Data Processing Agreement

For the purposes of this DPA, Customer Data means the electronic data or Material you provide us via the Services we offer to you. Personal Data means any Customer Data that could be used to identify a natural person.

1. Our Roles

• This DPA covers Converta’s processing of Personal Data relating to the Services as a Processor.

• For the purposes of this DPA:

  • You are the Data Controller of the Personal Data; and

  • Converta is the Data Processor of the Personal Data (which we describe in more detail in Annex A).

• All Personal Data that Converta processes under the Agreement remains your property. At no point will Converta act as a Data Controller of your Data.

2. Instructions

• We both agree that any agreement for the Services (including this DPA) and our use of the Service make up our complete instructions about how Personal Data is processed. We will refer to this as our Instructions. Any further Instructions will be set out in writing and agreed between both of us.

• We both agree that the subject matter, nature, purpose and duration of the processing under this DPA will be as described in Annex A. This includes the types and categories of Personal Data.

3 What Customer needs to do

• Converta will comply with the Privacy Laws that apply at all times, but in particular:

  • Converta will only process Personal Data as agreed with you in Annex A in order to provide the Service, unless required to do so by law. If there is a legal requirement for Converta to process Personal Data outside of these Instructions, Converta will inform you promptly, unless the law does not allow Converta to.

  • You are responsible for making sure that any Personal Data is accurate.

  • You will make sure that you have the right to send Personal Data to us.

4. What Converta will do

• Converta will comply with the Privacy Laws that apply at all times, but in particular:

  • Converta will only process Personal Data as agreed with you in Annex A in order to provide the Service, unless required to do so by law. If there is a legal requirement for Converta to process Personal Data outside of these Instructions, Converta will inform you promptly, unless the law does not allow Converta to.

  • Converta will ensure that its staff:

    • are fully aware of their responsibilities under this DPA; and

    • have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality in accordance with Privacy Laws (Art. 28(3)(b) GDPR).

  • Converta will maintain appropriate technical and organizational security measures to protect Personal Data from a Data Breach in accordance with Privacy Laws (Art. 32 GDPR). These measures are set out in Annex B. These may be updated over time, but any changes will not reduce the level of protection. Upon request, Converta will provide you with the latest documents to support the above. This includes any certificates or reports from Converta or third parties.

  • In the event of a confirmed Data Breach, Converta will notify you without undue delay, but in any event within 24 hours. If the information below is not available at the time of the notice, Converta will send you the details as soon as they are available. This notice will contain details of:

    • the nature of the Data Breach;

    • details, where possible, of the categories and number of records involved;

    • the likely consequences of the Data Breach;

    • the steps taken or that will be taken to address the Data Breach and/or mitigate its effects; and

    • any other information required under Privacy Laws.

  • Converta will provide you with reasonable assistance in meeting your responsibilities in the event of a Data Breach. This includes taking commercially reasonable steps to help with investigating, mitigating, and rectifying the cause of the Data Breach.

  • Converta will provide you with commercially reasonable support in responding to a Data Subject exercising a right under applicable Privacy Laws. If Converta receives a direct request from a Data Subject, we will direct the Data Subject to you, unless prohibited by law.

  • Converta will promptly let you know if, in our opinion, any Instruction infringes Privacy Laws. In this case, Converta is entitled to refuse to process Personal Data.

  • If Converta receives a communication from a Supervisory Authority that relates to the processing under this DPA, we will inform you promptly.

  • When Converta engages any Sub-Processor, we will only do so as set out in Section 5.

  • You are allowed to audit Converta, and we will support this as set out in Section 7.

5. Sub-Processors

• Converta has your general written authorization to use the Sub-Processors listed in Annex A as of the Start Date.

  • the Sub-Processor will only process Personal Data in a manner consistent with your Instructions; and

  • to protect the Personal Data in a manner consistent with the requirements of this DPA (including implementing and maintaining appropriate technical and organizational measures consistent with Annex B of this DPA).

• Converta's use of Sub-Processors requires Converta to agree via a written contract.

• Converta will remain liable to you for the processing carried out by any Sub-Processor under this DPA.

