This DPA supplements, is incorporated into, and forms part of the Agreement above, and establishes the rights and obligations of Recallium and Customer with respect to any Customer Personal Data Processed by Recallium on behalf of Customer under the Agreement. Any capitalized terms used but not defined in this DPA shall have the meaning provided in the Agreement. To the extent there is any conflict in meaning between any provisions of the Agreement and this DPA, the terms and conditions in this DPA shall prevail and control.
1. DEFINITIONS
1.1 The following capitalized terms will have the meanings indicated below:
“Adequate Country” means a country that may import Personal Data and is deemed by the governing authority of the exporting country to provide an adequate level of data protection under the applicable Data Protection Laws;
“Affiliate” means an entity that, directly or indirectly, owns or controls or is owned or controlled by, or is under common ownership or control with, a Party. As used herein, “control” means the power to direct, directly or indirectly, the management or affairs of an entity and “ownership” means the beneficial ownership of more than fifty percent of the voting equity securities or other equivalent voting interests of an entity;
“Completions” has the meaning given to it in Exhibit C of this DPA;
“Controller” means the entity which determines the purposes and means of the Processing of Personal Data and includes, as applicable, the term “controller” “business” and any other similar or equivalent terms under applicable Data Protection Laws;
“Customer Personal Data” means any Personal Data contained within Customer Data subject to Data Protection Laws that Customer, including Users, provides or makes available to Recallium in connection with the Agreement;
“Data Incident” means any breach, as defined by applicable Data Protection Laws, of Recallium’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems managed or otherwise controlled by Recallium;
“Data Protection Authority” means a competent authority responsible for enforcing the application of the relevant Data Protection Laws, and includes, as applicable, any data protection authority, privacy regulator, supervisory authority, Attorney General, state privacy agency or any governmental body or agency enforcing Data Protection Laws;
“Data Protection Laws” means all laws and regulations as amended from time to time regarding data protection, consumer privacy, electronic communications and marketing laws to the extent applicable to the Processing of Customer Personal Data by Recallium under the Agreement, such as:
California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”);
California Privacy Rights Act of 2020 (“CPRA”);
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“EU GDPR”);
The EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 (“UK GDPR”); and
The Switzerland Federal Data Protection act of 19 June 1992 as replaced and/or updated from time to time (“FDP”).
“Data Subject” means the identified or identifiable person to whom Personal Data relates, and includes, as applicable, the term “consumer” and any other similar or equivalent terms under Applicable Data Protection Laws;
“DPA Effective Date” means the Effective Date of the Agreement;
“EEA” means the European Economic Area;
“EU SCCs” means the standard contractual clauses for use in relation to exports of Personal Data from the EEA approved by the European Commission under Commission Implementing Decision 2021/914, or such other clauses as replace them from time to time;
“Personal Data” means: (a) any information relating to (i) an identified or identifiable natural person and/or (ii) an identified or identifiable legal entity (where such information is protected similarly as Personal Data or personally identifiable information under applicable Data Protection Laws), and (b) any information treated or receiving similar treatment as “personal data”, “personal information”, “personally identifiable information or any similar, or equivalent terms under applicable Data Protection Laws;
“Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. The terms “process”, “processes” and “processed” will be interpreted accordingly;
“Processor” means the entity which Processes Personal Data on behalf of the Controller, including as applicable the terms “processor”, “service provider” and any equivalent or similar terms that address the same, or similar, responsibilities under applicable Data Protection Laws;
“Request” means a request from a Data Subject or anyone acting on their behalf to exercise their rights under Data Protection Laws;
“Restricted Transfer” means a transfer, or onward transfer, of Personal Data from a country where such transfer would be restricted or prohibited by applicable Data Protection Laws (or by the terms of a data transfer agreement put in place to address the data transfer restrictions of Data Protection Laws) without implementing safeguards such as the Standard Contractual Clauses to be established under clause 14 below;
“Security Documentation” means the Documentation describing the security standards that apply to the Service as provided by or on behalf of Recallium from time to time;
“Sell” or “Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for valuable consideration.
“Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Data Subject’s Personal Data to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged;
“Subprocessor” means any processor or service provider who processes personal data on behalf of Recallium for the purpose of providing the Service as set out in the Agreement, Exhibit A and any other relevant applicable exhibits of this DPA.
“Standard Contractual Clauses” or “SCCs” means either (a) the standard data protection clauses approved pursuant to the Data Protection Laws of the applicable exporting country from time to time to legitimize exports of Personal Data from that country, or (b) where the applicable exporting country has Data Protection Laws that regulate the export of personal data but no approved standard data protection clauses, the EU SCCs shall apply- in each case incorporating the appropriate Completions, and where more than one form of such approved clauses exists in respect of a particular country, the clauses that shall apply shall be: (i) in respect of any situation where Customer acts as a Controller of Customer Personal Data, that form of clauses applying to Controller to Processor transfers; and (ii) in respect of any situation where Customer acts as a Processor of Customer Personal Data, that form of clauses applying to Processor to Processor transfers; and
“Technical and Organizational Measures” means the technical and organizational measures agreed by the Parties in the Agreement and any additional technical and organizational measures implemented by Recallium pursuant to its obligations under applicable Data Protection Laws.
2. TERM
2.1 This DPA will take effect from the DPA Effective Date and remain in effect until the destruction or return of all Customer Personal Data by Recallium in accordance with the Agreement, at which point it will automatically terminate.
3. SCOPE AND APPLICATION
3.1 This DPA is incorporated into, and forms part of, the Agreement and establishes the rights and obligations of Recallium and Customer with respect to any Customer Personal Data Processed by Recallium on behalf of Customer when in the course of the provision of the Service. To the extent there is any conflict in meaning between any provisions of the Agreement and this DPA, the provisions in this DPA shall prevail and control.
4. ROLE OF THE PARTIES
4.1 Customer and any relevant Customer Affiliate, hereby appoints and instructs Recallium as a Processor, or Sub-Processor as applicable of the Customer Personal Data. Accordingly, the Parties shall comply with applicable Data Protection Laws as relevant to their respective Processing of Customer Personal Data under the Agreement.
4.2 As between the Parties, Customer shall be liable and responsible as the Controller (or Processor, if Customer is Processing Personal Data with the Service for a third-party Controller) and Recallium shall be liable and responsible as the Processor (or Subprocessor), in respect of Customer Personal Data. In the event that Customer acts as a Processor (or Subprocessor) in respect of Customer Personal Data, Customer represents and warrants to Recallium that it is validly authorized by the relevant Controller to enter into the Agreement and this DPA and to provide Customer Instructions (as defined below) on behalf of the Controller in relation to Customer Personal Data.
4.3 The subject matter and details of Processing are described in the Agreement and this DPA, including Exhibit B (subject matter and details of Customer Personal Data processing) and any other relevant exhibits for applicable additional Services.
5. CUSTOMER PROCESSING OF PERSONAL DATA
5.1 Customer shall ensure that any Processing of Customer Personal Data via Customer’s use of the Service, including any instructions provided to Recallium in relation to such Processing, shall comply with all applicable Data Protection Laws.
5.2 Customer instructs Recallium to Process Customer Personal Data: (a) to provide the Service specified in the Agreement and Documentation or otherwise perform its obligations thereunder; (b) as further initiated by Customer via Customer’s or Users use of the Service in accordance with the Agreement and Documentation; and/or (c) in accordance with any additional instruction outside the scope of the Agreement or this DPA, as further documented in any other written instructions given by Customer and acknowledged by Recallium in writing as constituting instructions for purposes of this DPA (collectively, “Customer Instructions”). Customer acknowledges that any additional Customer Instructions issued under (c) above may result in additional charges or fees to the Customer by Recallium, which shall be payable in accordance with the terms of the Agreement.
