1. Definitions: "Customer Personal Data" means the personal data Customer is acting as a data processor on behalf of the Customer. In relation to the Product, this may include: - Contact details (name and email). - Any personal data provided by respondents when using the Product (including but not limited to: Interview responses, answers to screening questions, and voice recordings) Relating to: - The Customer's end-user of the Product. "Applicable Data Protection Law" means applicable data protection and privacy laws in Germany, including the EU General Data Protection Regulation and other data protection laws. "Controller", "data subject", "personal data", "processor", "processing" (and "process") and "special categories of personal data" shall have the meanings in the Applicable Data Protection Laws.
2. Relationship of the Parties 2.1. Customer appoints Supplier as a data processor in relation to Customer Personal Data for the purpose of providing the Product during the term of this Agreement.
3. Security 3.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Supplier shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk (in accordance with Applicable Data Protection Law) to protect Customer Personal Data from accidental or unlawful destruction, and loss, alteration, unauthorised disclosure of, or access to the Data (a "Security Breach").
4. Subprocessing 4.1. Customer agrees to Supplier engaging sub-processors to process the Customer Personal Data in connection with the Product. 4.2. Supplier shall remain liable for breaches of this Data Protection Addendum by any of the sub-processors; and shall provide Customer with notice of any updates to the sub-processor list by updating these Terms. 4.3. Customer may object to Supplier's appointment of a sub-processor prior to its appointment, provided such objection is based on reasonable data protection grounds. In such an event, Customer may suspend or terminate the Agreement (without prejudice to any fees incurred prior to Suspension or Termination). 4.4. Supplier's current list of sub-processors: - Cloud hosting and data processing services are provided by Amazon Web Services EMEA SARL. The location of data processing is Germany. - Cloud hosting and data processing services are provided by Google Cloud EMEA Limited. The location of data processing is Germany. - Cloud hosting and data processing services are provided by Microsoft Ireland Operations Limited. The location of data processing is Germany. - Video processing is provided by Zoom Video Communications Inc. ('Zoom'). The location of data processing is United States.
5. Cooperation and Assistance 5.1. Supplier shall provide reasonable and timely assistance to Customer (at Customer's expense) to enable Customer to: respond to any request from a data subject in relation to their rights under Data Protection Legislation; or any other correspondence, enquiry or complaint received from a data subject, regulator or third party in relation to the processing of Customer Personal Data. 5.2. Supplier shall provideCustomer with reasonable cooperation (at Customer's expense) to enable Customer to (i) conduct any data protection or transfer impact assessments that it is required to undertake under Applicable Data Protection Law; and (ii) consult competent supervisory authorities prior to processing where required by Applicable Data Protection Law.
6. Security Breaches 6.1. If Supplier becomes aware of a Security Breach, Supplier will inform Customer without undue delay and shall provide reasonable information and cooperation to Customer so that Customer can fulfil any data breach reporting obligations it may have under Applicable Data Protection Law. 6.2. Supplier shall further take such reasonably necessary measures and actions to mitigate the effects of the Security Breach and shall keep Customer informed of all material developments in connection with the Security Breach. 6.3. The Customer acknowledges that in the event of a Security Breach impacting a subprocessor of Supplier, the Customer may receive notification directly from the subprocessor.
7. Deletion and Return of Data 7.1. Following termination of the Agreement, Customer shall have thirty (30) days to export any Customer Personal Data from the Software and after such time has passed Supplier may destroy all Customer Personal Data in its possession or control. 7.2. This requirement shall not apply to the extent that: (i) Supplier is required by applicable law to retain some or all of the Customer Personal Data; or (ii) Customer Personal Data is archived on Supplier's back-up and support systems.
8. Reviews and Audit 8.1. Supplier shall deal promptly and adequately with any enquiries from the Customer about the processing of Customer Personal Data in accordance with this Data Processing Addendum and make available all information reasonably necessary to demonstrate compliance with its obligations in this Data Processing Addendum. 8.2. Supplier shall allow Customer or its representative to audit (at Customer's expense) Supplier's data processing activities on the following conditions: a) Supplier provides at least 45 days notice b) The audit takes place during normal business hours and it does not disrupt Supplier's business operations c) Customer has not audited Supplier in the last year (unless a major Data Breach has occurred)
9. International Data Transfers 9.1. At Customer's request, Supplier may enter into adequate data transfer agreements with Customer to ensure the processing of personal data transfers comply with applicable international data transfer requirements. 9.2. Customer must ensure that use of Product complies with international data transfer requirements and provide notice to Supplier if additional safeguards are required.