Data Processing Addendum

Last edited:

Introduction

  1. This Data Processing Addendum, along with its Schedules (jointly referred to as the “DPA”) is an integral part of the Order for the use of the tool “Steve”, entered into between Open Loyalty sp. z o.o. (the “Provider” or “Open Loyalty”) and its customer (the “Customer”), to accurately represent the parties’ consensus on the Processing of Personal Data.
  2. Delivery of the services under the agreement requires Open Loyalty to process Personal Data as a Processor on behalf of the Customer. To ensure the correctness of the Processing both parties shall comply with the following provisions concerning Personal Data acting in their duties as a controller or processor of the data.

DPA structure

  1. DPA consists of several parts:
    1. Main agreement
    2. Schedules

DPA definitions

Agreement
means the Order Form and appendices thereto (including appendices included by reference) between Open Loyalty and the Customer;
Business Purposes
mean the services to be provided by Open Loyalty to the Customer as described in the Agreement;
Customer Data Incident
means a confirmed event that has caused or may cause unauthorized access to, disclosure, alteration, loss, or destruction of Customer Personal Data processed by Open Loyalty, and which materially affects the Customer’s data or obligations under this DPA;
Data Protection Laws and Regulations
means the law of the European Union or any member state of the European Union to which the Customer is subject, which relates to the protection of Personal Data, or other applicable regulations related to the processing of personal data;
GDPR
means Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Data Protection Directive);
Open Loyalty
means the Open Loyalty entity that is a party to this DPA and the Agreement and that processes personal data as defined under relevant Data Protection Laws and Regulations;
Order Form
means the order form entered into between Open Loyalty and Customer, based on which the Customer gains access to the AI-based tool “Steve” offered by Open Loyalty;
Personal Data Breach
means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed;
Restricted Transfer
means a transfer of Personal Data from the EEA to a country outside of the EEA, which are not subject to an adequacy decision under Article 45 GDPR by the European Commission;
Services
means the services or products to be provided by Open Loyalty to the Customer in accordance with the Agreement, comprising the delivery of an AI-based online tool;
SCCs
means the standard contractual clauses adopted by the European Commission in its Implementing Decision (EU) 2021/914 of 4 June 2021, or any superseding decisions;
Sub-processor
means any processor engaged by Open Loyalty who agrees to receive Personal Data intended for processing on behalf of the Customer in connection with the Services.

The terms Controller, Data Subject, Personal Data, Process, Processing, Processor will have the same meanings as defined by Data Protection Laws and Regulations.

For the purposes of this DPA, “Controller” shall also mean “Customer”, and “Processor” shall also mean “Provider”. Where a Processor engages a Sub-processor, the terms “Processor” and “Provider” shall apply accordingly to such Sub-processor in relation to the relevant processing activities, and the Sub-processor shall be subject to the applicable obligations under this DPA.

Except as defined in this DPA, interpretations and defined terms in the Agreement apply to the interpretation of this DPA.

Objectives of the processing

  1. The Processing carried out by Open Loyalty involves the handling of Personal Data to provide the Services. The duration, nature, and objective of the Processing, as well as the types of Personal Data and categories of Data Subjects involved, are detailed in Schedule 1 (Details of Data Processing) of this DPA.

Duties of the Controller and the Processor

  1. When using the Services, the Customer must handle Personal Data in compliance with Data Protection Laws and Regulations. This includes, where required, notifying Data Subjects about the use of Open Loyalty as a Processor. If the Customer is a Processor, they must ensure that the ultimate Controller also provides this notice.
  2. Both parties will comply with all applicable requirements of the Data Protection Laws and Regulations. This DPA is in addition to, and does not relieve, remove or replace a party’s obligations or rights under the Data Protection Laws and Regulations unless the Parties have expressly agreed otherwise in this to the extent permitted by Data Protection Laws and Regulations or GDPR.
  3. Open Loyalty will only process the Personal Data to the extent, and in such a manner, as is necessary for the Business Purposes in accordance with the Customer’s written instructions, set out in Schedule 1 (Details of Data Processing) of this DPA. For the avoidance of doubt, the parties agree that this DPA constitutes the written instructions of the Customer to Processor. Open Loyalty will not process the Personal Data for any other purpose or in a way that does not comply with DPA or the Data Protection Laws and Regulations. The Processor may process Personal Data without the Customer’s instructions where such processing is required by Data Protection Laws and Regulations or GDPR; provided that the Processor shall inform the Customer of such legal requirement prior to the processing, unless the applicable law prohibits such information on important grounds of public interest.
  4. The Customer is responsible for the accuracy, quality, and legality of the Personal Data they have and how they obtained it.
  5. Open Loyalty will treat Personal Data Processed under this DPA as Confidential Information in accordance with the Agreement.
  6. Open Loyalty will promptly notify the Customer if:
    1. an instruction from the Customer is deemed to violate the Data Protection Laws and Regulations, and/or
    2. Open Loyalty is unable to comply with the Customer’s directives regarding the Processing of Personal Data.

