Grid Data Processing Addendum for Curator.pdf

GRID Data Processing Addendum

Supplementary Measures means the provisions set out in Appendix 2 to this DPA.

1. Details of the processing

5.1. The subject-matter of processing of personal data by GRID is the personal data processing required to performance of the Services pursuant to the Agreement. The duration of the processing is for the Term of the Agreement; the nature and purpose of the processing is to provide the Services under the Agreement, the types of personal data is information unique to internet user(s), used by advertisers to present advertising to that internet user(s) and categories of data subjects processed under this DPA are the aforementioned internet users. If the Agreement is materially deficient in respect of the subject matter of this Clause 5, the parties may supplement the Agreement with additional information.

2. Data Protection Obligations

6.1. Relationship of the parties: Customer (as the controller in its own right or as the processor who acts under instruction from third party controller(s)) or another business appoints GRID as a processor (or sub-processor, as the case may be) to process the personal data described in the Agreement (the "Data") for the purposes described in the Agreement (or as otherwise agreed in writing by the parties) (the "Permitted Purpose"). Each party shall comply with the obligations that apply to it under Applicable Data Protection Laws. If GRID becomes aware that processing for the Permitted Purpose infringes an Applicable Data Protection Laws, it shall promptly inform Customer.

6.2. Service provider limitations: Customer is a business and GRID is a service provider as those terms are defined under the Applicable Data Protection Laws. GRID shall not: (a) sell personal data; (b) retain, use, or disclose personal data for any purpose other than for the Permitted Purpose; (c) retain, use, or disclose personal data for a commercial purpose other than for the Permitted Purpose; or (d) retain, use, or disclose personal data outside of the direct business relationship between GRID and Customer. GRID certifies that it understands these restrictions and will comply with them.

6.3. Prohibited data: Customer shall not disclose (and shall not permit any data subject to disclose) any special categories of personal data or sensitive data to GRID for processing.

6.4. International transfers: GRID shall not transfer the Data outside of the European Economic Area ("EEA") unless it has taken such measures as are necessary to ensure the transfer is in compliance with Applicable Data Protection Laws. Where GRID processes personal data (i) relating to individuals located in the European Economic Area in a territory outside of the European Economic Area that does not have adequate data protection laws (as determined by the EU Commission); or (ii) relating to individuals located in the United Kingdom in a territory outside of the United Kingdom that does not have adequate data protection laws (as determined by the United Kingdom's Secretary of State), the Standard Contractual Clauses shall be incorporated by reference into this DPA and shall apply in relation to such Personal Data, the Supplementary Measures herein shall also apply. For the purposes of the Standard Contractual Clauses:

(a) Customer is the “data exporter” and GRID is the "data importer"; (b) Where Customer is a data controller, the parties choose Module Two: Transfer controller to processor as being the only applicable terms between the parties and any terms related to and references therein to Module One, Module Three and Module Four shall be deemed deleted. However, where Customer is a data processor, the parties choose Module Three: Transfer processor to processor as being the only applicable terms between the parties and any terms related to and references therein to Module One, Module Two and Module Four shall be deemed deleted; (c) In Clause 9, irrespective of the chosen Module, the Parties choose Option 2 and agree the time period shall be completed as at least 10 days in advance; (d) the optional language in Clause 11(a) shall be deemed deleted; (e) Clause 13(a) shall be amended as applicable depending on where the Customer is established (as identified in the Agreement); (f) In Clause 17, the Parties choose Option 1 and agree that this shall be the law of Germany; (g) Clause 18(b) shall be deemed completed with the courts of Berlin, Germany; (h) Annex I to the Standard Contractual Clauses shall be deemed completed with the information set out in Appendix 1 to this DPA; and (i) Annex II to the Standard Contractual Clauses shall be deemed completed with the information set out in Appendix 2 to this DPA.

6.5. Sub-processing: Customer may object to GRID’s appointment or replacement of a sub-processor prior to GRID’s engagement of such sub-processor, provided such objection is based on reasonable grounds relating to data protection. In such event, GRID will either not appoint or replace the sub-processor or, if this is not possible, Customer may suspend or terminate the Agreement (without prejudice to any fees incurred by Customer prior to suspension or termination).

6.6. Cooperation and data subjects' rights: GRID shall provide reasonable and timely assistance to Customer (at Customer's expense) to enable Customer to respond to: (i) any request from a data subject to exercise any of its rights under Applicable Data Protection Laws (including its rights of access, correction, objection, erasure and data portability, as applicable); and (ii) any other correspondence, enquiry or complaint received from a data subject, regulator or other third party in connection with the processing of the Data.

6.7. Data Protection Impact Assessment: GRID shall and provide reasonable cooperation to Customer (at Customer's expense) in connection with any data protection impact assessment that may be required under Applicable Data Protection Laws.

6.8. Audit: Customer acknowledges that GRID is audited against ISO 27001, standards by independent third party auditors. Upon request, GRID shall supply a summary copy of its audit report(s) to Customer, which shall be subject to the confidentiality provisions of the Agreement. GRID shall also respond to any written audit questions submitted to it by Customer, provided that Customer shall not exercise this right more than once per year.

Appendix 1

A. LIST OF PARTIES

Data exporter: the organisation identified as Customer. Customer’s contact information is specified in the Agreement. Customer’s activities are as described in the Agreement and in relation to these activities Customer is acting as a data controller for the personal data.

Data importer: the organisation identified as GRID. GRID’s contact information is specified in the Agreement. GRID’s activities are as described in the Agreement and in relation to these activities GRID is acting as a data processor for the personal data.

B. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred: The categories of data subjects identified in Clause 5 of the DPA.

Categories of personal data transferred: The data identified in Clause 5 of the DPA.

Sensitive data transferred (if applicable): No special categories of data or sensitive date is transferred.

Frequency of the transfer: On a continuous basis depending on Customer’s use of the Services.

Nature of the processing: The nature of processing identified in Clause 5 of the DPA.

Purpose(s) of the data transfer and further processing: The objective of processing personal data by the parties is set out in Clause 5 of the DPA.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: The Services has different automated retention/deletion periods for different types of data and settings but in no event is personal data retained longer than is necessary.

Transfers to (sub-) processors: GRID maintains an up-to-date list of its sub-processors at https://www.iponweb.com/policies-legal/iponweb-sub-processors/. The subject matter of processing of personal data by sub-processors is the personal data processing required for performance of the Services pursuant to the Agreement. The nature of the processing is to provide the Services under the Agreement and duration of the processing is for the Term of the Agreement.

C. COMPETENT SUPERVISORY AUTHORITY

The competent supervisory authority is as set out in Clause 13 of the Standard Contractual Clauses.

Appendix 2

Description of the technical and organisational measures implemented by the data importer, including technical and organisational measures to ensure security of the data:

In all cases, the data importer uses various security technologies and procedures that help protect personal data from unauthorized access, use, disclosure, alteration or destruction.

For example:

Supplementary Measures:

  1. If GRID receives an order or request to disclose personal data transferred under the Agreement (“Transferred Personal Data”) to a law enforcement, regulatory, judicial or governmental authority (an "Authority"), whether on a binding or voluntary basis, GRID shall: (a) promptly notify the Customer of such Authority's data access request; (b) inform the Authority that it is a processor of the Transferred Personal Data and that the Customer has not authorised GRID to disclose that Transferred Personal Data to the Authority; (c) inform the Authority that any and all requests or demands for relating to the Transferred Personal Data should be notified to or served upon the Customer (as the Controller) in writing; and (d) not provide the Authority with access to Transferred Personal Data unless and until authorised by the Customer, save to the extent any such order or request or other legally binding obligation on GRID requires GRID to do otherwise.
  2. In the event GRID is under a legal prohibition or a legal compulsion that prevents it from complying with paragraphs 1(a) to 1(d) in full, GRID shall use reasonable and lawful efforts to challenge such prohibition or compulsion (and the Customer acknowledges that such challenge may not always be reasonable or possible in light of the nature, scope, context and purposes of the intended Authority access request and the reasonable prospects and costs of successfully challenging the prohibition or compulsion).
  3. Paragraphs 1 and 2 shall not apply in the event that, taking into account the nature, scope, context and purposes of the intended Authority's access to the Transferred Personal Data, GRID has a reasonable and good-faith belief that urgent access is necessary to prevent an imminent risk of serious harm to any individual. In such event, GRID shall notify the Customer as soon as practicable following such Authority's access and provide the Customer with full details of the same, unless and to the extent GRID is legally prohibited from doing so.
  4. GRID shall not knowingly disclose the Transferred Personal Data in a massive, disproportionate and indiscriminate manner that goes beyond what is necessary in a democratic society.
  5. GRID shall have in place, maintain and comply with a policy governing personal data access requests from Authorities which at minimum prohibits: (a) massive, disproportionate or indiscriminate disclosure of personal data relating to data subjects in the European Economic Area or the United Kingdom; and (b) disclosure of personal data relating to data subjects in European Economic Area or the United Kingdom to an Authority without a subpoena, warrant, writ, decree, summons or other legally binding order that compels disclosure of such personal data.
  6. GRID shall have in place and maintain in accordance with good industry practice measures to protect the Transferred Personal Data from unauthorised interception (including in transit from the Customer to GRID and between different systems and services). This includes having in place and maintaining network protection to deny attackers the ability to intercept Transferred Personal Data and encryption of Transferred Personal Data whilst in transit to deny attackers the ability to read Transferred Personal Data.