This Data Processing Addendum (including all Schedules attached hereto, the “DPA”) is incorporated into, and is subject to the terms and conditions of, the Order Form, Customer Agreement (SaaS), or other written or electronic agreement (“Agreement”) between HumanSignal, Inc. (“HumanSignal”) and the entity identified as “Customer” in the Agreement (“Customer”). This DPA applies where HumanSignal’s Processing of Customer Personal Data is subject to the Data Protection Laws. This DPA shall be effective for the term of the Agreement.
1. Definitions
1.1 For the purposes of this DPA:
1.2 Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement.
2. Processing of Customer Personal Data
2.1 The parties acknowledge and agree that Customer is the Controller of Customer Personal Data and HumanSignal is a Processor of Customer Personal Data. HumanSignal will only Process Customer Personal Data as a Processor on behalf of and in accordance with Customer’s prior written instructions, including any instructions provided through Customer’s use of the HumanSignal Product. HumanSignal is hereby instructed to Process Customer Personal Data to the extent necessary to provide the HumanSignal Product as set forth in the Agreement. HumanSignal shall not (1) retain, use, or disclose Customer Personal Data other than as provided for in the Agreement, as needed to provide the HumanSignal Product, or as otherwise permitted by Data Protection Laws; or (2) Sell Customer Personal Data. HumanSignal certifies that it understands and will comply with the restrictions contained in this Section 2.1.
2.2 HumanSignal will immediately inform Customer if, in its opinion, an instruction from Customer infringes the Data Protection Laws.
2.3 The details of HumanSignal’s Processing of Customer Personal Data are described in Schedule 1.
2.4 If applicable laws preclude HumanSignal from complying with Customer’s instructions, HumanSignal will inform Customer of its inability to comply with the instructions, to the extent permitted by law.
2.5 Each of Customer and HumanSignal will comply with their respective obligations under the Data Protection Laws.
3. Cross-Border Transfers of Personal Data
3.1 With respect to Customer Personal Data originating from the European Economic Area (“EEA”) or Switzerland that is transferred from Customer to HumanSignal, the parties agree to comply with the general clauses and, where Customer is a Controller of Customer Personal Data, with “Module Two” (Controller to Processor) of the EU SCCs, which are incorporated herein by reference.
3.2 For purposes of the EU SCCs the parties agree that:
3.3 If the transfer of Customer Personal Data is subject to the Swiss Federal Act on Data Protection, the following provisions apply: (i) the Federal Data Protection and Information Commissioner (FDPIC) will be the competent supervisory authority under Clause 13 of the EU SCCs; (ii) the parties agree to abide by the GDPR standard in relation to all Processing of Customer Personal Data that is governed by the Swiss Federal Act on Data Protection; (iii) the term ‘Member State’ in the EU SCCs will not be interpreted in such a way as to exclude Data Subjects who habitually reside in Switzerland from initiating legal proceedings in Switzerland in accordance with Clause 18(c) of the EU SCCs; and (iv) references to the ‘GDPR’ in the EU SCCs will be understood as references to the Swiss Federal Act on Data Protection insofar as the transfer of Customer Personal Data is subject to the Swiss Federal Act on Data Protection.
3.4 With respect to transfers from Customer to HumanSignal of Customer Personal Data originating from the United Kingdom, the parties agree to comply with the UK SCCs, which are incorporated herein by reference. The parties agree that, for the purposes of the UK SCCs: (i) Customer shall act as and comply with the obligations of the “data exporter”, and HumanSignal shall act as and comply with the obligations of the “data importer”; (ii) all references to the “Directive 95/46/EC” and its provisions shall be deemed to refer to the relevant provisions of the UK GDPR and the Data Protection Act 2018 of the United Kingdom; (iii) all references to the “Commission” shall be deemed to refer to the Information Commissioner; (iv) all references to the “European Economic Area” or the “European Union” shall be deemed to refer to the United Kingdom; (v) for the purposes Appendix 1 to the UK SCCs, information about the exporter and importer, the categories of Data Subjects, types of Personal Data and type of Processing operations are as set out in Schedule 1 to this DPA; and (vi) for the purposes Appendix 2 to the UK SCCs, the security measures are as described Schedule 2. The parties acknowledge that the Information Commissioner’s Office has not yet approved new standard contractual clauses under the UK GDPR. The UK SCCs will apply only until such time as the Information Commissioner’s Office issues new standard contractual clauses under the UK GDPR. Once approved, the parties shall work together, in good faith, to enter into an updated version of the UK SCCs or negotiate an alternative solution to enable transfers of Customer Personal Data in compliance with Data Protection Laws.