5.3 Customer shall have sole responsibility for the lawful Processing of Customer Personal Data in connection with its use of the Recallium Technology and/or its receipt of any related Professional Services in accordance with applicable Data Protection Laws, including without limitation, the accuracy, quality, and legality of the Customer Personal Data, the means by which it acquires and uses Customer Personal Data, and the Customer Instructions regarding the Processing of Customer Personal Data. Customer represents and warrants that it has (or its Controller has) a valid legal basis for the Processing of Customer Personal Data and has (or its Controller has) provided (or procured the provision of) all notifications and obtained (or procured the provision of) all consents (including Consents), authorizations, approvals, and/or agreements (including, where Customer is a Processor or Subprocessor, with and from the applicable Controller(s)) required under applicable laws or policies in order to enable Recallium to receive and Process Customer Personal Data in accordance with this DPA, the Agreement and Customer Instructions.
6. RECALLIUM PROCESSING OF CUSTOMER PERSONAL DATA
6.1 Recallium will Process Customer Personal Data for the business purposes of providing to Customer the Services pursuant to the Customer Instructions ("Business Purposes"), in accordance with the terms of the Agreement and this DPA as well as any requirements set out by applicable Data Protection Laws. For the avoidance of doubt, Customer is disclosing Customer Personal Data to Recallium only for the limited and specified Business Purposes set forth within the Agreement and the Customer Instructions. Recallium shall Process Customer Personal Data pursuant to Customer’s Instructions and shall:
(a) not Sell or Share Customer Personal Data or otherwise retain, use, disclose, or Process Customer Personal Data outside of the direct business relationship between the Parties or for any purpose other than for the fulfilment of the Business Purposes pursuant to Customer Instructions, unless obligated to do otherwise by applicable law or regulation or requests or orders of judicial, governmental or regulatory entities (including without limitation subpoenas), in which case Recallium will inform Customer of that legal requirement before such Processing occurs unless legally prohibited from doing so;
(b) not combine Customer Personal Data with Personal Data that it receives from other sources or collects from its own interactions with a Data Subject, provided, however, that Recallium may combine Customer Personal Data as necessary to perform its internal business purposes in connection only with the provision of the Service;
(c) implement appropriate technical and organizational measures as described in the Agreement, designed to ensure a level of security appropriate to the risk against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons. To the extent such assistance requires Recallium to take additional steps beyond those imposed on Recallium by Data Protection Laws or specifically required pursuant to the Agreement; or to the extent the relevant technical and organizational measures are required as a result of an act or omission by Customer or a Party acting on behalf of Customer in breach of this Agreement or Data Protection Laws, then Recallium’s obligation to provide such assistance shall be subject to Customer’s payment of Recallium’s reasonable fees in respect of such additional assistance;
(d) ensure that all persons authorized by Recallium to Process Customer Personal Data, including any Subprocessors (as defined below), are bound by confidentiality obligations consistent with those set out in this DPA, the Agreement or otherwise sufficient to meet the requirements of Data Protection Laws;
(e) take reasonable steps to return or destroy Customer Personal Data at the choice of the Customer, when it is no longer necessary for the purposes of performing the relevant Services upon termination of the Agreement, unless storage is otherwise required under applicable Data Protection Laws; and
(f) process Customer Personal Data in a manner that is consistent with the same level of privacy protection that is required of Customer under applicable Data Protection Laws.
6.2. Customer shall instruct Recallium as to the subject-matter and duration of the Processing, the nature and purpose of the Processing, the type of Personal Data and the categories of Data Subjects taking into account the specific tasks and responsibilities of the Processor in the context of the Processing to be carried out and the risk to the rights and freedoms of the Data Subject as part of Customer Instructions. Notwithstanding anything to the contrary herein, Customer shall ensure that its acts or omissions, including in relation to any Customer Instructions to Recallium, do not put Recallium in breach of the Data Protection Laws.