Data Subject’s requests

  1. Open Loyalty will promptly inform Customer of any complaint, dispute, or request received from a Data Subject, including but not limited to the right of access, right to rectification, restriction of Processing, erasure (commonly known as the “right to be forgotten”), data portability, objection to Processing, or the right to not be subject to automated individual decision making. These requests are collectively referred to as “Data Subject Requests.” Open Loyalty will not directly respond to a Data Subject Request unless the Customer grants written authorization to do so, in which case any responses shall be prepared under the Customer’s direction. Otherwise, Open Loyalty shall redirect such requests to the Customer to enable the Customer to respond directly.
  2. Considering the nature of the Processing, Open Loyalty shall, at no additional cost to the Customer except where such assistance requires material changes to the Services or the development of new functionalities, which shall be subject to separate agreement, provide the Customer with necessary support through suitable technical and organizational measures, to the extent feasible, to help the Customer fulfil its obligations in addressing a Data Subject Request under Data Protection Laws and Regulations.
  3. If a Customer using the services is unable to handle a request from a data subject, Open Loyalty will make reasonable efforts to assist upon request. This assistance will only be provided if legally allowed by data protection laws. The Customer will be responsible for any costs associated with this assistance.

Staff and technical security, certificates

  1. Open Loyalty appoints Data Protection Officer (details: Krzysztof Łoś, Data Protection Officer, krzysztof.los@openloyalty.io).
  2. Open Loyalty will guarantee that its staff involved in handling Personal Data are aware of the confidential nature of the information, have undergone suitable training regarding their duties, and have signed legally binding confidentiality agreements. Open Loyalty will:
    1. make sure that these confidentiality obligations continue even after the staff’s engagement ends;
    2. take reasonable measures to ensure the trustworthiness of any Open Loyalty staff involved in handling Personal Data; and
    3. ensure that Open Loyalty’s access to Personal Data is restricted to only those staff members carrying out Services as per the Agreement.
  3. Open Loyalty implement suitable technical and organizational safeguards to ensure the security (including protection against unauthorized or unlawful processing, accidental or unlawful destruction, loss, alteration, or damage, unauthorized disclosure, or access to Customer data (including the Personal Data)), confidentiality, and integrity of Customer data (including the Personal Data).

Audits

  1. The Customer can request an audit of Open Loyalty’s processing activities covered by this DPA. As a rule, the audit shall be remote. An on-site audit (On-Site Audit) shall only be requested when necessary, e.g. in case of a reasonable suspicion of breach of the DPA by Open Loyalty.
  2. An audit may be performed by the Customer or through a third-party auditor. In any event, the auditing party shall not be a competitor of Open Loyalty, and shall sign a non-disclosure agreement to safeguard Open Loyalty’s proprietary information prior to the audit.
  3. Any On-site Audits will only be conducted at Customer data processing and storage facilities operated by Open Loyalty or any of Open Loyalty’s Affiliates.
  4. The audit shall be conducted:
    1. by acting reasonably, in good faith, and in a proportional manner;
    2. up to once a year with at least three weeks’ advance written notice. In case of an emergency requiring a shorter notice period, Open Loyalty will make good faith efforts to accommodate the request; and
    3. during Open Loyalty’s normal business hours, for a reasonable duration, and without unreasonably interfering with Open Loyalty’s day-to-day operations.
  5. The Customer understands that Open Loyalty operates in a multi-tenant cloud environment. Before starting any audit, the Customer and Open Loyalty will agree on the scope, timing, and duration of the audit, as well as the reimbursement rate that the Customer will need to pay (in case of On-Site Audits). The reimbursement rates will be fair and consider the resources used by Open Loyalty. Open Loyalty can adjust the scope of the audit to protect the service levels, availability, and confidentiality of other Customers’ information.
  6. The Customer shall promptly inform Open Loyalty of any non-compliance identified during an audit. The Parties shall agree on appropriate remedial measures to address such non-compliance, provided that such measures shall be limited to those reasonably necessary to ensure compliance with applicable legal requirements and shall not impose on Open Loyalty any additional costs or obligations beyond those required by applicable law, unless otherwise agreed by the Parties.

