This Data Processing Addendum (“DPA“) is supplemental to the Agreement between SourceWhale and the Customer.
In the event of a conflict between any of the provisions of this DPA and the remaining provisions of the Agreement, the provisions of this DPA shall prevail.
Unless otherwise set out below, each capitalised term in this DPA shall have the meaning set out in the Agreement and the following capitalised terms used in this DPA shall be defined as follows:
(a) “Customer Personal Data” means the personal data described in ANNEX 1 and any other personal data that SourceWhale processes on behalf of the Customer in connection with SourceWhale’s provision of the Services;
(b) “Data Protection Laws” means all applicable laws and guidance by relevant supervisory authorities relating to data protection and the processing of personal data including:
(i) the UK Data Protection Act 2018 and UK GDPR, as amended from time to time (“GDPR“);
(ii) national legislation implementing Directive 2002/58/EC (as amended); and
(iii) any applicable legislation protecting the fundamental rights and freedoms of persons and their right to privacy with regard to the Processing of Customer Personal Data;
(c) “European Economic Area” or “EEA” means the Member States of the European Union together with Iceland, Norway, and Liechtenstein;
(d) “Security Incident” means any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, any Customer Personal Data;
(e) “Subprocessor” means any Processor engaged by SourceWhale who agrees to receive from SourceWhale Customer Personal Data; and
(f) the terms “personal data“, “Controller“, “Processor“, “Data Subject“, “Process” and “Supervisory Authority” shall have the same meaning as set out in the applicable Data Protection Laws.
3.1 Instructions for Data Processing. SourceWhale will only Process Customer Personal Data in accordance with the Agreement, to the extent necessary to provide the Services to the Customer, and Customer’s written instructions. In connection with the provision of the Services and the Processing of Data, each Party will comply with: (a) any and all applicable laws, rules, regulations, directives applicable to the Processing of Customer Personal Data, including all Data Protection Laws, and (b) all industry standards concerning data protection, privacy and information security. In addition, Service Provider will not disclose the Customer Personal Data to any third party apart from Sub-processors authorized by Customer under this Addendum, unless required to do so under the Data Protection Laws to which Service Provider is subject.
3.2 Processing outside the scope of this DPA or the Agreement will require prior written agreement between the Customer and SourceWhale on additional instructions for Processing.
3.3 Required consents. Where required by applicable Data Protection Laws, the Customer will ensure that it has obtained/will obtain all necessary consents, and has provided/will provide the necessary notifications, for the Processing of Customer Personal Data by SourceWhale in connection with the provision of the Services and as otherwise set out in the Agreement.
4.1 Consent to Subprocessor Engagement. The Customer generally authorises the engagement of third parties as Subprocessors.
4.2 List of Subprocessors.
4.3 Requirements for Subprocessor Engagement.
When engaging any Subprocessor, SourceWhale will ensure that:
(i) the Subprocessor only accesses and uses Customer Personal Data to the extent required to perform the obligations subcontracted to it and does so in accordance with the Agreement and this DPA; and
(ii) the same obligations are imposed on the Subprocessor with regard to their Processing of Customer Personal Data, as are imposed on SourceWhale under this DPA.
4.4 Opportunity to Object to Subprocessor Changes.
(a) When any new Subprocessor is engaged during the Agreement, SourceWhale will, at least 30 days before the new Subprocessor processes any Customer Personal Data, inform Customer of the engagement (including the name and location of the relevant subprocessor and the activities it will perform), if Customer opts-in to receive such notification prior to any such changes by emailing info@sourcewhale.com and asking to be subscribed.
(b) Customer may object to the appointment of that Subprocessor by providing documentary evidence that reasonably shows that the Subprocessor does not or cannot comply with the requirements in this DPA (“Objection“). If SourceWhale does not remedy or provide a reasonable workaround for the Customer’s Objection within a reasonable time, Customer may object to any new Subprocessor by terminating the Agreement immediately upon written notice to SourceWhale, on condition that Customer provides such notice within 90 days of being informed of the engagement of the subprocessor as described in clause 4.4(a). This termination right is Customer’s sole and exclusive remedy if Customer objects to any new Subprocessor.
