Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of and supplements the existing customer agreement (“Agreement”) between Patlytics, Inc. (“Patlytics”), and the counterparty to the Agreement (“Customer”). If any conflict arises between this DPA and the Agreement, the terms of this DPA prevail. Capitalized terms used in this DPA that are not otherwise defined will have the meanings given to them under the Agreement or applicable Data Protection Laws, whichever is more protective of Personal Data.

Customer and Patlytics agree as follows:

1. Definitions. For purposes of this DPA:
   
   1. “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control,” for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
   2. “Approved Data Transfer Mechanisms” means, as applicable, the SCCs, the UK Addendum, or any data transfer mechanism a supervisory authority approves under Data Protection Laws that is incorporated into this DPA.
   3. “Data Protection Laws” means all applicable laws, regulations, and other legal or self-regulatory requirements in any jurisdiction relating to privacy, data protection, data security, breach notification, or the Processing of Personal Data, including without limitation, to the extent applicable, the General Data Protection Regulation, Regulation (EU) 2016/679 (“EU GDPR”), the EU Directive 2002/58/EC (the “ePrivacy Directive”), the national laws of each European Economic Area member state made under, pursuant to, or that implement the EU GDPR or the ePrivacy Directive, the EU GDPR as it forms part of United Kingdom law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the “UK GDPR”), the United Kingdom Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003, and the Swiss Federal Act on Data Protection (“FADP”); and the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”), including its regulations and the amendments made by the California Privacy Rights Act of 2020 (“CPRA”), the Virginia Consumer Data Protection Act (“VCDPA”), the Colorado Privacy Act and related regulations (“CPA”), the Utah Consumer Privacy Act (“UCPA”), and the Connecticut Act Concerning Personal Data Privacy and Online Monitoring (“CTDPA”) (collectively, beginning with the CCPA, the “U.S. Privacy Laws”). For the avoidance of doubt, each of the laws referred to in this definition applies as amended or superseded from time to time and, if a Party’s activities involving Personal Data are not within the scope of a given Data Protection Law, such law is not applicable for purposes of this DPA.
   4. “Personal Data” includes “personal data,” “personal information,” “personally identifiable information,” and analogous terms, as defined by Data Protection Laws, that Patlytics Processes in relation to the provision of the Services under the Agreement, as further described in Annex I. 
   5. “Process” and its cognates “Processing,” “Processed,” etc. mean any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, creating, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
   6. “SCCs” means where the EU GDPR or the FADP applies, the standard contractual clauses set out in the European Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries according to the EU GDPR, being: (i) where Customer is a Controller, Module Two (Transfer: Controller to Processor); and (ii) where Customer is a Processor, Module Three (Transfer: Processor to Processor).
   7. “Security Breach” means any confirmed unlawful acquisition, destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
   8. “Services” means the services that Patlytics performs on behalf of Customer pursuant to the Agreement.
   9. “Sub-processor” means any third party or Patlytics Affiliate that Patlytics engages to Process Personal Data. 
   10. “UK Addendum” means where the UK GDPR applies, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the United Kingdom Information Commissioner under section 119A(1) of the United Kingdom Data Protection Act 2018.
   11. The terms “Business,” “Consumer,” “Controller,” “Data Subject,” “Processor,” and “Service Provider” are defined as in Data Protection Laws. “Controller” is deemed to also refer to “Business,” and “Processor” is deemed to also refer to “Service Provider.” “Data Subject” is deemed to include “Consumer.”
2. Roles of the Parties; Scope and Purposes of Processing. 
   
   1. Unless otherwise specified, this DPA applies to all Personal Data that Patlytics Processes in relation to the Agreement.
   2. To the extent that Customer is the Controller of Personal Data, Patlytics is its Processor. To the extent that Customer is a Processor of Personal Data, Patlytics is its sub-processor (within the meaning of Data Protection Laws).
   3. Patlytics will Process Personal Data solely: (1) to fulfill its obligations to and documented instructions from Customer under the Agreement, including this DPA; (2) on Customer’s behalf; and (3) in compliance with Data Protection Laws. Patlytics will:
      
      1. not retain, use, or disclose Personal Data outside of the direct business relationship between Customer and Patlytics, except to the extent strictly required by applicable law to retain, use, or disclose such Personal Data;
      2. not “sell” any Personal Data, as such term is defined in U.S. Privacy Laws (regardless of whether any such laws apply);
      3. not “share” any Personal Data, as such term is defined in the CCPA (regardless of whether the CCPA applies);
      4. comply with any applicable restrictions under Data Protection Laws on combining Personal Data with personal data that Patlytics receives from, or on behalf of, another person or persons, or that Patlytics collects from any interaction between it and any individual;
      5. not attempt to re-identify any pseudonymized or otherwise de-identified Personal Data received from Customer without Customer’s express written permission;
      6. not otherwise engage in any Processing of Personal Data that is prohibited or not permitted by Processors or Service Providers under Data Protection Laws;
      7. will use commercially reasonable efforts to provide the level of protection for the Personal Data subject to the CPRA as is required under the CPRA; and
      8. promptly inform Customer if, in Patlytics’ opinion, an instruction from Customer infringes Data Protection Laws.
   4. Where Customer acts as a Processor, Customer represents and warrants that it has obtained the relevant Controller’s authorization to engage Patlytics as a sub-processor, that Customer’s instructions to Patlytics are consistent with the Controller’s instructions to Customer, and that Customer is authorized to enter into this DPA (including the Approved Data Transfer Mechanisms) on the Controller’s behalf. Customer shall      disclose      to Patlytics the identity of the Controller and any Controller instructions applicable to Patlytics’ Processing, and Patlytics may treat Customer as its sole point of contact for all matters arising under this DPA.
3. Personal Data Processing Requirements. Patlytics will: 
   
   1. Ensure that the persons it authorizes to Process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. 
   2. Assist Customer in the fulfillment of Customer’s obligations to respond to verifiable requests by Data Subjects (or their lawful representatives) for exercising their rights under Data Protection Laws (such as rights to access or delete Personal Data). 
   3. Promptly notify Customer of any Data Subject requests to exercise their rights under Data Protection Laws with regard to the Personal Data or any government request for access to or information about Customer’s Processing of Personal Data on Customer’s behalf (collectively, “Personal Data Request”), unless prohibited by applicable law from making such notification. Unless otherwise required by applicable law, if Patlytics receives a Personal Data Request, after notifying Customer of such request, Patlytics will await written instructions from Customer on how, if at all, to assist in responding. Patlytics will provide Customer with reasonable and timely cooperation and assistance in relation to any Personal Data Request.
   4. Solely to the extent that such Processing activities are within Patlytics’ control and directly relate to the Services, Patlytics will provide reasonable assistance to and cooperation with Customer for Customer’s (i) performance of a data protection impact assessment of Processing or proposed Processing of Personal Data, when required by Data Protection Laws; and/or (ii) consultation with regulatory authorities in relation to the Processing or proposed Processing of Personal Data, including complying with any applicable obligation upon Patlytics to consult with a regulatory authority in relation to Patlytics’ Processing or proposed Processing of Personal Data.
4. Data Security. Patlytics will implement appropriate administrative, technical, physical, and organizational measures to protect Personal Data, as set forth in Annex II. 
5. Security Breach. Patlytics will notify Customer of any Security Breach promptly, and in any event within seventy-two (72) hours after becoming aware of such Security Breach. Patlytics will comply with the Security Breach-related obligations directly applicable to it under Data Protection Laws and will assist Customer in Customer’s compliance with its Security Breach-related obligations, including without limitation by:
   
   1. Taking steps to mitigate the effects of the Security Breach and reduce the risk to Data Subjects whose Personal Data was involved, at Patlytics’ own expense to the extent the Security Breach arose within Patlytics’ systems or security infrastructure, and otherwise at Customer’s reasonable expense to the extent the Security Breach was caused by Customer’s acts or omissions; and
   2. Providing Customer with the following information, to the extent known: 
      
      1. The nature of the Security Breach, including, where possible, how the Security Breach occurred, the categories and approximate number of Data Subjects concerned, and the categories and approximate number of Personal Data records concerned;
      2. The likely consequences of the Security Breach; and
      3. Measures taken or proposed to be taken by Patlytics to address the Security Breach, including, where appropriate, measures to mitigate its possible adverse effects.
6. Sub-processors. 
   
   1. Customer acknowledges and agrees that Patlytics may use Sub-processors to Process Personal Data in accordance with the provisions within this DPA and Data Protection Laws. Where Patlytics sub-contracts any of its rights or obligations concerning Personal Data under this DPA to a Sub-processor, Patlytics will: (i) take steps to select and retain Sub-processors that are capable of maintaining appropriate privacy and security measures to protect Personal Data consistent with Data Protection Laws; (ii) enter into a written agreement with each Sub-processor requiring it to comply with obligations at least as restrictive as those imposed on Patlytics under this DPA; and (iii) remain liable to Customer for any breach of this DPA caused by an act or omission of a Sub-processor to the same extent Patlytics would be liable under this DPA had Patlytics itself committed such act or omission.
   2. Patlytics will maintain an up-to-date list of its Sub-processors. The initial list is provided in Annex III of this DPA, and Customer authorizes Patlytics’ use of the Sub-processors on this list. To the extent required by applicable Data Protection Laws, Patlytics will provide Customer notice of any new Sub-processor (in writing, which may include by email or through a subscription mechanism Patlytics makes available on its website), and will allow Customer thirty (30) days, beginning the day Patlytics gives such notice, to object to such appointment. If Customer has legitimate objections to the appointment of a new Sub-processor, Patlytics will work with Customer in good faith to resolve the grounds for the objection.
7. Data Transfers.
   
   1. In the event that Patlytics will transfer Personal Data from the European Union, the European Economic Area and/or its member states (collectively, “EEA”) and/or the United Kingdom where the transfer is either prohibited by applicable Data Protection Laws or permitted to proceed only if certain additional requirements specified by applicable Data Protection Laws are fulfilled (a “Restricted Transfer”), Section 7(b) and/or Section 7(c), as applicable, of this DPA shall apply.
   2. The SCCs apply to a Restricted Transfer of Personal Data under this DPA from the EEA. Customer agrees the SCCs are completed and supplemented as follows:
      
      1. Customer is the data exporter and Patlytics is the data importer;
      2. Module Two applies where Customer is a Controller, and Module Three applies where Customer is a Processor, in each case as designated by Customer in Annex I(A);
      3. The optional docking clause under Clause 7 of the SCCs will not apply;
      4. option 2 under Clause 9 of the SCCs applies and Customer generally authorizes Patlytics to engage Sub-processors according to, and the time period for prior notice of Sub-processor changes shall be as set out in, Section 6 of this DPA;
      5. the optional redress language under Clause 11(a) of the SCCs will not apply;
      6. the governing law under Clause 17 of the SCCs will be Ireland;
      7. the choice of forum and jurisdiction under Clause 18 of the SCCs will be the courts of Ireland;
      8. Annexes I, II and III of the SCCs are deemed to be populated with the information set out in Annexes I, II and III of this DPA; and
      9. Annex IV of this DPA supplements the SCCs with additional clauses as described therein.
   3. The UK Addendum applies to a Restricted Transfer of Personal Data under this DPA from the United Kingdom, and the Customer agrees the UK Addendum is completed and supplemented as follows:
      