Transfer of data to third countries

  1. The Customer may authorize Open Loyalty and its Sub-processors to make Restricted Transfers of Personal Data to third countries and use Sub-processors (e.g. external suppliers) to comply with the Customer’s instructions under this DPA, provided always that Open Loyalty shall ensure (i) appropriate safeguards are provided in relation to each transfer; (ii) the Data Subjects have enforceable rights and effective legal remedies; and (iii) Open Loyalty and its Sub-processors comply with its obligations under Data Protection Laws and Regulations by providing an adequate level of protection to the Personal Data that is transferred. Open Loyalty will always ensure that any such Restricted Transfers comply with the requirements of Data Protection Laws and Regulations and this DPA. As of the date of entering into this DPA, the authorized transfers of personal data (if any) are those resulting from Schedule 2 (Subprocessors).
  2. If Personal Data protected by the GDPR needs to be transferred to a country outside the European Economic Area (EEA) that does not provide an adequate level of protection for personal data, the parties agree to process such Personal Data following the SCCs.

Sub-processors

  1. Approved Sub-processors. The Customer acknowledges that Open Loyalty has the authority to engage Sub-processors to process Personal Data on behalf of the Customer. As at the commencement of the Agreement, the Sub-processors engaged by Open Loyalty are listed in Schedule 2. Open Loyalty will inform the Customer if any Sub-processors are added or removed, provided that, where Open Loyalty wishes to engage a new Sub-processor, Open Loyalty shall first provide the Customer with a reasonable opportunity of at least 5 days to consider and object to any such engagement. The Customer’s failure to respond within this period shall be deemed as acceptance of the new Sub-processor.
  2. Open Loyalty will:
    1. establish an agreement with each Sub-processor that includes data protection obligations, ensuring that the level of protection for Personal Data is at least equivalent to the obligations stated in this DPA, as required by applicable Data Protection Laws and Regulations and in relation to the nature of the service provided by the Sub-processor; and
    2. remain accountable and liable for the Sub-processor’s compliance with the obligations outlined in this DPA, as well as for any actions or failures on the part of the Sub-processor in respect of its processing activities.
  3. Upon request, Open Loyalty will make reasonable efforts to provide the Controller with all relevant information about Sub-processor agreements. However, due to confidentiality restrictions, Open Loyalty may not always be able to disclose unredacted Sub-processor agreements to the Customer.

Incident management

  1. If Open Loyalty becomes aware of a Personal Data Breach, it shall promptly notify the Customer in accordance with the applicable Data Protection Laws and Regulations, and in any event within 48 hours of becoming aware of the breach. If reporting to a Supervisory Authority is required within 72 hours, Open Loyalty shall provide such notice to the Controller as soon as reasonably practicable and in any event within 48 hours. The notification shall include, at a minimum:
    1. detailed information about the nature of the Personal Data Breach, including the categories and numbers of Data Subjects and Personal Data records affected;
    2. the name and contact details of Open Loyalty’s data protection officer or other relevant contact person who can provide further information;
    3. an assessment of the likely consequences of the Personal Data Breach, considering the nature of the Services and the breach itself;
    4. an explanation of the measures that have been taken or will be taken to address the breach.
  2. Open Loyalty will collaborate with the Customer and take necessary steps to assist in the investigation, mitigation, and resolution of each Personal Data Breach.
  3. The Customer agrees that in cases where there is an unauthorized attempt to access Personal Data or the infrastructure and networks providing the Services (as defined in the Agreement) (such as pings, denial of service attacks, firewall or edge server attacks, port scans, unsuccessful login attempts, packet sniffing, or other unauthorized access to traffic data) that does not lead to a Personal Data Breach, Open Loyalty is not obligated to inform the Customer under the Agreement or this DPA.

