Data Processing Agreement
This Data Processing Agreement ("DPA") forms an integral part of, and is subject to the Terms of Service ("Terms") entered into by and between the user accepting the Terms to which this DPA is attached ("User") and Real Far Ltd. d/b/a Ply and its Affiliates (as defined below). Capitalized terms not otherwise defined herein shall have the meaning given to them in the Terms.
Whereas, in connection with the performance of its obligations under the Terms, Ply may Process User Personal Data (both as defined below) on behalf of the User; and
Whereas, the parties wish to set forth the mutual obligations with respect to the Processing of User Personal Data by Ply;
Now therefore, intending to be legally bound, the parties hereby agree as follows:
1. Definitions.
In addition to capitalized terms defined elsewhere in this DPA, the following terms shall have the meanings set forth below:
"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. "Control" for purposes of this definition means direct or indirect ownership or control of more than 50% of the voting interest in the subject entity.
"Applicable Law" means Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) ("GDPR"), laws implementing or supplementing the GDPR.
"User Personal Data" means any Personal Data Processed by Ply on behalf of User pursuant to or in connection with the
"Data Protection Laws" means Applicable Law and, to the extent applicable, the data protection or privacy laws of any other applicable country or as agreed in writing between the Parties.
"Sub Processor" means any person (excluding an employee of Ply or any Ply Affiliate) appointed by or on behalf of Ply or any Ply Affiliate to Process User Personal Data on behalf of the User in connection with the
The terms "Controller", "Data Subject", "Personal Data", "Personal Data Breach", "Processor", "Processing" and "Supervisory Authority" shall have the meanings ascribed to them in the GDPR.
2. Processing of User Personal Data.
Ply shall serve as a Processor and shall Process User Personal Data on User's behalf and at User's instructions as specified in the Terms in this DPA, including without limitation with regard to transfers of User Personal Data to a third country or international organization. Any other Processing shall be permitted only in the event that such Processing is required by any Data Protection Laws to which Ply is subject. In such event, Ply shall, unless prohibited by such Data Protection Laws on important grounds of public interest, inform User of that requirement before engaging in such Processing.
User instructs Ply (and authorizes Ply to instruct each Sub Processor) (i) to Process User Personal Data for the provision of the Service, as detailed in the Terms and as otherwise set forth in the Terms and in this DPA, and/or as otherwise directed by User; and (ii) to transfer User Personal Data to any country or territory as reasonably necessary for the provision of the Service and in accordance with Applicable Law.
User sets forth the details of the Processing of User Personal Data, as required by Article 28(3) of the GDPR in Schedule 1 (Details of Processing of User Personal Data), attached hereto.
3. Controller.
User represents and warrants that it has and shall maintain throughout the term of the Terms and this DPA, all necessary rights to provide the User Personal Data to Ply for the Processing to be performed in relation to the Service and in accordance with the Terms and this DPA. To the extent required by Data Protection Laws, User is responsible for obtaining any necessary Data Subject consents to the Processing, and for ensuring that a record of such consents is maintained throughout the term of the Terms and this DPA and/or as otherwise required under Data Protection Laws.
4. Ply Employees.
Ply shall take reasonable steps to ensure that access to the User Personal Data is limited on a need to know and/or access basis and that all Ply employees receiving such access are subject to confidentiality undertakings or professional or statutory obligations of confidentiality in connection with their access to and use of User Personal Data.
5. Security.
Ply shall implement appropriate technical and organizational measures to ensure an appropriate level of security of the User Personal Data. In assessing the appropriate level of security, Ply shall take into account the risks that are presented by the nature of the Processing and the information available to Ply.
6. Personal Data Breach.
Ply shall notify User without undue delay and, where feasible, not later than within 48 (forty eight) hours upon Ply becoming aware of a Personal Data Breach affecting User Personal Data. In such event, Ply shall provide User with reasonable and available information to assist User in meeting any obligations to inform Data Subjects or Supervisory Authorities of the Personal Data Breach as required under Applicable Law. At the written request of the User, Ply shall reasonably cooperate with User and take such commercially reasonable steps as are agreed by the parties or required under Applicable Law to assist in the investigation, mitigation and remediation of any Personal Data Breach.