4.5 Transfers of Personal Data Outside the EEA. To the extent that the Processing of Customer Personal Data by SourceWhale involves the export of such Personal Data to a country or territory outside the EEA, such transfer shall be to a third party:
(a) in a country, territory or specified sector which ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data, as set out in an adequacy decision by the European Commission, the UK Data Protection Act 2018 or regulations made by the UK Secretary of State under the UK Data Protection Act 2018;
(b) that is a member of a compliance scheme recognised by the European Commission as offering adequate protection for the rights and freedoms of data subjects; or
(c) that has signed:
in each case as amended or approved by the ICO for use in respect of transfers by a data exporter subject to the UK GDPR;
(d) that has entered into any other transfer mechanism approved by the ICO.
5.1 SourceWhale Security Obligations. SourceWhale will develop and maintain a comprehensive security program including without limitation appropriate administrative, technical, organizational and physical security measures to protect the Data against accidental or unlawful destruction, loss, alteration, unauthorized access or disclosure, which measures are described in ANNEX 2. SourceWhale will limit access to the Data to personnel whose roles reasonably require such access and who have agreed contractually in writing to maintain the confidentiality and security of the Data in keeping with the terms of this Addendum. SourceWhale will maintain written policies including without limitation, an information security policy, security and privacy guidelines, an internal acceptable use policy, and internal procedural documentation, and provide Customer with reasonable evidence of its policies and guidelines upon request. Upon hire and annually thereafter, each of SourceWhale’s personnel will receive training in the security and handling of Data and will agree in writing to adhere to SourceWhale’s privacy and security guidelines and policies. SourceWhale will remain responsible for and liable for its personnel’s compliance with the terms of this Addendum.
5.2 Service Provider Security Audits. The Customer may audit (by itself or using independent third party auditors) SourceWhale’s compliance with the security measures set out in this DPA (including the technical and organisational measures as set out in ANNEX 2), including by conducting audits of SourceWhale’s (and Subprocessors’) data processing facilities and such audits may be performed at least once annually.
5.3 SourceWhale shall make available to the Customer on request all information necessary to demonstrate compliance with this DPA. SourceWhale shall immediately inform the Customer if, in its opinion, an instruction pursuant to this clause 5.3 infringes applicable Data Protection Laws.
5.4 Security Incident Notification. If SourceWhale or any Subprocessor becomes aware of, or has reason to suspect that there has been, a Security Incident, SourceWhale will (a) notify the Customer of the Security Incident without undue delay, (b) investigate the Security Incident and provide such reasonable assistance to the Customer (and any law enforcement or regulatory official) as required to investigate the Security Incident, and (c) take steps to remedy any non-compliance with this DPA.
5.5 SourceWhale Employees and Personnel. SourceWhale shall treat the Customer Personal Data as the Confidential Information of the Customer, and shall ensure that:
(a) access to Customer Personal Data is limited to those employees or other personnel who have a business need to have access to such Customer Personal Data;
(b) any employees or other personnel who have access to Customer Personal Data have agreed in writing to protect the confidentiality and security of Customer Personal Data.
6.1 Data Subject Requests. Save as required (or where prohibited) under applicable law, SourceWhale shall notify the Customer of any request received by SourceWhale or any Subprocessor from a Data Subject in respect of their personal data included in the Customer Personal Data, and shall not respond to the Data Subject, unless requested or agreed to by Customer to support in Customer’s responsibilities as Data Controller.
6.2 SourceWhale shall, where possible, assist the Customer with ensuring its compliance under applicable Data Protection Laws, and in particular shall:
(a) provide the Customer with the ability to correct, delete, block, access or copy the personal data of a Data Subject, or
(b) promptly correct, delete, block, access or copy Customer Personal Data within the Services at the Customer’s request.
6.3 Government Disclosure. SourceWhale shall notify the Customer of any request for the disclosure of Customer Personal Data by a governmental or regulatory body or law enforcement authority (including any data protection supervisory authority) unless otherwise prohibited by law or a legally binding order of such body or agency.
