole discretion, either not appoint Sub-processor, or permit Customer to suspend or terminate the affected Processor service in accordance with the termination provisions of the Agreement.
    3. Sub-processor obligations. Where a Sub-processor is engaged by Processor as described in this Section 5, Processor shall: (a) restrict the Sub-processor’s access to Personal Data only to what is necessary to perform the subcontracted services and meet the requirements of Article 28(3) of the GDPR; (b) impose on such Sub-processors data protection terms that protect the Personal Data to the same standard provided for by this DPA; and (c) remain liable for any breach of the DPA caused by a Sub-processor.
  6. DATA SUBJECT RIGHTS
    1. Taking into account the nature of the Processing, Processor shall, at Customer’s cost, provide Customer with such assistance as may be reasonably necessary and technically possible in the circumstances, to assist Customer in fulfilling its obligation to respond to Data Subject Requests.
    2. Processor shall: (a) promptly notify Customer if Processor receives a Data Subject Request; and (b) ensure that Processor does not respond to any Data Subject Request except on the documented instructions of Customer (and in such circumstances, at Customer’s cost) or as required by applicable laws, in which case Processor shall to the extent permitted by applicable laws inform Customer of that legal requirement before Processor responds to the Data Subject Request.
  7. PERSONAL DATA BREACH
    1. Processor shall notify Customer without undue delay upon Processor becoming aware of a Personal Data Breach affecting Customer Personal Data, providing Customer with sufficient information (insofar as such information is within Processor’s possession) to allow Customer to meet any obligations to report or inform affected Data Subjects of the Personal Data Breach under Data Protection Laws.
    2. Processor shall cooperate with Customer and take such reasonable commercial steps as may be directed by Customer to assist in the investigation, mitigation and remediation of each such Personal Data Breach.
  8. DATA PROTECTION IMPACT ASSESSMENT AND PRIOR CONSULTATION

