Popdock Data Processing Agreement

Introduction 

Purpose and Scope

1. With regard to the Processing of Personal Data, You are the Controller and determine the purposes and means of Processing of Personal Data. You appoint Us as a Processor. We shall Process Personal Data on Your behalf only for the purposes detailed in Annex I, unless we receive further documented instructions from You.
2. You shall be solely responsible for compliance with Your obligations as Controller under applicable Data Protection Laws, including, but not limited to, the lawful disclosure and transfer of Personal Data to Us.
3. Processing by Us shall only take place for the duration of the Services as specified in the Agreement.

Obligations of Processor

1. We shall Process Your Personal Data only as set forth herein, unless otherwise required to do so under applicable Data Protection Laws. In such case, we shall inform You of the legal requirement before Processing, unless such law prohibits Us from doing so. Subsequent instructions may also be given by You throughout the duration of the Processing of Your Personal Data, provided that such instructions are in the scope of the Agreement and documented.
2. We shall promptly inform You if, in Our opinion, instructions given by You infringe applicable Data Protection Laws. We shall be entitled to suspend performance against such instruction until You confirm or modify such instruction in accordance with all applicable Data Protection Laws.
3. We shall correct or erase Your Personal Data if instructed by You and where included in the scope of the instructions. Within thirty 30 days of the expiry of Your Subscription Term or termination of the Agreement for any reason, and at Your request, We will either (i) securely destroy or render unreadable, undecipherable, or unrecoverable or (ii) deliver to You or Your designees all Personal Data in Our possession, custody, or control, and certify such deletion upon Your request. This obligation shall not apply to the extent applicable Data Protection Laws or competent authority requires retention for a specified period, in which event We shall isolate and protect the Personal Data from any further Processing except and to the extent required by such law.
4. To the extent We receive data that cannot be associated with an identified or identifiable individual from or on Your behalf, We shall take reasonable measures to ensure that the data continues not to be associated with an identified or identifiable individual and shall not attempt to reidentify the data unless expressly directed otherwise by You.
5. We shall notify you if We are not able to comply with our obligations as set forth herein or under applicable Data Protection Laws.
6. When acting as Processor for the Personal Data, we shall not (i) Sell the Personal Data, (ii) retain, use or disclose the Personal Data for any Commercial Purpose, or (iii) combine the Personal Data with information received from another source.
7. Unless prohibited by applicable law, We shall promptly notify you on becoming aware of any notice, inquiry, investigation, audit, administrative sanction or fine by a supervisory authority, related to the Personal Data we Process on your behalf.
8. Taking into account the nature of the Processing and the information available to Us, if You request, We shall reasonably assist You in carrying out a data protection impact assessment in cases where the Processing is likely to result in a high risk to the rights and freedoms of natural persons, and shall reasonably assist You in any required consultations with a supervisory authority.

Security of Processor

1. In assessing the appropriate level of security, We shall take into account the state of the art, the costs of implementation, the nature, scope, context and purposes of Processing and the risks involved for the Data Subjects, as well as the likelihood and likely severity of any breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to the Personal Data (“Personal Data Breach”).
2. Access to the Personal Data by Our personnel shall be strictly limited to those individuals who need such access to implement, manage and monitor the Services. Any personnel authorized to access the Personal Data have committed themselves to confidentiality obligations similar to the confidentiality terms of the Agreement or are under an appropriate statutory obligation of confidentiality.

Documentation and Audits

1. We shall document Our compliance with the obligations agreed in this DPA.
2. Upon Your request, and subject to the confidentiality obligations set forth in the Agreement, We shall make available to You or Your independent third-party auditor information regarding Our compliance with the obligations set forth in this DPA in the form of the third-party certifications and audits.
3. If and only to the extent that the information made available to You cannot reasonably demonstrate Our compliance with the provisions of this DPA, You may request an audit of the procedures relevant to the processing activities by contacting privacy@eonesolutions.com. Such audit will be conducted upon 30 days’ prior written notice, at most once per calendar year, during regular business hours, without interfering with Our operations, and subject to the execution of a confidentiality agreement. You may request more frequent audits only in the event We notify You of a Personal Data Breach that concerns your Personal Data or when a supervisory authority requires such an audit. Such an audit will be conducted by an independent third-party auditor reasonably acceptable to Us. Each party shall bear its own costs related to any audit. Before the commencement of an on-site audit, the parties shall mutually agree upon the scope, timing, and duration of the audit. You shall promptly provide Us with information regarding any noncompliance discovered during the course of an audit.

Use of Sub-Processors

1. You hereby consent to the use of (i) eOne Solutions Affiliates and (ii) the sub-processors listed at https://www.eonesolutions.com/documentation/popdock-sub-processors in connection with Our performance under the Agreement, provided that (i) We are liable for the sub-processors’ compliance with the obligations of this DPA, and (ii) where We engage a sub-processor, We shall do so by way of a binding contract which imposes on the sub-processor, in substance, the same data protection obligations as those contained in this DPA.
2. We shall notify You at least four 4 weeks before engaging any new sub-processor(s) under this DPA. You may object to any new sub-processor(s) on reasonable grounds related to applicable Data Protection Laws by providing written notice to Us within thirty (30) days after having received such notice (“Objection Period”). If You do not object within the Objection Period, You shall be deemed to have consented to the new sub processor. If You do object within the Objection Period, the parties will work together in good faith to find a functionally-equivalent and commercially-reasonable alternative to the new sub-processor. If a solution is not agreed between the parties within the Objection Period, You shall have the right to terminate the relevant Service by providing thirty days’ prior written notice. In such event, We will refund You (or, in the case Your Subscription is purchased through an Authorized Reseller, arrange through such Authorized Reseller, the refund of) any prepaid Fees covering the remainder of the applicable Subscription Term and terminate Your access to and use of the affected Service for which You have received the refund.