7.1 SourceWhale shall provide Customer with any information or assistance reasonably requested by Customer for the purpose of complying with any of Customer’s obligations under applicable Data Protection Laws, including:
(a) assisting Customer by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of Customer’s obligation to respond to requests for exercising Data Subject rights laid down in the applicable Data Protection Laws;
(b) providing reasonable assistance to Customer with any data protection impact assessments and with any prior consultations to any Supervisory Authority of Customer, in each case solely in relation to Processing of Customer Personal Data and taking into account the nature of the Processing and information available to SourceWhale.
8.1 Deletion of data. SourceWhale shall, within 90 (ninety) days of the date of termination of the Agreement:
(a) upon written request, return a complete copy of all Customer Personal Data by secure file transfer in such a format as notified by the Customer to SourceWhale; and
(b) delete and use all reasonable efforts to procure the deletion of all other copies of Customer Personal Data Processed by SourceWhale or any Subprocessors.
8.2 SourceWhale and its Subprocessors may retain Customer Personal Data to the extent required by applicable laws and only to the extent and for such period as required by applicable laws and always provided that SourceWhale shall ensure the confidentiality of all such Customer Personal Data and shall ensure that such Customer Personal Data is only Processed as necessary for the purpose(s) specified in the applicable laws requiring its storage and for no other purpose.
9.1 Except as expressly provided herein, nothing in this DPA will be deemed to waive or modify any of the remaining provisions of the Agreement, which otherwise remains in full force and effect. Specifically, nothing in this DPA will affect any of the terms of the Agreement relating to SourceWhale’s limitations of liability, which will remain in full force and effect.
9.2 In the event of a conflict or inconsistency between the terms of this DPA and the terms of the Agreement, the terms of this DPA will prevail.
Subject matter and duration of the Processing of Customer Personal Data
The subject matter of the Processing of Customer Personal Data is the use of and access to the Service by the Customer in accordance with the Agreement. The duration of the Processing of Customer Personal Data is the Term, subject to clauses 8 of this DPA.
The nature and purpose of the Processing of Customer Personal Data
The Processing of Customer Personal Data provided by Customer to SourceWhale for the purposes of providing the Service to the Customer.
The categories of data subject to whom the Customer Personal Data relates
The types of Customer Personal Data to be processed
The obligations and rights of the Customer
The obligations and rights of the Customer are as set out in this DPA and the Agreement.
This document is a high-level overview of SourceWhale’s technical and organizational measures. SourceWhale may change these measures from time to time to adapt to the evolving security landscape and where required will notify clients of these changes.
Within this document, the following definitions apply:
Client: any customer of SourceWhale
SourceWhale Platform: the software-as-a-service provided by SourceWhale to its Clients
Client Data: any information provided by the Client that is processed by the SourceWhale Platform
Personnel: employees of SourceWhale and authorized individual contractors/vendors
Organization of Information Security
Objective: To administer SourceWhale’s information security structure
Measures:
Physical Access
Objective: To protect the physical assets that contain Client Data.
Measures:
System Access
Objective: To ensure systems containing Client Data are used only by approved, authenticated users.
Measures:
Data Access
Objective: To ensure Personnel entitled to use systems gain access only to the Client Data that they are authorized to access.
Measures:
Data Transmission/Storage/Destruction
Objective: To ensure Client Data is not read, copied, altered or deleted by unauthorized parties during transfer/storage.
Measures:
Confidentiality And Integrity
Objective: To ensure Client Data remains confidential throughout processing and remains intact, complete and current during processing activities.
Measures:
Availability
Objective: To ensure Client Data is protected from accidental destruction or loss, and there is timely access, restoration or availability to Client Data in the event of a service incident.
Measures:
Data Separation
Objective: To ensure each Client’s Data is processed separately.
Measures:
Incident Management
Objective: In the event of any security breach of Client Data, the effect of the breach is minimized and the Client is promptly informed.
Measures:
Audit
Objective: To ensure SourceWhale regularly tests, assesses and evaluates the effectiveness of the technical and organizational measures outlined above.
Measures: