Data Processing Addendum

This Data Processing Addendum (“DPA”) between Augumenta Oy (“Augumenta”) and Company forms part of the Agreement and is effective as of the Effective Date.

1. Definitions

1.1. All capitalized terms not defined in this DPA will have the meanings set forth in the Agreement.

1.2. The following terms have the meanings assigned to them in the GDPR: “Controller” and “Processor.”

1.3. “Affiliate” means an entity that directly or indirectly controls, is controlled by or is under common control with an entity.

1.4. “Agreement” means Augumenta’s Terms of Service, which govern the provision of the Services to Company.

1.5. “Company Data” means any Personal Information that Augumenta Processes on behalf of Company as a Processor in the course of providing Services.

1.6. “Data Protection Law” means all data protection and privacy laws applicable to the Processing of Personal Information under the Agreement, including, where applicable, EU Data Protection Law.

1.7. “EU Data Protection Law” means (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (“GDPR”); and (ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and applicable national implementations of it (as may be amended, superseded or replaced).

1.8. “EEA” means the European Economic Area.

1.9. “Personal Information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, including Company employees.

1.10. “Process” and its cognates means any operation or set of operations that is performed on Personal Information, including storage, disclosure, erasure, and destruction.

1.11. “Security Incident” means any unauthorized or unlawful breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Company Data.

1.12. “Services” means any product or service provided by Augumenta to Company pursuant to the Agreement.

1.13. “Standard Contractual Clauses” (“SCCs”) means the European Union standard contractual clauses for the transfer of personal data from the European Economic Area to third countries. Unless otherwise specified, a reference to “SCCs” means the controller-to-Processor version (Commission Decision 2010/87/EU) or the controller-to-controller version (Commission Decision 2004/915/EC), as context requires.

1.14. “Subprocessor” means any entity that Processes Personal Information on behalf of Augumenta to assist Augumenta in its performance of the Agreement.

2. Relationship with the Agreement

2.1. The parties agree that the DPA shall replace any existing data processing addendum the parties may have previously entered into in connection with the Services.

2.2. Except for the changes made by this DPA, the Agreement remains unchanged and in full force and effect. If there is any conflict between this DPA and the Agreement, this DPA shall prevail to the extent of that conflict.

2.3. Any claims brought under or in connection with this DPA shall be subject to the terms and conditions, including but not limited to, the exclusions and limitations set forth in the Agreement.

2.4. Company further agrees that any regulatory penalties incurred by Augumenta in relation to the Company Data that arise as a result of, or in connection with, Company’s failure to comply with its obligations under this DPA or any applicable Data Protection Laws shall count toward and reduce Augumenta’s liability under the Agreement as if it were liability to the Company under the Agreement.

2.5. No one other than a party to this DPA, its successors and permitted assignees shall have any right to enforce any of its terms (except to the extent that individuals are able to enforce their rights through SCCs).

2.6. This DPA shall be governed by and construed in accordance with governing law and jurisdiction provisions in the Agreement, unless required otherwise by SCCs or applicable Data Protection Laws.

3. Roles and Scope of Processing

3.1. Role of the Parties. As between Augumenta and Company, Company is a Controller of Company Data, and Augumenta shall Process Company Data only as a Processor acting on behalf of Company.

3.2. Company’s Processing of Personal Information. Company agrees that (i) it shall comply with its obligations as a Controller under Data Protection Laws in respect of its Processing of Personal Information and any Processing instructions it issues to Augumenta; and (ii) it has provided notice and obtained (or shall obtain) all consents and rights necessary under Data Protection Laws for Augumenta to Process Personal Information and provide the Services pursuant to the Agreement and this DPA.