• If Converta needs to make a change to the processing carried out by Sub-Processors or add a new Sub-Processor in order to provide the Service, we will inform you at least 30 days before any such change via email.

• This notice will describe the changes, including what activity is being carried out and the name and location of the new Sub-Processor (if applicable).

• You may object to any notice that Converta provides under Section 5.4. Any objection must be reasonable and given within 14 days of the notice Converta provides you. In this case, Converta will work with you in good faith to address any concerns.

• If these concerns are not resolved, you may either:

  • instruct Converta not to begin or to cease the proposed processing activity, in which case this DPA will continue unaffected; or

  • terminate the Agreement immediately and receive from Converta a pro rata refund of any pre-paid fees for Services unused after the date of termination.

• In the event you do not respond within the aforementioned period as described in Section 5.e, the approval of the new Sub-Processor shall be deemed to have been granted by you.

6. Storage & Transfer

• Converta may transfer Personal Data outside of the European Union solely for the purposes of our Affiliates or Sub-Processors accessing Personal Data in order to provide the Service.

• Any transfers of Personal Data outside of the European Union will be subject to the Standard Contractual Clauses (SCCs) and other requirements of Chapter 5 of the GDPR, including:

  • Data transfer impact assessments;

  • Third country assessments; and

  • Agreeing to additional safeguards as necessary.

• Converta will not volunteer any information about your Data. If Converta or our Sub-Processors receive a Government Request relating to Personal Data under this DPA, we will:

  • take reasonable steps to confirm the request is valid;

  • inform the government authority explaining that we are a Processor of your Data;

  • attempt to direct the government authority to you; and

  • notify you about the Government Request to allow you to seek your own remedy.

7. Agreement Mechanics

• Converta will assist you in ensuring that you comply with your legal obligations, taking into account the nature of the processing and the information available to us. This assistance shall only apply to the extent that applicable legislation obligates Converta as a Data Processor.

• You (or a representative you appoint, under signed non-disclosure commitments) are entitled to audit Converta's activities under this DPA. We will both agree on the timing of the audit and the resources required. This will be at least 14 days before any on-site inspection.

• Any request for information or audit shall be carried out by electronic disclosure as far as possible to reduce any time required for an on-site inspection. Any on-site inspection will be carried out in a way that does not disrupt Converta's usual business operations or obligations to a third party.

• The obligations under this DPA shall begin on the Start Date and continue for as long as Converta processes your Data under the Agreement.

• Any obligations that, due to their nature, are meant to survive the expiry of this DPA shall remain in force after the expiry of the Agreement.

• Any deletion of data by Converta is always subject to any legal requirements for us to retain data.

8. Liability

• Each party shall be liable to the other for any loss or damage incurred as a result of that party's breach of their obligations under this DPA or Privacy Laws.

• Liability is governed by applicable Privacy Laws (including Art 82 GDPR). Nothing in this section 8 shall limit either party's liability in relation to a fine or penalty issued by a Supervisory Authority or court of law. In no event shall either party limit their liability with respect to any individual's data protection rights under this DPA or otherwise.

• Each party is obligated to pay only the part of the damages or administrative fine that corresponds to the liability for damage confirmed in the final decision of a Supervisory Authority or a court of law.

• Except as set out in sections 8.2 and 8.3 above, to the maximum extent allowed by law, neither party is liable to the other in tort (including negligence or breach of statutory duty), contract, or otherwise for any:

  • loss of profits, business, goodwill, or similar losses;

  • pure economic loss; or

  • indirect or consequential loss, costs, damages, or expenses however they may arise.

• Subject to section 8.4, each party's liability to the other under this DPA shall not exceed the amount of Fees paid or payable for the Services for the most recent 12-month period, or €10,000 (whichever is higher).

9. General

• Any claims brought under or in connection with this DPA shall be subject to the governing law and exclusive jurisdiction of Germany.

• Both of us will try to resolve any dispute or claim concerning or relating to this DPA through commercial discussions and negotiations.

• In the event of any conflict between terms and conditions for the supply of Services and this DPA in relation to the subject matter of this DPA, the terms of the DPA will prevail