6.3 Customer has assessed the level of security appropriate to the Processing in the context of its obligations under Data Protection Laws and agrees that the Technical and Organizational Measures of Recallium is consistent with such assessment. Customer further acknowledges that Recallium is not able to assess, and does not have knowledge of, the specific Personal Data provided by Customer to Recallium or made available by Customer to Recallium in relation to the Services and that as a result the Technical and Organizational Measures proposed by Recallium are generic in nature and Recallium is unable to assess whether or not they reflect any particular risks posed by the Personal Data.
7. SUBPROCESSORS
7.1 Customer specifically authorizes the engagement as Subprocessors of the entities listed in Exhibit A and/or applicable specific additional Services exhibits in this DPA provided that, prior to permitting such Subprocessors to Process any Customer Personal Data, Recallium shall enter into a written agreement with the Subprocessor imposing terms that are consistent with those set out in this DPA or otherwise sufficient to meet the requirements of Data Protection Laws.
7.2 Subject to Section 7.3, Customer generally authorizes Recallium to engage additional Subprocessors (“Additional Subprocessors”), provided that, prior to permitting such Additional Subprocessor to Process any Customer Personal Data, Recallium shall enter into a written agreement with the Additional Subprocessor imposing terms that are consistent with those set out in this DPA or otherwise sufficient to meet the requirements of Data Protection Laws.
7.3 Should Recallium engage an Additional Subprocessor, it shall provide Customer with no less than 30 days’ notice, including the identity, location, and nature of Processing proposed to be undertaken by such Additional Subprocessor. That notice may be given by any typical means Recallium uses to communicate with the Customer from time to time. Where Customer indicates in writing that it objects to the Processing of Customer Personal Data by such Additional Sub-Processor, the Parties shall seek to resolve the Customer concerns and where necessary the Customer may exercise its applicable rights to terminate the Agreement.
7.4 To the extent required by Data Protection Law, Recallium shall remain liable to Customer for the performance of the Subprocessor’s obligations in relation to this Section 7 (“Subprocessor Data Protection Liability”), and Recallium shall be permitted to re-perform or to procure the re-performance of any such obligations and Customer acknowledges that such re-performance shall diminish any claim that Customer has against Recallium in respect of any Subprocessor Data Protection Liability.
8. AUDIT
8.1 Recallium shall make such information available to Customer to demonstrate compliance with applicable Data Protection Laws including, with advance notice in accordance with this section and solely to the extent required under applicable Data Protection Laws, audits carried out by a third-party assessor mutually agreed upon between the Parties. Such a third-party audit shall be at Customer’s sole expense.
8.2 In order to request an audit of Recallium’s facilities under this Section 8 (and where such an audit is authorized), Customer shall notify Recallium and the Parties shall agree, as soon as reasonably possible but always in advance, the reasonable dates, duration and scope of the audit, the identity and qualifications of the auditor, and any security and confidentiality controls required for access to the information or Processes in scope of such audit. Recallium may object to any external auditor if, in Recallium’s reasonable opinion, the auditor is not qualified, does not have appropriate security controls to ensure Recallium’s Confidential Information is suitably protected, is a competitor to Recallium or its suppliers, or is not independent. If Recallium objects to the identity or qualifications of any proposed auditor, Recallium shall provide reasons for such objection and Customer will be required to propose an alternate auditor. The Customer shall bear the reasonable costs of Recallium in fulfilling any requirements under this Section. The scope of any audit under this Section 8 shall be limited to Recallium systems and facilities used to Process Customer Personal Data and Documentation directly related to such Processing.
8.3 All information provided or made available to Customer, its auditor or any other third-party authorized under the present DPA to have access to the above information pursuant to this Section 8 shall be Confidential Information of Recallium.
8.4 In the event of any confirmed material non-compliance by Recallium with the terms of this DPA, Customer may take reasonable steps to remediate the same, including, without limitation, by requiring the suspension of all Processing of Customer Personal Data until such time as Customer determines that the non-compliance has been remediated. In the event that Recallium determines that it can no longer meet its obligations pursuant to this DPA, Recallium shall promptly notify Customer of such determination.