Requests of authorities and courts

  1. If a Public Authority legally requests access to Personal Data, Open Loyalty must notify the Customer promptly, unless legally prohibited. If prohibited by law, Open Loyalty will try to get permission to share as much information as possible. For the purposes of this section, “Public Authority” means any government, governmental agency, regulatory body, supervisory authority, law enforcement agency, court, or other public authority or body authorized by law to request access to or disclosure of Personal Data.
  2. Open Loyalty will challenge the request if it believes it is unlawful and seek interim measures to suspend the request until a judicial decision is made. Personal Data will not be disclosed until required by law. Open Loyalty will provide the minimum information necessary when responding to disclosure requests.
  3. If Open Loyalty becomes aware of direct access to Personal Data by a Public Authority, it will inform the Customer within legal limits. Open Loyalty certifies that it has not created back doors or changed processes to allow access to Personal Data by Public Authorities, and is not aware of any laws or policies requiring such actions at the date of concluding the Agreement.

Return and deletion of data

  1. The Provider processes Personal Data on behalf of the Customer for the duration of the Agreement, without prejudice to retention periods as set out in the Agreement. After termination or expiry of the Agreement, the Provider stores Personal Data during the Export Period and the Return Period (as defined below) solely to enable the Export and return or delete Personal Data under this DPA.
  2. After termination or expiry, the Customer may choose by notice to the Provider whether Personal Data is returned or deleted. Return is effected through the Export and, for any remaining Personal Data not covered by the Export, within 30 days after the end of the Export Period, in a manner and format agreed with the Customer.
  3. At the Customer’s request, the Provider confirms the deletion in writing.
  4. This DPA does not apply to processing for the Provider Purposes under Section 4.4 of the Terms, for which the Provider acts as an independent controller, and does not apply to Derived Data.

Liability

  1. The liability of each party and its Affiliates, when combined, concerning this DPA and all DPAs between Authorized Affiliates and Open Loyalty, regardless of whether it is based on contract, tort, or any other theory of liability, is subject to the Liability section of the Agreement. Any mention of a party’s liability in that section refers to the total liability of that party and all of its Affiliates under the Agreement and all DPAs combined.

Final provisions

  1. The DPA will take effect upon the commencement of the parties’ Agreement.
  2. This DPA will automatically end upon the later of:
    1. the termination or expiration of the Agreement;
    2. the cessation of processing of the Personal Data by Open Loyalty.
  3. In the event of a conflict between the terms of the Agreement and those of this DPA, the terms of the DPA will prevail.
  4. If any provision of this DPA is deemed invalid, the validity of the remaining terms will not be affected.
  5. Any obligations resulting from legal requirements or as per a court or regulatory ruling will not be impacted by this DPA.
  6. The Provider may amend this DPA in particular due to:
    1. Changes in law or guidance of competent authorities,
    2. Changes to the functionality, architecture of the Tool or security measures,
    3. Organizational changes affecting the DPA,
    4. Editorial changes
  7. The Provider shall notify the Customer by e-mail to its contact address at least 14 days before the amendment takes effect. The period may be shortened only to the extent required by law or a binding decision of an authority. If an amendment is materially adverse to the Customer, the Customer may terminate the Agreement before it takes effect.
  8. Amendments to the DPA shall not:
    1. Reduce the level of personal data protection below that required legally,
    2. Extend the scope, purposes or categories of Personal Data or Data Subjects processed, without the Customer’s documented instructions,
    3. Modify Standard Contractual Clauses, if applicable.
  9. For the avoidance of doubt, Restricted Transfers and Subprocessors are governed exclusively by Sections 9-10 and Schedule 2, and nothing in this clause limits or modifies those provisions.
  10. This DPA shall be governed by the law governing the Agreement, and any disputes arising out of it shall be resolved by the court competent under the Agreement, provided that the Standard Contractual Clauses (if applicable) shall be governed by the law and jurisdiction specified therein.