    Processor shall provide reasonable assistance to Customer, at Customer’s cost, with any data protection impact assessments, and prior consultations with Supervisory Authorities, which Customer reasonably considers to be required of Customer by Article 35 or 36 of the GDPR, in each case solely in relation to Processing of Customer Personal Data by, and taking into account the nature of the Processing and information available to, Processor.
  9. DELETION OR RETURN OF COMPANY PERSONAL DATA
    1. Subject to Paragraph 2, Processor shall promptly and in any event within ten (10) Business Days of the date of cessation of any Processor Services involving the Processing of Customer Personal Data (the “Cessation Date”), Delete and/or procure the Deletion of all copies of those Customer Personal Data. If requested by Customer, Processor shall provide written certification to Customer that it has fully complied with this DPA Paragraph 3.1 within fourteen (14) Business Days of the date of such request.
    2. Processor may retain Customer Personal Data after the Cessation Date to the extent required by applicable laws and only to the extent and for such period as required by applicable laws and always provided that Processor shall ensure the confidentiality of all such Customer Personal Data and shall ensure that such Customer Personal Data is only Processed as necessary for the purpose(s) specified in the applicable laws requiring its storage and for no other purpose.
  10. AUDIT RIGHTS
    1. Subject to Paragraphs 2 and 4.3, Processor shall make available to Customer on request information reasonably necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits, including inspections, by Customer or an auditor mandated by Customer in relation to the Processing of the Customer Personal Data by Processor.
    2. Customer shall give Processor reasonable notice of any audit or inspection to be conducted under Paragraph 1 (which shall in no event be less than thirty (30) days’ notice unless required by a Supervisory Authority pursuant to Paragraph 4.3(f)(ii)) and shall use its best efforts (and ensure that each of its mandated auditors uses its best efforts) to avoid causing, and hereby indemnifies Processor in respect of, any damage, injury or disruption to Processor’s premises, equipment, personnel, data, and business (including any interference with the confidentiality or security of the data of Processor’s other customers or the availability of the Processor Services to such other customers) while its personnel are on those premises in the course of such an audit or inspection.
    3. Processor need not give access to its premises for the purposes of such an audit or inspection:
      1. to any individual unless he or she produces reasonable evidence of identity and authority;
      2. to any auditor whom Processor has not given its prior written approval (not to be unreasonably withheld);
      3. unless the auditor enters into a non-disclosure agreement with Processor on terms acceptable to Processor;
      4. where, and to the extent that, Processor considers, acting reasonably, that to do so would result in interference with the confidentiality or security of the data of Processor’s other customers or the availability of the Processor Services to such other customers;
      5. outside normal business hours at those premises; or
      6. on more than one (1) occasion in each period of twelve (12) months during the term of the Agreement (or where the term of the Agreement is less than (12) months, on more than one (1) occasion during such shorter term), except for any additional audits or inspections which:
        1. Customer reasonably considers necessary because of a Personal Data Breach; or
        2. Customer is required to carry out by Data Protection Law or a Supervisory Authority,
      where Customer has identified the Personal Data Breach or the relevant requirement in its notice to Processor of the audit or inspection.
    4. The Parties shall discuss and agree the costs of any inspection or audit to be carried out by or on behalf of Customer pursuant to this DPA Paragraph 4 in advance of such inspection or audit and, unless otherwise agreed in writing between the Parties, Customer shall bear any third party costs in connection with such inspection or audit and reimburse Processor for all costs incurred by Processor and time spent by Processor (at Processor’s then-current professional services rates) in connection with any such inspection or audit.
  11. RESTRICTED TRANSFERS
    1. Subject to Paragraph 2, the Parties agree that no Customer Personal Data shall be Processed by Processor or any Subprocessor outside the EEA, without the Customer’s consent.
    2. The Standard Contractual Clauses will apply to Processing of Personal Data that is transferred outside the EEA, either directly or via onward transfer, to any recipient not (i) located in a country recognized by the European Commission as providing an adequate level of protection for personal data or (ii) covered by a framework recognized by the relevant authorities or courts as providing an adequate level of protection for personal data, including, without limitation, Binding Corporate Rules or the E.U.-U.S. Privacy Shield Framework (each such recipient, a “Third Country Recipient”). Where Customer provides its prior written consent in respect of any Transfer: (a) from Customer to Processor, each Party agrees that the Standard Contractual Clauses shall be entered into by and between Customer as the ‘data exporter’ and Processor as the ‘data importer’; and/or (b) from Processor to a Subprocessor, Customer agrees that the Standard Contractual Clauses shall be entered into by and between Processor (as agent for Customer) as the ‘data exporter’ and the Subprocessor as the ‘data importer’; in each case to allow the relevant Transfer to take place without breach of applicable Data Protection Laws. Customer acknowledges and agrees that certain sub-processors that are identified in the Agreement (e.g., payment processors) shall be deemed approved by Customer and the obligations of this Section satisfied as to the identified sub-processors in the Agreement.

Appendix 1 to DPA

Data Processing Details

This DPA Appendix to the DPA includes certain details of the Processing of Customer Personal Data as required by Article 28(3) GDPR.

Subject matter and duration of the Processing of Customer Personal Data

The subject matter and duration of the Processing of the Customer Personal Data are set out in the Agreement and the DPA.

The nature and purpose of the Processing of Customer Personal Data

  • To perform the Processor Services.
  • To perform financial transactions relating to Processor Services.
  • To perform backups of Customer Data.
  • To comply with legal obligations.

The types of Customer Personal Data to be Processed

  • The names, email addresses and other contact details of Customer’s Personnel with whom Processor needs to liaise in the provision of the Processor Services.
  • Trunomi may also collect: (a) names; (b) addresses; (c) countries; (d) email addresses, (e) telephone numbers; (f) financial data relating to orders; (g) IP Addresses; and (h) log files; as may be necessary to perform the Processor Services and/or bill for such Processor Services.

The categories of Data Subject to whom the Customer Personal Data relates

  • Customer’s Personnel
  • Personnel Data of Customer’s Customers

The obligations and rights of Customer

The obligations and rights of Customer are set out in the Agreement and this DPA.