9. DEALINGS WITH DATA PROTECTION AUTHORITIES AND DATA PROTECTION IMPACT ASSESSMENTS
9.1 Recallium shall reasonably cooperate on reasonable request and at Customer’s cost, with any Data Protection Authority in the performance of its tasks, taking into account the nature of the Processing by, and information available to, Recallium.
9.2 Taking into account the nature of the Service and the information available to Recallium, Recallium will assist Customer in complying with Customer’s obligations in respect of data protection impact assessments (including a 'risk assessment', 'privacy impact assessment', 'data protection assessment' or any equivalent documentation) and prior consultation or mandatory submission to a Data Protection Authority where applicable under Data Protection Laws.
10. DATA SUBJECT RIGHTS
10.1 With regard to Customer Personal Data, where Recallium directly receives a Request from a Data Subject, or anyone authorized to act on their behalf, any claim or complaint in relation to their rights under the Data Protection Laws, and provided Recallium can reasonably identify from the information provided that the request, claim or complaint relates to Customer and Customer Personal Data, then unless prohibited by applicable law, Recallium shall forward the request, claim or complaint to Customer.
11. DATA INCIDENT
11.1 Recallium shall notify Customer without undue delay after becoming aware of (or where required by applicable Data Protection Laws) having reasonable grounds to believe that there has been a Data Incident and provide Customer with any information required to be included under applicable Data Protection Laws. For avoidance of doubt, a Data Incident shall not include acts or omissions which do not breach Recallium’s security or the security of any Subprocessor; port scans, authorized penetration tests, and denial of service attacks; or any access to or Processing of Customer Personal Data that is consistent with Customer Instructions.
11.2 Recallium shall provide Customer with reasonable cooperation and assistance in dealing with a Data Incident, in particular in relation to (a) taking commercially reasonable steps to resolve any data privacy or security issues involving any Customer Personal Data; and (b) making any appropriate notifications to individuals affected by the Data Incident or to a Supervisory Authority to the extent reasonably possible; provided that, Customer shall maintain and follow an effective cyber incident response policy, which shall include the use of legal professional, litigation, or client attorney privilege, work in good faith with Recallium in relation to the Data Incident, and agree with Recallium the form and method of any public announcement in relation to the Data Incident.
11.3 Any information provided by Recallium pursuant to this Section 11 shall be the Confidential Information of Recallium and Recallium’s notification of or response to a Data Incident under this Section 10 will not be construed as an acknowledgement by Recallium or, if relevant, its Subprocessors of any fault or liability with respect to the performance of any Service or Professional Services (as applicable).
12. DATA TRANSFERS
12.1 Recallium may Process Personal Data in countries outside of the country in which Customer is established in which Recallium or its Subprocessors maintains facilities, employees or infrastructure.
13.2 Where the Processing of Customer Personal Data in the course of the provision of the Service involves a Restricted Transfer of Customer Personal Data by or on behalf of Customer, from a country which places restrictions on the transfer of Personal Data to countries not deemed to be an Adequate Country then:
(a) Recallium shall provide appropriate safeguards, meeting the requirements of the applicable SCCs in respect of onward transfers, in relation to transfers of the Personal Data between Recallium Affiliates for the purpose of performing Services; and
(b) Recallium shall ensure that any transfers of Customer Personal Data between Recallium and any Recallium third party Subprocessors, are subject to contractual terms between Recallium and the relevant third party Subprocessor providing appropriate safeguards and containing clauses equivalent to the SCCs; or
(c) Where the Parties choose to enter into SCCs, the applicable SCCs and any required Completions as applicable and set out in Exhibit D, shall hereby be deemed incorporated into this DPA, and apply between Customer (as Exporter) and Recallium (as importer),
12.3 Nothing in this DPA or the Agreement modifies any rights or obligations of Recallium or customer under the Standard Contractual Clauses.