3.3. Augumenta’s Processing of Company Data. Augumenta shall Process Company Data only for the purposes described in this DPA and only in accordance with Company’s documented, lawful instructions. The parties agree that this DPA and the Agreement set out the Company’s complete and final instructions to Augumenta in relation to the Processing of Company Data under the Agreement and Processing outside the scope of these instructions (if any) shall require prior written agreement between Company and Augumenta. Augumenta is prohibited from: (i) Selling Company Data; (ii) retaining, using, or disclosing Company Data for any purpose other than for the specific purpose of performing the Services specified in the Agreement, including retaining, using, or disclosing the Company Data for a commercial purpose other than providing the Services specified in the Agreement; or (iii) retaining, using, or disclosing the Company Data outside of the direct business relationship between Company and Augumenta. Augumenta will promptly inform Company if following Company’s instructions would result in a violation of Data Protection Law or where Augumenta must disclose Company Data in response to a legal obligation, unless the legal obligation prohibits Augumenta from making such disclosure. Notwithstanding anything to the contrary in this Section 3.3, Augumenta may Process Company Data as necessary to detect data security incidents or protect against fraudulent or illegal activity and to build or improve the quality of its products and services, provided that in the course of these activities Augumenta will not (i) permit any third party (other than Augumenta’s service providers or except as instructed by Company) to access Company Data or (ii) use the Company Data to modify or add to Personal Information it collected from a source that is not Company. By signing this Addendum, Augumenta certifies that it understands and will comply with the obligations herein.

3.4. Details of Data Processing

1. Subject Matter and Purpose: Augumenta Processes Company Data to provide the Services to Company and to perform Augumenta’s obligations under the Agreement (including this DPA) or as otherwise agreed by the parties. Those data Processing activities may include, for example, collecting names and email addresses of Company’s employees who have signed up to the Services, and collecting the same from Company’s partners whom have been invited to use the Services by the Company.
2. Duration: As between Augumenta and Company, the duration of the data Processing under this DPA is until the termination of the Agreement in accordance with its terms.
3. Categories of Individuals: Individuals whose Personal Information Augumenta processes are Company’s employees or Company’s partner’s employees and any individuals whose Personal Information is shared with Augumenta by Company.
4. Types of Personal Information: Augumenta will process any Personal Information that Company chooses to disclose to Augumenta because Augumenta offers Company the ability to upload any content into Augumenta’s systems. (Augumenta discourages Company from uploading sensitive Personal Information into Augumenta’s systems.)

3.5. Augumenta as Controller. Company acknowledges that Augumenta may collect information about any individual employed by Company or its partners who is assigned to interact with Augumenta and any individual accessing and/or using the Services through the Company’s account (“Users”). To the extent any such data is considered Personal Information under Data Protection Laws, Augumenta is the Controller of such data and accordingly shall Process such data in accordance with the Augumenta Privacy Policy and Data Protection Laws. Augumenta shall have a right to use and disclose this data for its legitimate business purposes relating to the operation, support, and use of the Services, such as billing, account management, technical support, product development, sales and marketing.

3.6. Tracking Technologies. Company acknowledges that in connection with the performance of the Services, Augumenta employs the use of cookies and unique identifiers that are mandatory for the core functionality of the Services (“Tracking Technologies”).

4. Individual Requests

4.1. Facilitation of Responses. The Services provide Company with a number of controls that Company may use to retrieve, correct, delete, or restrict Company Data, which Company may use to assist it in connection with its obligations under Data Protection Law, including its obligations relating to responding to requests from individuals or applicable data protection authorities. To the extent that Company is unable to independently access the relevant Company Data within the Services, Augumenta shall (at Company’s expense) provide reasonable cooperation to assist Company to respond to any requests from individuals or applicable data protection authorities relating to the Processing of Company Data under the Agreement.

4.2. Requests Received by Augumenta. Should Augumenta receive any requests from individuals to exercise their rights, Augumenta shall notify the individual of the need to submit the request directly to Company, and shall promptly notify Company of the request, unless Augumenta is legally prohibited from providing such notification.

5. Government Requests

5.1. Requests Received by Augumenta. If a governmental authority (e.g. a European data protection authority) sends Augumenta a demand for Company Data (for example, through a court order), Augumenta shall attempt to redirect the law enforcement agency to request that data directly from Company. As part of this effort, Augumenta may provide Company’s basic contact information to the governmental authority. If compelled to disclose Company Data to a governmental authority, then Augumenta shall give Company reasonable notice of the demand to allow Company to seek a protective order or other appropriate remedy unless Augumenta is legally prohibited from doing so.