      1. Customer is the data exporter and Patlytics is the data importer;
      2. Table 1 of the UK Addendum is deemed to be populated with the information set out in Annex I of this DPA;
      3. for the purposes of Table 2 of the UK Addendum, the version of the “Approved EU SCCs” (including the appendix information, modules and selected clauses) appended to the UK Addendum is the SCCs;
      4. the optional docking clause under Clause 7 of the SCCs will not apply;
      5. option 2 under Clause 9 of the SCCs applies and Customer generally authorizes Patlytics to engage Sub-processors according to, and the time period for prior notice of Sub-processor changes shall be as set out in, Section 6 of this DPA;
      6. the optional redress language under Clause 11(a) of the SCCs will not apply;
      7. Annex IV of this DPA supplements the SCCs with additional clauses as described therein;
      8. Table 3 of the UK Addendum is deemed to be populated with the information set out in Annexes I, II and III of this DPA;
      9. The “importer” and “exporter” option applies for the purposes of Table 4 of the UK Addendum;
      10. under Part 2, the mandatory clauses of the UK Addendum will apply; and
      11. by using the Services to transfer Personal Data to Patlytics, Customer will be deemed to have signed the UK Addendum.
   4. The terms applicable to the transfer of Personal Data under this DPA from any other country or region are listed in Annex IV of this DPA and are hereby incorporated into this DPA.
   5. In the event of any conflict between the SCCs or UK Addendum and the terms of this DPA, the terms of the SCCs or UK Addendum shall prevail. 
8. Audits. Patlytics will provide Customer with all such information as may be reasonably requested by Customer from time to time with regard to Patlytics’ compliance with this DPA. Customer may conduct an audit to confirm Patlytics’ compliance with this DPA by submitting a data protection questionnaire of reasonable length not more than once annually. Patlytics shall promptly complete and return such questionnaire to Customer. To the extent Customer is able to demonstrate that Patlytics’ questionnaire responses do not provide sufficient information to demonstrate compliance with this DPA, Customer may conduct follow up interviews with Patlytics’ personnel as needed.
9. Return or Destruction of Personal Data. Except to the extent required otherwise by applicable law, Patlytics will, at the choice of Customer, return to Customer and/or securely destroy all Personal Data upon (a) written request of Customer or (b) termination of the Agreement. Except to the extent prohibited by applicable law, Patlytics will inform Customer if it is not able to return or delete Personal Data. 
10. Governing Law. To the extent Data Protection Laws require this DPA to be governed by the law of a European Union or European Economic Area member state or of the United Kingdom, this DPA is governed by the laws of Ireland (or, where the UK GDPR applies, the laws of England and Wales) solely to that extent, without prejudice to the governing law provisions of the SCCs and the UK Addendum. In all other respects, the governing law and dispute resolution provisions of the Agreement apply to this DPA.
11. Survival. The provisions of this DPA survive the termination or expiration of the Agreement for so long as Patlytics or its Sub-processors Process Personal Data. 
    

‍

‍

‍

IN WITNESS WHEREOF, the parties have entered into this DPA as of the date of the Agreement.

<div class="legal-2col">
<div class="legal-col">
<p class="paragraph-rg text-weight-bold margin-bot-sm">Patlytics, Inc.</p>
<p class="paragraph-rg text-weight-bold">By: _______________________</p>
<p class="paragraph-rg text-weight-bold">Name: ____________________</p>
<p class="paragraph-rg text-weight-bold">Title: _____________________</p>
</div>
<div class="legal-col">
<p class="paragraph-rg text-weight-bold margin-bot-sm">[Insert Customer Entity Name]</p>
<p class="paragraph-rg text-weight-bold">By: _______________________</p>
<p class="paragraph-rg text-weight-bold">Name: ____________________</p>
<p class="paragraph-rg text-weight-bold">Title: _____________________</p>
</div>
</div>

‍

‍

‍

Annex I

APPROVED DATA TRANSFER MECHANISM: DESCRIPTION OF PROCESSING AND TRANSFER

1. LIST OF PARTIES

MODULE TWO: Transfer Controller to Processor / MODULE THREE: Transfer Processor to Processor