13. LIABILITY
13.1 Subject to 13.2, the total combined liability of either Party and its Affiliates towards the other Party and its Affiliates under or in connection with the Agreement and the Standard Contractual Clauses combined will be the liability cap, and subject to the liability limitations, set forth in the Agreement for the relevant Party.
13.2 Nothing in this DPA serves to modify, disapply or amend the terms of the Agreement relating to liability, including but not limited to any exclusions and/or limitations of liability.
13.3 Customer shall ensure that all Customer Data it uploads in the course of the provision of the Service is accurate and complies with all applicable laws. Recallium does not monitor or control any Customer Data on Recallium Services. Customer shall defend and indemnify Recallium for any and all damages, liabilities, penalties, fines and expenses (including from third parties) arising out of the Customer’s failure to comply with the present provision or any applicable laws in connection with Customer Data.
14. GOVERNING LAW AND JURISDICTION
14.1 The Parties shall modify the terms of this DPA as soon as possible if such modification is required for the parties to comply with any Data Protection Laws, or in order to implement or adhere to the Standard Contractual Clauses or such other permitted compliance mechanism under Data Protection Laws.
14.2 This DPA, and any dispute or claim (including any non-contractual disputes or claims) arising out of or in connection with it, or its subject matter or formation, shall be governed by and construed in accordance with the laws that govern the Agreement. If it is or becomes a requirement that, under the Data Protection Laws or other applicable laws, this DPA must be governed by (a) the laws of a member state of the European Union (and it is not already so governed), this DPA shall be governed by and construed in accordance with the laws of Ireland; (b) the laws of the United Kingdom, this DPA shall be governed by and construed in accordance with the laws of England and Wales, and/or (c) the laws of any other jurisdiction, then this DPA shall be governed by and construed in accordance with the laws of that jurisdiction, but only to the extent required to satisfy such laws.
14.3 The Parties irrevocably agree that the forum set out in the Agreement shall have exclusive jurisdiction to settle any dispute which may arise out of or in connection with this DPA and the documents to be entered into pursuant to it and that, accordingly, any proceedings arising out of or in connection with this DPA shall be brought in such forum save that where a mandatory requirement of Data Protection Law or other applicable laws requires that disputes arising out of or in connection with this DPA and any documents to be entered into pursuant to it are heard in (a) a member state of the European Union, then such disputes shall be heard in Ireland; (b) the United Kingdom, then such disputes shall be heard in England and Wales; and/or (c) any alternative forum, then such disputes shall be heard in that alternative forum, to the extent legally permitted. Each of the Parties irrevocably submits to the jurisdiction of such forum and waives any objection to proceedings in any such forum on the ground of venue or on the ground that proceedings have been brought in an inconvenient forum.
15. GENERAL TERMS
15.1 Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, whilst preserving the Parties’ intension as closely as possible, or, where not possible, (ii) construed in a manner as if the invalid off unenforceable part had never been contained therein.
15.2 Recallium may notify Customer in writing from time to time of any variations to this DPA, including relating to cross border transfers, which are required as a result of change in Data Protection Laws.
EXHIBIT A - List of approved Subprocessors
PART I - Subprocessors
To perform its obligations under the Recallium Terms of Service and Data Protection Agreement (or the alternative written agreement between Customer and Recallium, if applicable), Recallium and its Affiliates may use third-party data processors (“Third-Party Subprocessors”) and Affiliates to process Customer Personal Data. Capitalized terms used but not defined here shall have the meanings provided in the Agreement.
The following third parties are hereby specifically authorized by Customer to carry out work as Third-Party Subprocessors for purposes of the Agreement.
| Authorized Third-Party Subprocessors | ||||
|---|---|---|---|---|
| Subprocessor | Purpose | Registered Address | Location | Transfer Mechanism |
EXHIBIT B - Subject Matter and Details of Customer Personal Data Processing
Categories of Data Subject Whose Personal Data May be Subject to Processing:
Data Subjects include the individuals about whom Personal Data is provided to Recallium via the Service (as applicable) or otherwise by (or at the direction of) Customer or Customer’s Users.