5.2. Cooperation. Where required in connection with requests from a government authority, Augumenta will immediately inform Company and will reasonably cooperate to provide Company with records related to its Processing activities in connection with the Agreement, including information on the categories of Company Data Processed and the purposes of the Processing, the use of Subprocessors with respect to such Processing, any data disclosures or transfers to third parties, and a general description of technical and organizational measures used to protect the security of such data.

6. Subprocessing

6.1. Authorized Subprocessors. Company agrees that Augumenta may engage Subprocessors to Process Company Data on Company’s behalf. The Subprocessors currently engaged by Augumenta and authorized by Company are listed here.

6.2. Subprocessor Obligations. Augumenta shall: (i) enter into a written agreement with the Subprocessor imposing data protection terms that require the Subprocessor to protect the Company Data to the standard required by Data Protection Laws; and (ii) remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the Subprocessor that cause Augumenta to breach any of its obligations under this DPA.

6.3 Changes to Subprocessors. Augumenta shall (i) provide an up-to-date list of the Subprocessors it has appointed upon written request from Company; and (ii) notify Company (for which email shall suffice) if it adds or changes Subprocessors at least then (10) calendar days prior to any such changes. Company may object in writing to Augumenta’s appointment of a new or changed Subprocessor within five (5) calendar days of such notice, provided that such objection is based on reasonable grounds relating to data protection. In such event, the parties shall discuss such concerns in good faith with a view to achieving resolution. If this is not possible, Company may suspend or terminate the Agreement (without prejudice to any fees incurred by Company prior to suspension or termination).

7. Security

7.1. Security Measures. Augumenta shall implement and maintain appropriate technical and organizational security measures to protect Company Data from Security Incidents and to preserve the security and confidentiality of the Company Data, in accordance with Augumenta’s security standards described in this DPA.

7.2. Updates to Security Measures. Company is responsible for reviewing the information made available by Augumenta relating to data security and making an independent determination as to whether the Services meet Company’s requirements and legal obligations under Data Protection Laws. Company acknowledges that the Security Measures are subject to technical progress and development and that Augumenta may update or modify the Security Measures from time to time provided that such updates and modifications do not result in the degradation of the overall security of the Services purchased by the Company.

7.3. Confidentiality of Processing. Augumenta shall ensure that any person who is authorized by Augumenta to Process Company Data (including its staff, agents and subcontractors) shall be under an appropriate obligation of confidentiality (whether a contractual or statutory duty).

7.4. Security Incident Response. Upon becoming aware of a Security Incident, Augumenta shall notify Company without undue delay and shall provide timely information relating to the Security Incident as it becomes known or as is reasonably requested by Company.

7.5. Company Responsibilities. Notwithstanding the above, Company agrees that except as provided by this DPA, Company is responsible for its secure use of the Services, including securing its account authentication credentials, protecting the security of Company Data when in transit to and from the Services and taking any appropriate steps to securely encrypt or backup any Company Data uploaded to the Services.

8. International Transfers

8.1. Data center locations. Augumenta stores all Personal Information in datacenters located in the European Economic Area.

8.2. Transfer Mechanism. Augumenta shall not transfer Personal Information from the European Economic Area to other jurisdictions.

9. Return or Deletion of Data

9.1. Upon termination or expiration of the Agreement, Augumenta shall (at Company’s election) delete (after providing Company the ability to download, pursuant to the Agreement) all Company Data (including copies) in its possession or control, save that this requirement shall not apply to the extent Augumenta is required by applicable law to retain some or all of the Company Data, which Company Data Augumenta shall securely isolate and protect from any further Processing, except to the extent required by applicable law.

10. Cooperation

10.1. Augumenta shall (at Company’s expense) provide reasonably requested information regarding the Services to enable the Company to carry out data protection impact assessments or prior consultations with data protection authorities as required by law.

11. Changes to DPA

11.1. Changes to DPA. Augumenta may be required to update this DPA in order to comply with applicable law, and in such case Augumenta will provide reasonable notice of any such updates.

Last Updated: September, 2020 (2020.v1)