7. Sub Processing.
User authorizes Ply to appoint (and permits each Sub Processor appointed in accordance with this Section 7 to appoint) Sub Processors in accordance with this Section 7.
Ply may continue to use those Sub Processors already engaged by it as of the date of this DPA. Ply may appoint new Sub Processors and shall give notice of any such appointment to User. If, within seven (7) days of such notice, User notifies Ply in writing of any reasonable objections to the proposed appointment, Ply shall not appoint the proposed Sub Processor for the Processing of User Personal Data until reasonable steps have been taken to address the objections raised by User and User has been provided with a reasonable written explanation of the steps taken. Where such steps are not sufficient to relieve User's reasonable objections, each of User or Ply may, by written notice to the other party and with immediate effect, terminate the Terms to the extent that it relates to the Service requiring the use of the proposed Sub Processor. In such event, the terminating party shall not bear any liability for such termination.
With respect to each new Sub Processor, Ply shall:
Prior to the Processing of User Personal Data by Sub Processor, take reasonable steps (for instance by way of reviewing privacy policies as appropriate) to ensure that Sub Processor is committed and able to provide the level of protection for User Personal Data required by this DPA; and
ensure that the arrangement between Ply and the Sub Processor is governed by a written contract, including terms that offer a materially similar level of protection for User Personal Data as those set out in this DPA and meet the requirements of Applicable Law.
Ply shall remain fully liable to the User for the performance of any Sub Processor's obligations.
8. Data Subject Rights.
User shall be solely responsible for compliance with any statutory obligations concerning requests to exercise Data Subject rights under Data Protection Laws (e.g., for access, rectification, deletion of User Personal Data, etc.). Ply shall, at User's sole expense, use commercially reasonable efforts to assist User in fulfilling User's obligations with respect to such Data Subject requests, as required under Data Protection Laws.
Upon receipt of a request from a Data Subject under any Data Protection Laws in respect to User Personal Data, Ply shall notify User of such request and shall not respond to such request except on the documented instructions of User or as required by Data Protection Laws to which Ply is subject, in which case Ply shall, to the extent permitted by Data Protection Laws, inform User of such legal requirement prior to responding to the request.
9. Data Protection Impact Assessment and Prior Consultation.
At User's written request and expense, Ply and each Sub Processor shall provide reasonable assistance to User with respect to any User Personal Data Processed by Ply and/or a Sub Processor, with any data protection impact assessments or prior consultations with Supervisory Authorities or other competent data privacy authorities, as required under any Data Protection
10. Deletion or Return of User Personal Data.
Ply shall promptly and in any event within 60 (sixty) days of the date of termination of the Terms, delete, return, or anonymize all copies of such User Personal Data, provided however that Ply may retain User Personal Data, as permitted by applicable law.
11. Audit Rights.
Subject to Sections2 and 11.3, Ply shall make available to an auditor mandated by User in coordination with Ply, upon prior written request, such information reasonably necessary to demonstrate compliance with this DPA and shall allow for audits, including inspections, by such reputable auditor mandated by the User in relation to the Processing of the User Personal Data by Ply, provided that such third-party auditor shall be subject to confidentiality obligations.
Any audit or inspection shall be at User's sole expense, and subject to Ply's reasonable security policies and obligations to third parties, including with respect to confidentiality. The results of any audit or inspection shall be considered the confidential information of Ply and shall be treated with the same degree of care as User affords its own confidential information.