Categories of Customer Personal Data:
Customer Personal Data provided to Recallium for Processing (including via the Service) by or at the direction of Customer or Customer’s Users.
Subject Matter of Processing:
Recallium’s provision of the Service and Professional Services and performance of its obligations under the Agreement.
Nature and Purpose of Processing:
Recallium will Process Customer Personal Data in accordance with the terms of this DPA for the purpose of providing the Service and Professional Services to Customer, or as otherwise compelled by applicable law.
Duration of Processing:
Continuous for duration of the Agreement, plus the period from the expiry of the Agreement until the return or deletion of all Customer Personal Data by Recallium in accordance with the Agreement (including this DPA), Customer Instructions and applicable law.
Subject matter, nature and duration of processing by sub-processors:
As set out in Exhibit A. The duration of sub-processing is as set out immediately above.
EXHIBIT C - Additions to the Standard Contractual Clauses
The following capitalized term will have the meaning indicated below:
"UK Addendum" means the international data transfer addendum to the EU SCCs issued by the UK Information Commissioner under s. 119A of the Data Protection Act 2018, or such other addendum as may amend or replace the addendum from time to time.
“Completions” means
(i) in relation to the EU SCCs in relation to exports from the EEA:
a) the optional wording at Clauses 7 and 11 is deleted;
b) in Clause 8.9 of such SCCs, the following paragraph is added after subsection (d): “(e) Notwithstanding the above, any audit will be limited in scope and parameter to the systems processing the relevant personal data. Where audits include inspections, they shall be carried out with reasonable prior notice. The parties will mutually agree upon the scope, timing, duration, control and evidence requirements of the audit, provided that this requirement to agree will not permit the data importer to unreasonably delay performance of the audit. Any audit made pursuant to this Clause (i) shall be at the expense of the requesting data exporter, and such expenses shall include any reasonable related costs of the data importer, including compensation for the hours worked by the data importer’s staff; (ii) may, if the data exporter seeks to retain an independent auditor, only be done by a party approved in advance by the data importer, which approval cannot be unreasonably withheld; and (iii) shall be subject to a non-disclosure agreement.”
c) in Clause 9, Option 1 is deleted and the time period shall be not less than 30 days;
d) the applicable wording for Clause 13(a) of the EU SCCs (as determined by the instructions in square brackets in such SCCs) is retained and the two remaining alternatives are deleted;
e) in Clause 17 of the EU SCCs, Option 2 is deleted and Option 1 is completed with details of the laws of Ireland and in Clause 18(b) of the EU SCCs is completed with details of the courts of Ireland;
f) the parties set out in Annex 1 shall be completed with the names of the Customer as exporter and Recallium as importer, the transfers shall be as described in Exhibit B and any other relevant exhibits for applicable additional Services under this DPA and the supervisory authority shall be the Irish supervisory authority; in Annex II the list of technical and organizational measures shall be the Technical and Organizational Measures and in Annex III the list of sub-processors shall be those set out in Exhibit A; and
g) in the event that the EU SCCs are replaced from those in force at the Effective Date, such completions shall be made to the revised SCCs as most closely replicate those set out above.