Data exporter(s): 

• Name: Customer, as identified in the Agreement.
• Address: As provided in the Agreement.
• Contact person’s name, position, and contact details: As provided in the Agreement.
• Activities relevant to the data transferred under these Clauses: The data exporter receives the data importer’s Services pursuant to their underlying Agreement.
• Signature and date: The Parties agree that execution of the Agreement shall constitute execution of these SCCs by both parties. 
• Role: [   ] Controller     [   ] Processor     (Customer to select one. If Customer selects Processor, Module Three applies. If Customer selects Controller, or makes no selection, Customer is deemed to act as a Controller and Module Two applies.)

Data importer(s): 

• Name: Patlytics, as identified in the Agreement. 
• Address: As provided in the Agreement.
• Contact person’s name, position, and contact details: As provided in the Agreement.
• Activities relevant to the data transferred under these Clauses: The data importer provides Services to the data exporter pursuant to their underlying Agreement.
• Signature and date: The Parties agree that execution of the Agreement shall constitute execution of these SCCs by both parties.
• Role: Processor

B. DESCRIPTION OF TRANSFER

MODULE TWO: Transfer Controller to Processor / MODULE THREE: Transfer Processor to Processor

• Categories of data subjects whose personal data is transferred: The Personal Data transferred concerns Personal Data of users of Customer services, which may include, but is not limited to, Customer employees and individual employees or contractors of Customer’s customers, partners, agents, & vendors (“Customer Users”).
• Categories of personal data transferred: The Personal Data transferred concern the following categories of data: information about Customer Users, including but not limited to, contact information, authentication data, device and network information, financial information, employment information, government identifiers, & personal identifiers (date of birth, gender).
• Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures: Customer does not anticipate the transfer of any sensitive data (including special categories of personal data under Article 9 of the EU GDPR or UK GDPR, or data relating to criminal convictions and offences under Article 10) with respect to Customer Users, and Customer will not submit such data to the Services.
• The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): Continuous for the duration of the Agreement.
• Nature of the processing: Data importer’s Processing activities shall be limited to those discussed in the Agreement and the DPA.
• Purpose(s) of the data transfer and further processing: The purpose of the transfer to and further Processing of Personal Data by Patlytics is for Patlytics to provide the Services to Customer.
• The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: Personal Data will be retained for the period of time necessary for Patlytics to provide the Services to Customer under the Agreement and/or in accordance with applicable legal requirements.
• For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: Same as above to the extent that Personal Data is provided to Sub-processors for purposes of providing the Services.

C. COMPETENT SUPERVISORY AUTHORITY

MODULE TWO: Transfer Controller to Processor / MODULE THREE: Transfer Processor to Processor

To the extent legally permitted, the competent supervisory authority is the Irish Data Protection Commission.

‍

‍

‍

Annex II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

1. SCOPE
   
   1. Security Policy. Patlytics will comply in all respects with Patlytics’ information security requirements set forth in this Annex II (“Security Policy”). The Security Policy applies to Patlytics’ performance under the Agreement and all access, collection, use, storage, transmission, disclosure, destruction or deletion of, and security incidents regarding all Personal Data. This Security Policy does not limit other obligations of Patlytics, including under the Agreement or any laws that apply to Patlytics, Patlytics’ performance under the Agreement, the Personal Data or the Permitted Purpose. 
   2. Permitted Purpose. Patlytics may collect, use, store and retain only the Personal Data that is expressly authorized under the Agreement, and then may only collect, use, store and retain that Personal Data solely as necessary for Patlytics to perform the Services in accordance with the Agreement (“Permitted Purpose”). 
2. REQUIREMENTS
   