User and any auditor on its behalf shall use best efforts to minimize or avoid causing any damage, injury or disruption to Ply's premises, equipment, employees and business and shall not interfere with Ply's day-to-day business. User and Ply shall mutually agree upon the scope, timing and duration of the audit or inspection and the reimbursement rate, for which User shall be responsible. Ply need not give access to its premises for the purposes of such an audit or inspection:
to any individual, unless he or she produces reasonable evidence of identity and authority;
if Ply was not given a prior written notice of such audit or inspection;
outside of normal business hours at those premises, unless the audit or inspection needs to be conducted on an emergency basis; or
for the purposes of more than one (1) audit or inspection in any calendar year, except for any additional audits or inspections which:
User reasonably considers necessary because of genuine concern as to Ply's compliance with this DPA; or
User is required to carry out by Applicable Law, a Supervisory Authority or any similar regulatory authority responsible for the enforcement of Applicable Law in any country or territory where User has identified its concerns or the relevant requirement or request in its prior written notice to Ply of the audit or inspection.
e. Ply shall immediately inform User if, in its opinion, an instruction received under this DPA infringes the GDPR or other applicable Data Protection Laws.
12. Limitation of Liability.
User shall indemnify and hold Ply harmless against all claims, actions, third party claims, losses, damages and expenses incurred by Ply and arising directly or indirectly out of or in connection with a breach of this DPA and/or the Data Protection Laws by User. Each party's liability toward the other party shall be subject to the limitations on liability under the Terms.
13. General Terms.
Governing Law and Jurisdiction.
The parties to this DPA hereby agree that the competent courts in Ireland shall have exclusive jurisdiction regarding all disputes hereunder, and the parties expressly consent to such jurisdiction.
This DPA and all non-contractual or other obligations arising out of or in connection with it are governed by the laws of Ireland .
Order of Precedence.
Nothing in this DPA reduces Ply's obligations under the Terms in relation to the protection of User Personal Data or permits Ply to Process (or permit the Processing of) User Personal Data in a manner that is prohibited by the Terms.
This DPA is not intended to, and does not in any way limit or derogate from User's obligations and liabilities towards Ply under the Terms and/or pursuant to Data Protection Laws or any law applicable to User in connection with the collection, handling and use of User Personal Data by User or other processors or their Sub Processors, including with respect to the transfer or provision of User Personal Data to Ply and/or providing Ply with access thereto.
Subject to this Section 13.2, with regard to the subject matter of this DPA, in the event of inconsistencies between the provisions of this DPA and any other agreements between the parties, including the Terms and including (except where explicitly agreed otherwise in writing, signed on behalf of the parties) agreements entered into or purported to be entered into after the date of this DPA, the provisions of this DPA shall prevail.
Changes in Data Protection Laws.
User may, by at least 45 (forty five) calendar days' prior written notice to Ply, request in writing any variations to this DPA if they are required as a result of any change in or decision of a competent authority under any Data Protection Laws in order to allow User Personal Data to be Processed (or continue to be Processed) without breach of that Data Protection Laws.
If User gives notice with respect to its request to modify this DPA under Section 3.1, (i) Ply shall make commercially reasonable efforts to accommodate such modification request and (ii) User shall not unreasonably withhold or delay agreement to any consequential variations to this DPA proposed by Ply to protect Ply against additional risks, or to indemnify and compensate Ply for any further steps and costs associated with the variations made herein.
Severance. Should any provision of this DPA be held invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall either be (i) amended as necessary to ensure its validity and enforceability, while preserving the parties' intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.
Schedule 1: Details of Processing of User Personal Data
This Schedule 1 includes certain details of the Processing of User Personal Data as required by Article 28(3) GDPR.
Subject matter and duration of the Processing of User Personal Data.
The subject matter and duration of the Processing of the User Personal Data are set out in the Terms and this DPA.
The nature and purpose of the Processing of User Personal Data:
Providing the Service, as detailed in the Terms.
The types of User Personal Data to be Processed are as follows:
Any Personal Data that may be stored in User's systems that are used in connection with the Service, as detailed in the Terms.
The categories of Data Subject to whom the User Personal Data relates are as follows:
Any data subjects whose Personal Data User elects to make available to Ply in connection with the Service, which may include employees, customers, potential customers, vendors and others.
The obligations and rights of User.
The obligations and rights of User are set out in the Terms and this DPA.
Last updated