Legal
This Data Processing Agreement ("DPA") is by and between Keystrike Inc. (the "Data Processor") and the entity or individual executing this DPA (the "Company"). It reflects the Parties' agreement with respect to the processing of personal data by the Data Processor on behalf of the Company in connection with the Data Processor's services under the Hybrid Cloud Subscription Terms of Service and License Agreement (the "ToS and LA").
By signing this DPA through electronic means, such as an acceptance box, the Company agrees to be bound by its terms as of the date of signature (the "Effective Date").
Data Processor
Keystrike Inc.Company
The corporation, limited liability company, partnership, sole proprietorship, other business entity, or individual executing this DPA.Whereas: (A) the Company acts as a Data Controller; (B) the Company wishes to subcontract certain services which imply the processing of personal data to the Data Processor; and (C) the Parties seek to implement a data processing agreement that complies with the requirements of the General Data Protection Regulation (EU) no. 2016/679 ("GDPR").
1.1This DPA reflects the Parties' agreement with respect to the processing of personal data by the Data Processor on behalf of the Company in connection with the Data Processor's services under the ToS and LA between the Company and the Data Processor.
1.2By signing this DPA with electronic means, such as by acceptance box, the Company agrees to be bound by this DPA as of the date of signature (the "Effective Date").
2.1On behalf of the Company, the Data Processor is permitted to process the personal data necessary to provide the services described under the ToS and LA and otherwise for the processing activities described below.
2.2The processing of personal data is for the purposes of the following Processing Activities:
2.3The Data Processor is permitted to process the following types of Personal Data, as further described in the Data Processor's Privacy Policy:
2.4The Data Processor is permitted to process the following categories of Data Subjects:
3.1The Data Processor shall:
Comply with all applicable data protection law in the processing of Company Personal Data.
Only process Company Personal Data in accordance with this DPA.
Only process Company Personal Data in accordance with the Company's documented instructions, which are identified in this DPA. Where the Data Processor believes an instruction is incompatible with the GDPR or other relevant legal provisions, it must notify the Company without delay.
Ensure that employees who have access to personal data in connection with the execution of the contract have signed a confidentiality statement or are bound by law to confidentiality, and that they receive appropriate training in the protection of personal data.
Make sure that devices, products, programmes, and services are designed with built-in and default personal data protection as a guiding principle.
4.1As a general authorisation of the Company, the Data Processor is entitled to engage another processor (a "Sub-Processor").
4.2The Data Processor's use of Sub-Processors is based on written agreements that ensure the continuation of at least the same level of protection as the level specified in this DPA.
4.3At the acceptance of this DPA, the Company simultaneously authorises the Data Processor's use of the Sub-Processors listed below:
4.4As a consequence of the general authorisation in Section 4.1, the Data Processor shall inform the Company of any intended changes concerning the addition or replacement of Sub-Processors with 14 days' notice, giving the Company the opportunity to object within 10 days. If the Company objects and the Data Processor cannot meet the content of that objection, the services described in the ToS and LA will be considered terminated by the Company.
4.5When using a Sub-Processor, the Data Processor shall ensure the Sub-Processor is subject to the same data protection obligations as those specified in this DPA, on the basis of a contract or other legal document under EU law or the national law of the Member States, providing in particular the necessary guarantees that the Sub-Processor will implement appropriate technical and organisational measures such that the processing meets GDPR requirements.
4.6If the Sub-Processor does not fulfil its data protection obligations, the Data Processor remains liable to the Company for the fulfilment of the Sub-Processor's obligations, as required by the GDPR.
5.1The Company is responsible for providing the data subject with information about the processing activity before or as soon as processing begins, in accordance with the provisions of the GDPR on information that must be provided to the data subject, including Articles 13 and 14.
6.1Taking into account the nature of the processing, the Data Processor shall assist the Company by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Company's obligations to respond to requests to exercise Data Subject rights under the GDPR.
6.2The Data Processor shall:
7.1Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Data Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.
In assessing the appropriate level of security, the Data Processor takes into account in particular the risks presented by the processing.
8.1The Data Processor shall notify the Company without undue delay upon becoming aware of a Personal Data Breach affecting Company Personal Data, providing the Company with sufficient information to allow it to meet any obligations to report or inform Data Subjects of the breach under applicable data protection laws. The notification must be accompanied by the documents or data necessary for the Company to report the breach to the relevant supervisory authority.
8.2The Data Processor shall cooperate with the Company and take reasonable commercial steps as directed by the Company to assist in the investigation, mitigation, and remediation of each such Personal Data Breach.
9.1The Data Processor shall provide reasonable assistance to the Company with any data protection impact assessments, and prior consultations with competent data privacy authorities, which the Company reasonably considers to be required by Article 35 or 36 of the GDPR or equivalent provisions of any other applicable data protection law — in each case solely in relation to processing of Company Personal Data, and taking into account the nature of the processing and information available to the Data Processor.
10.1Subject to this section, the Data Processor shall make available to the Company on request all information necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits, including inspections, by the Company or an auditor mandated by the Company in relation to the processing of Company Personal Data.
10.2The Company and the Data Processor shall mutually decide the procedures of inspections, the type of audit report, and which authorised, independent third party shall carry out the audit and/or inspection.
10.3Information and audit rights of the Company only arise under this section to the extent the DPA does not otherwise give the Company information and audit rights meeting the relevant requirements of data protection law.
10.4The Company shall incur all costs related to the audit or inspection of the Data Processor's compliance with this DPA.
11.1Company Personal Data may only be transferred to, stored, or processed in a geographic location in accordance with this DPA. Taking into account the safeguards stipulated in this DPA, the Company appoints the Data Processor to transfer Company Personal Data to the United States or any other country in which the Data Processor or its Sub-Processors operate, store, and process the Company Personal Data for the purposes described in Section 2.
11.2The Data Processor will abide by the requirements of EU/EEA data protection law regarding the collection, use, transfer, retention, and other processing of Company Personal Data from the EU/EEA. All transfers of Company Personal Data to a third country will be subject to adequate protection in accordance with the GDPR.
11.3The Data Processor is certified under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework ("DPF") as administered by the U.S. Department of Commerce. The Data Processor adheres to the principles and obligations set out in these frameworks with respect to personal data transferred from the EU/EEA, the UK, and Switzerland to the United States.
The Data Processor's certification status is publicly available on the official Data Privacy Framework List maintained by the U.S. Department of Commerce at dataprivacyframework.gov, and is further described in the Data Processor's Privacy Policy.
12.1By signing this DPA with electronic means, such as by acceptance box, the Company agrees to be bound by this DPA as of the Effective Date. This DPA will remain in force until the termination of the processing of Company Personal Data and the erasure of the Company Personal Data by the Data Processor and any Sub-Processors.
13.1At the termination of this DPA, the Data Processor shall be under obligation, at the Company's discretion, to erase or return all Personal Data to the Company and to erase existing copies, unless EU law or national law requires the storage of the Personal Data.
13.2The Data Processor is entitled to erase Company Personal Data if the Company has not requested the return of the Personal Data within 30 days after the termination of this DPA.
14.1This DPA is governed by the internal laws of the State of Delaware, United States.
14.2Any dispute arising in connection with this DPA which the Parties are not able to resolve amicably will be submitted to the exclusive jurisdiction of the courts of the State of Delaware, United States, so long as other relevant recourse mechanisms — e.g. under the DPF — have been fully tested.
.svg)