4. Confidentiality and Security
4.1 HumanSignal will require its personnel who access Customer Personal Data to commit to protect the confidentiality of Customer Personal Data.
4.2 HumanSignal will implement commercially reasonable technical and organisational measures, as further described Schedule 2 that are designed to protect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
4.3 To the extent required by Data Protection Laws, HumanSignal will provide Customer with reasonable assistance as necessary for the fulfilment of Customer’s obligations under Data Protection Laws to maintain the security of Customer Personal Data.
5. Sub-Processing
5.1 Customer agrees that HumanSignal may engage sub-Processors to Process Customer Personal Data on Customer's behalf. The agreed list of sub-Processors currently engaged by HumanSignal and authorized by Customer are available Schedule 3 (the “Authorized Sub-Processors”). HumanSignal will inform Customer of any intended changes concerning the addition or replacement of any Authorized Sub-Processors and Customer will have an opportunity to object to such changes on reasonable grounds within seven days after being notified. If the parties are unable to resolve such objection, either party may terminate the Agreement by providing written notice to the other party.
5.2 HumanSignal will impose on its Authorized Sub-Processors substantially the same obligations that apply to HumanSignal under this DPA. Where any of its Authorized Sub-Processors fails to fulfil its data protection obligations, HumanSignal will be liable to Customer for the performance of its Authorized Sub-Processors’ obligations.
5.3 The parties agree that the copies of the Authorized Sub-Processor agreements that must be provided by HumanSignal to Customer pursuant to Clause 9(c) of the EU SCCs and Clause 5 of the UK SCCs, if applicable, may have commercial information or clauses unrelated to the EU or UK SCCs removed by HumanSignal beforehand; and, that such copies will be provided by HumanSignal, in a manner to be determined in its discretion, only upon Customer’s written request.
6. Data Subject Rights
Customer is responsible for responding to any Data Subject requests relating to Customer Personal Data (“Requests”). If HumanSignal receives any Requests during the term, HumanSignal will advise the Data Subject to submit the request directly to Customer or the appropriate Controller. HumanSignal will provide Customer with self-service functionality or other reasonable assistance to permit Customer to respond to Requests.
7. Personal Data Breaches
Upon becoming aware of a Personal Data Breach affecting Customer Personal Data, HumanSignal will (i) promptly take measures designed to remediate the Personal Data Breach and (ii) notify Customer without undue delay. Customer is solely responsible for complying with Personal Data Breach notification requirements applicable to Customer. At Customer’s request, HumanSignal will reasonably assist Customer’s efforts to notify Personal Data Breaches to the competent data protection authorities and/or affected Data Subjects, if Customer is required to do so under the Data Protection Laws. HumanSignal’s notice of or response to a Personal Data Breach under this Section 7 will not be an acknowledgement or admission by HumanSignal of any fault or liability with respect to the Personal Data Breach.
8. Data Protection Impact Assessment; Prior Consultation
Taking into account the nature of the Processing and the information available to HumanSignal, HumanSignal will reasonably assist Customer in conducting data protection impact assessments and consultation with data protection authorities if Customer is required to engage in such activities under applicable Data Protection Laws and such assistance is necessary and relates to the Processing by HumanSignal of Customer Personal Data.
9. Deletion of Customer Personal Data
Customer instructs HumanSignal to delete Customer Personal Data within 90 days of the termination of the Agreement and delete existing copies unless applicable law requires otherwise. The parties agree that the certification of deletion described in Clause 8.5 of the EU SCCs and Clause 12 of the UK SCCs, if applicable, shall be provided only upon Customer’s written request. Notwithstanding the foregoing, HumanSignal may retain Customer Personal Data to the extent and for the period required by applicable laws provided that HumanSignal maintains the confidentiality of all such Customer Personal Data and Processes such Customer Personal Data only as necessary for the purpose(s) specified in the applicable laws requiring its storage.