International Transfers

1. Location of Processing. Customer acknowledges that Popdock and its Sub-processors may maintain data processing operations in countries that are outside of the country in which the Services are deployed, including the United States and other locations in which Popdock or its Sub-Processors maintain data processing operations as more particularly described in the Sub-Processor List. We shall ensure that such transfers are made in compliance with Privacy Laws and this DPA.
2. Data Protection Frameworks. In relation to the international transfers of Personal Data to the United State and Switzerland, We comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.
3. When transferring personal information to a third party acting as a controller, this third party has responsibility for the processing of personal information it receives under the DPF Principles and subsequently transfers to a third party acting as an agent on its behalf. This third party shall remain liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the DPF Principles, unless the organization proves that it is not responsible for the event giving rise to the damage.

Data Subject Requests

1. We shall promptly notify You of any request we receive from a Data Subject, provided We are able to correlate that Data Subject to You based on the information provided by the Data Subject. We shall not respond to the request, unless authorized to do so by You or required by Data Protection Laws.
2. Taking into account the nature of the Processing, We will reasonably assist You to fulfill Your obligations as Controller to respond to Data Subject requests.
3. We shall not be liable in cases where You fail to respond to a Data Subject’s request completely, correctly, in a timely manner, or otherwise in accordance with Data Protection Laws.

Personal Data Breach

1. You shall have the right, upon notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Your Personal Data.
2. In the event of a Personal Data Breach, we shall cooperate with and reasonably assist You to comply with Your obligations under applicable Data Protection Laws, considering the nature of Processing and the information available to Us.
3. In the event of a Personal Data Breach by Us, We shall notify You without undue delay after becoming aware of the breach. Such notification shall contain, to the extent known: (a) a description of the nature of the breach (including, where possible, the categories and approximate number of Data Subjects and data records concerned); (b) the details of a contact point where more information can be obtained; (c) its likely consequences and the measures taken to address the breach.
4. You shall send the contact details of the person to notify in case of Personal Data Breaches to privacy@eonesolutions.com.
5. Where, and insofar as, it is not possible to provide all of the information specified in (b) above at the same time, the initial notification shall contain the information then-available and further information shall, as it becomes available, subsequently be provided without undue delay.

Final Provisions

1. Each Party shall be liable for and shall bear responsibility for any damages, including compensation to Data Subjects, and administrative fines imposed on it under applicable Data Protection Laws such as Articles 82 and/or 83 of the GDPR. Such liability shall not be subject to any limitations set forth in the ‘Limitation of Liability’ section of the Agreement.
2. This DPA constitutes the entire agreement between the parties regarding Our Processing activities, and supersedes all prior and contemporaneous agreements, proposals and representations, whether written or oral, concerning the subject matter hereof. We may update this DPA from time-to-time. Any revised version shall become effective upon renewal of Your Subscription under the Agreement. The latest version will always be available on the eOne Solutions website for review.
3. If You are located in the European Union, the European Economic Area and/or their member states, Switzerland, and the United Kingdom, this DPA is subject to the laws of the country in which You are located. For all other cases, this DPA is subject to the laws applicable to the Agreement. For any disputes arising out of or in connection with this DPA, the parties submit to the exclusive jurisdiction of the courts established in the country whose laws govern this DPA.

Annex 1: Description of the Processing

Categories of Data Subjects whose Personal Data is Processed

• Employees of the Controller.
• Further categories of Data Subjects, depending on the Controller’s use of the Services.

Categories of Personal Data Processed

• User Account related data such as name, username/lD, contact details, log and protocol data.
• Further categories of Personal Data, depending on the Controller’s use of the Services.

Nature of Processing

• Provision of the Popdock Service: The Cloud Service provides tools and features to integrate and automate various third-party applications, websites and services maintained by the Controller. Personal Data is primarily used to provide access to the Service by the Processor. If Personal Data is used for application-related usage analysis, the data will be anonymized.
• Support Services: Personal Data of Controller’s employees issuing Support Services requests (“tickets”) may be Processed by Processor for the purposes of administering the Support Services. Processor’s personnel may access Controller’s instance on a case-by-case basis if requested by the Controller.

Purpose(s) for which the Personal Data is Processed on behalf of the Controller

• Rendering of the Services by the Processor to the Controller, as agreed in the Agreement between the parties.
• Processing initiated by Users in the course of their use of or access to the Services.
• Processing to comply with other reasonable and documented instructions provided by the Controller that are consistent with the terms of the Agreement.

Duration of Processing

• The duration of the Processing equals the applicable Subscription Term.

Change, Review, and Update 

This agreement shall be reviewed once every year unless the owner considers an earlier review necessary to ensure that the agreement remains current. Changes to this agreement shall be exclusively performed by the Information Security Manager and approved by the IT Committee.  

Responsibility 

This is the responsibility of the Information Security Manager to maintain and make sure everyone is aware of this policy. 

Revisions 

• 4 April 20245
• This policy will be reviewed for continued completeness, relevance, and accuracy at yearly intervals or less. 

Need to contact us?

If there are any questions regarding this Popdock Data Processing Agreement, you may contact us using the information below.

4170 41st Avenue South, Suite 101
Fargo, ND 58104
USA

+1 888-319-3663

privacy@eonesolutions.com