   1. Patlytics Security Policy. Patlytics will implement and enforce a written information and network security policy for employees, subcontractors, agents, and suppliers that meets the standards set out in the Agreement.
   2. Basic Security Requirements. Patlytics will, consistent with current industry standards and such other requirements specified by Customer based on the classification and sensitivity of Personal Data, maintain physical, administrative and technical safeguards and other security measures (i) to maintain the security and confidentiality of Personal Data accessed, collected, used, stored or transmitted by Patlytics, and (ii) to protect that information from known or reasonably anticipated threats or hazards to its security and integrity, accidental loss, alteration, disclosure and all other unlawful forms of processing. Without limitation, Patlytics will comply with the following requirements:
      
      1. Firewall. Patlytics will install and maintain a working network firewall or equivalent to protect data accessible via the Internet and will keep all Personal Data protected at all times. The firewall must provide both ingress and egress filtering, and have a default policy of blocking network traffic.
      2. Updates. Patlytics will keep its systems and software up-to-date with the latest upgrades, updates, bug fixes, new versions and other modifications necessary to ensure security of the Personal Data.
      3. Anti-virus. Patlytics will at all times use industry standard anti-virus software on endpoints and scanning technologies for the production environment, and regularly updated signature files, to ensure that all operating systems, software and other systems hosting, storing, processing, or that have access to Personal Data and are known to be susceptible or vulnerable to being infected by or further propagating viruses, spyware and malicious code, are and remain free from such viruses, spyware and malicious code. Patlytics will mitigate threats from all viruses, spyware, and other malicious code that are or should reasonably have been detected.
   3. Testing. Patlytics will regularly test its security systems and processes to ensure they meet the requirements of this Security Policy.
   4. Access Controls. Patlytics will restrict access to Personal Data to only those people with a “need-to-know” for a Permitted Purpose.
   5. Encryption. Patlytics will store and transmit all Personal Data using industry standard algorithms and methods on portable media or portable devices.
   6. Data Retention and Destruction. 
      
      1. Retention. Patlytics will retain Personal Data only for the purpose of, and as long as is necessary for, the Permitted Purpose.
      2. Return or Deletion. Patlytics will promptly, and in any event within 72 hours after Customer’s request, return to Customer and permanently and securely delete all Personal Data upon and in accordance with Customer’s notice requiring return and/or deletion. Also, Patlytics will permanently and securely delete all live (online or network accessible) instances of the Personal Data within 30 days after the earlier of completion of the Permitted Purpose or termination or expiration of the Agreement.
   7. Disaster Recovery / Business Continuity. Patlytics will implement appropriate disaster recovery and business continuity plans that will ensure the availability, security, integrity, and (where necessary) restoration of the Personal Data on the occurrence of a business interruption event. Patlytics will provide a copy of its disaster recovery and business continuity plans to Customer upon request.
   8. Security Incidents. Patlytics will inform Customer without undue delay, and in any event, within seventy-two (72) hours of detecting any confirmed unlawful acquisition, destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data (“Security Breach”). Patlytics will remedy each Security Breach in a timely manner and provide Customer written details regarding Patlytics’ internal investigation regarding each Security Breach.
      

‍

‍

‍

Annex III

LIST OF SUB-PROCESSORS

‍

‍

‍

Annex IV

SUPPLEMENTAL CLAUSES

SWITZERLAND

The SCCs as adapted and supplemented as set forth in this section will only apply to a transfer of Personal Data Processed under this DPA where the transfer is a Restricted Transfer from Switzerland. Customer agrees that:

1. Any reference to “Member State” will not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland);

2. Any references to “personal data” extend to personal data of legal entities if and to the extent such personal data pertaining to legal entities is within the scope of the Swiss Federal Act on Data Protection (“FADP”); and

3. To the extent the transfer of personal data is governed by the FADP, the Swiss Federal Data Protection and Information Commissioner will act as the competent supervisory authority; to the extent the transfer of personal data is governed by the GDPR, the supervisory authority determined in Annex I(C) will act as the competent supervisory authority; any references to the “competent supervisory authority” will be interpreted accordingly.