(ii) in relation to the EU SCCs in relation to exports from other jurisdictions besides the EEA the completions set out in (i)(a)-(g) above shall apply save that:
a) in Clause 17 of such EU SCC, the second sentence is replaced with the following: “The Parties agree that this shall be English law” save where another governing law of the EU SCCs is required as a mandatory requirement of the Data Protection Law of the relevant country, in which case Clause 17 shall be completed with details of the law which that Data Protection Law requires must be applied to such EU SCCs;
b) Clause 18(b) is replaced with the following “18(b) The Parties agree that those shall be the courts of England & Wales” save where another country, state or territory must have jurisdiction over the EU SCCs as a mandatory requirement of the Data Protection Law of the relevant country, in which case Clause 18(b) of such EU SCCs shall be completed with details of the country, state or territory which that Data Protection Law requires must have jurisdiction over the EU SCCs;
c) references in the EU SCC to “a third party located outside the European Union” are replaced by references to “a third party located outside the country or territory in which the data exporter is established”;
d) references in such EU SCC to “the Member State” are replaced by references to “the country or territory in which the data exporter is established”;
e) all references to the GDPR in such EU SCC are replaced by references to Data Protection Law of the relevant country and references to provisions or concepts of the GDPR are replaced by references to the provisions or concepts of such Data Protection Law most closely related to the relevant term as understood in the GDPR;
f) all references to Member States of the European Union or to the European Union are replaced by references to the country of establishment of the exporter;
g) save where required as mandatory requirement of the relevant Data Protection Law, all references in the EU SCC to (a) data subject rights or other third-party beneficiary rights or (b) to obligations or liability towards data subjects or other third parties shall be deleted and ignored; and
h) to the extent that any of references to the EU SCCs referred to above under (i) to (viii) are replaced in any amended provisions or replacement or subsequently approved clauses or instrument after the Effective Date, the amendments provided above under (ii)(a)-(h) shall be adapted and/or completed if and to the extent appropriate to reflect the effect of the former as close as possible
(iii) in relation to SCCs in relation to exports from the UK the EU SCCs shall apply as amended by either (i) the Information Commissioner’s “UK Addendum to the EU Commission Standard Contractual Clauses” found at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdfhttps://ico.org.uk/media/about-the-ico/consultations/2620398/draft-ico-addendum-to-com-scc-20210805.pdf or (ii) such replacement addendum to the EU Standard Contractual Clauses as the Information Commissioner might issue from time to time (these addenda known as the “UK SCC”), with the following items completed (or in the case of (ii) those items as most closely approximate the following items):
a) to the extent not covered by the foregoing, the completions set out in (i)(a)-(g) above shall apply save that:
b) Table 1 shall be completed with the names of the Customer as exporter and Recallium as importer;
c) in Table 2 the module of the EU SCCs selected shall be determined in accordance with the definition of SCCs set out below;
d) in Table 4 the “neither party” option shall be selected,
(iv) in relation to SCCs in relation to exports from Switzerland, the EU SCCs shall apply (incorporating the completions set out at (i)(a)-(g) above), as amended by either (a) the FDPIC’ decision guidance of 27 August 2021 found at https://www.edoeb.admin.ch/edoeb/en/home/latest-news/aktuell_news.html#-1259254222 setting out amendments to be made to the EU SCCs in respect of transfers subject to the Swiss FADP or (b) such replacement decision of the FDPIC relating to amendments to be made to the EU SCCs from time to time (these amendments known as the “Swiss SCCs”);
(v) in relation to SCCs in relation to exports from any other country, the completions set out in (i)(a)-(g) above shall be made or such other Completions as most closely achieves the same outcome as those Completions.
In respect of any transfers of Personal Data that may occur in the course of the provision of the Service, Module 2 (Controller to Processor) terms, as provided below in Annex 1 to Exhibit D, shall apply to the extent Customer is a Controller of Customer Personal Data. The Module 3 (Processor to Processor) terms, as provided below in Annex 2 to Exhibit D, shall apply to the extent Customer is a Processor (or subprocessor) of Customer Personal Data. For both Module 2 and Module 3 of the Standard Contractual Clauses, the election of specific terms and/or addition of required information shall apply as follows:
(a) The applicable wording for Clause 13(a) of the Standard Contractual Clauses (as determined by the instructions in square brackets in the Standard Contractual Clauses) is retained and the two remaining alternatives are deleted;
(b) details of Subprocessors the data importer intends to engage as set out in Exhibit A and/or any other relevant exhibits for applicable additional Services, respectively, to this Agreement are the “agreed list” of Subprocessors referred to in Clause 9(a) of the Standard Contractual Clauses.