Data Processing Agreement

1. Definitions

"Personal Data", "Processing", "Controller", "Processor", "Data Subject", "Personal Data Breach" and "Supervisory Authority" have the meanings given in the GDPR. "Customer Personal Data" means personal data processed by us on the Customer's behalf in providing the Service, as described in Annex I. "Sub-processor" means a third party we engage to process Customer Personal Data. "SCCs" means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.

2. Roles and scope

• For Customer Personal Data, the Customer is the Controller (or, where it acts for its own client, a Processor) and we are the Processor (or Sub-processor).
• We process Customer Personal Data only to provide the Service as described in Annex I. For the Customer's own account and billing data, we act as an independent controller as set out in our Privacy Policy, and this DPA does not apply to that data.
• The Customer is responsible for the lawfulness of its Processing instructions, for having a lawful basis for contacting each Data Subject, and for giving Data Subjects the information the law requires.

3. Instructions

• We process Customer Personal Data only on the Customer's documented instructions: the Terms of Service, this DPA, and the Customer's use of the Service's features. The Customer may give further reasonable written instructions, and we will follow them where they are technically possible and within the scope of the Service.
• We will tell the Customer if, in our opinion, an instruction breaks Data Protection Laws, and we may pause the affected processing until it is clarified.
• If the law requires us to process data otherwise, we will tell the Customer beforehand unless the law forbids it.

4. Confidentiality

We ensure everyone we authorise to access Customer Personal Data is bound by a duty of confidentiality, and that access is limited to people who need it to provide, support or secure the Service.

5. Security

We implement the technical and organisational measures in Annex II, taking account of the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to Data Subjects. We may update those measures if the update does not reduce the level of protection.

6. Sub-processors

• The Customer gives us general written authorisation to engage the Sub-processors listed in Annex III.
• We have a written contract with each Sub-processor that imposes data protection obligations no less protective than this DPA, and we remain responsible for their performance.
• We will tell the Customer, by email or by updating Annex III, before we add or replace a Sub-processor that will process Customer Personal Data. The Customer may object on reasonable data protection grounds within 14 days of the notice. If we cannot resolve the objection, the Customer may close its account and we will refund no fees for unused time except where the law requires.

7. Data Subject requests

Taking account of the nature of the processing, we help the Customer respond to requests from Data Subjects to exercise their rights (access, correction, deletion, restriction, portability, objection). The Service includes tools for the Customer to export or delete data and to record opt-outs. If we receive a request directly from a Data Subject whose data we process for the Customer, we will refer them to the Customer, unless the request is only to stop emails (we will block their address for that Customer) or the law requires otherwise.

8. Personal Data Breaches

We tell the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and provide the information we then have: the nature of the breach, the data and Data Subjects likely affected, the likely consequences, and the measures taken or proposed. We take reasonable steps to contain it and help the Customer meet its own notification duties. Our notice is not an admission of fault.

9. Assistance

We give the Customer reasonable help with its obligations on security, breach notification, data protection impact assessments and prior consultation with Supervisory Authorities, taking account of the nature of the processing and the information available to us.

10. International transfers

• We and our Sub-processors may process Customer Personal Data in countries outside the Customer's own, including the United States.
• Where Data Protection Laws require a transfer mechanism, the parties agree that the SCCs, Module Two (controller to processor), are incorporated into this DPA, and Module Three (processor to processor) where the Customer acts as a processor. Annex I describes the transfer; Annex II describes our security measures; Annex III lists our Sub-processors. Under Clause 9(a) the parties choose Option 2 (general authorisation, 14 days' notice). The optional wording in Clause 7 (docking clause) applies; the optional wording in Clause 11 does not. Under Clauses 17 and 18 the parties choose the law and courts of Ireland.
• For transfers subject to UK GDPR, the UK International Data Transfer Addendum to the SCCs is incorporated. For transfers subject to Swiss law, the SCCs apply with references to the GDPR read as references to the Swiss law and the Swiss authority as the competent authority.
• If a transfer mechanism is invalidated or replaced, we will work with the Customer in good faith to put another in place.

11. Audits

We give the Customer the information needed to show we comply with this DPA, and allow reasonable audits, including inspections, by the Customer or an auditor it appoints that is bound by confidentiality. Audits need 30 days' written notice, may happen no more than once a year (unless a Supervisory Authority requires otherwise or after a Personal Data Breach), take place during business hours, must not unreasonably disrupt our business or expose other customers' data, and are at the Customer's cost. We will first offer written answers and available documentation to meet the request.

12. Return and deletion

The Customer can export and delete Customer Personal Data while its account is active. When the account ends, we delete Customer Personal Data, except what the law requires us to keep, within a reasonable period. Copies in backups expire on their normal cycle and remain protected by this DPA until they are deleted. Opt-out records are deleted with the account.

13. The Customer's obligations

• Have a lawful basis, and give any required notices, for the Customer Personal Data it uploads and for contacting each Data Subject.
• Follow the Sending Policy, including honouring opt-outs and objections.
• Not upload special-category data (such as health data) or government identifiers.
• Use the Service's security features appropriately, including keeping its sign-in secure.

14. Liability and order of precedence

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where the law or the SCCs say otherwise. If this DPA conflicts with the Terms of Service on the protection of Personal Data, this DPA prevails. If it conflicts with the SCCs, the SCCs prevail.

15. Term and governing law

This DPA lasts as long as we process Customer Personal Data for the Customer. Except where the SCCs require otherwise, it is governed by the law that governs the Terms of Service.

Annex I. Description of the processing

Annex II. Technical and organisational measures

Annex III. Sub-processors

Some are used only if the Customer enables the related feature.

Signatures

This DPA applies automatically when the Customer accepts the Terms of Service. The Customer may also countersign a copy to keep for its records; to receive one, write to support@hy-lix.com.