10. Audits
10.1 Customer may audit HumanSignal’s compliance with its obligations under this DPA up to once per year. In addition, Customer may perform more frequent audits (including inspections) in the event: (1) HumanSignal suffers a Personal Data Breach affecting Customer Personal Data; (2) Customer has genuine, documented concerns regarding HumanSignal’s compliance with this DPA or the Data Protection Laws; or (3) where required by the Data Protection Laws, including where mandated by regulatory or governmental authorities with jurisdiction over Customer Personal Data. HumanSignal will contribute to such audits by providing Customer or Customer’s regulatory or governmental authority with the information and assistance reasonably necessary to conduct the audit, including any relevant records of Processing activities applicable to the HumanSignal Product.
10.2 To request an audit, Customer must submit a detailed proposed audit plan to support@HumanSignal.com at least one month in advance of the proposed audit start date. The proposed audit plan must describe the proposed scope, duration, start date of the audit, and the identity of any third party Customer intends to appoint to perform the audit. HumanSignal will review the proposed audit plan and provide Customer with any concerns or questions (for example, HumanSignal may object to the third party auditor as described in Section 10.3, provide an Audit Report as described in Section 10.4, or identify any requests for information that could compromise HumanSignal confidentiality obligations or security, privacy, employment or other relevant policies). The parties will negotiate in good faith to agree on a final audit plan at least two weeks in advance of the proposed audit start date. Nothing in this Section 10 shall require HumanSignal to breach any duties of confidentiality.
10.3 HumanSignal may object to third party auditors that are, in HumanSignal’s reasonable opinion, not suitably qualified or independent, a competitor of HumanSignal, or otherwise manifestly unsuitable. Customer will appoint another auditor or conduct the audit itself if the parties cannot resolve the objection after negotiating in good faith.
10.4 If the requested audit scope is addressed in an SSAE 16/ISAE 3402 Type 2, ISO, NIST or similar audit report performed by a qualified third party auditor on HumanSignal’s systems that Process Customer Personal Data (“Audit Reports”) within twelve (12) months of Customer’s audit request and HumanSignal confirms there are no known material changes in the controls audited, Customer agrees to accept the Audit Report in lieu of requesting an audit of the controls covered by the Audit Report.
10.5 The audit must be conducted at a mutually agreeable time during regular business hours at the applicable facility, subject to the agreed final audit plan and HumanSignal’s health and safety or other relevant policies and may not unreasonably interfere with HumanSignal business activities.
10.6 Any audits are at Customer’s expense and Customer will promptly disclose to HumanSignal any perceived non-compliance or security concerns discovered during the audit, together with all relevant details.
10.7 The parties agree that the audits described in Clause 8.9 of the EU SCCs and Clause 5(f) of the UK SCCs, if applicable, shall be performed in accordance with this Section 10.
11. Analytics Data
Customer acknowledges and agrees that HumanSignal may create and derive from Processing related to the HumanSignal Product anonymized and/or aggregated data that does not identify or relate to Customer or any Data Subject (“Analytics Data”), and use, publicize or share with third parties such Analytics Data to improve the HumanSignal Product and for HumanSignal’s other legitimate business purposes.
12. Liability
12.1 Each party’s liability towards the other party under or in connection with this DPA will be limited in accordance with the provisions of the Agreement.
12.2 Customer acknowledges that HumanSignal is reliant on Customer for direction as to the extent to which HumanSignal is entitled to Process Customer Personal Data on behalf of Customer in performance of the HumanSignal Product. Consequently, HumanSignal will not be liable under the Agreement for any claim brought by a Data Subject arising from (a) any action or omission by HumanSignal in compliance with Customer’s instructions or (b) from Customer’s failure to comply with its obligations under the Data Protection Laws.
13. General Provisions
With regard to the subject matter of this DPA, in the event of inconsistencies between the provisions of this DPA and the Agreement, the provisions of this DPA shall prevail. In the event of inconsistencies between the DPA and the EU or UK SCCs, the EU OR UK SCCs will prevail.