Data Processing Agreement

Data Protection Roles

1. The Parties acknowledge that:

   1. they each shall be independent controllers in respect of the Contact Data: and 

   2. Zyte shall be a Processor and Client shall be a Controller in respect of the Service Personal Data. 

Client Obligations

1. Client represents and warrants that it will only use the Service Personal Data to process Personal Data if such processing is in compliance with the applicable Data Protection Laws.

2. Client, as the Controller, represents and warrants that any processing instructions given to Zyte shall be lawful and in compliance with the applicable Data Protection Laws.  Client further represents and warrants that it has and will continue at all times to have in place all fair Processing notices, (where applicable) consent mechanisms for Data Subjects and other measures required to ensure that all Processing of Service Personal Data on the Client's behalf contemplated pursuant to this DPA, shall be lawful and shall not contravene the applicable Data Protection Laws.

Zyte Obligations

1. Zyte, as the Controller, will process Contact Data for the purposes of providing the Services to Client under the Zyte Terms and any applicable Agreement.

2. Zyte, as the Processor, will process the Service Personal Data only on documented instructions from Client.

3. Without prejudice to the Client's obligations pursuant to Section 3, Zyte shall immediately inform Client if instructions given by Client, in Zyte' opinion, infringe the GDPR or applicable Union or Member State data protection provisions.

4. Zyte warrants that all persons authorized by Zyte to Process Personal Data are subject to obligations of confidentiality or are under an appropriate statutory obligation of confidentiality to ensure that the Service Personal Data is kept safe and secure.

5. Zyte shall implement and maintain appropriate TOMs designed to meet the requirements of Article 32 of the GDPR to protect the the Personal Data against any misuse, accidental, unlawful or unauthorized destruction, loss, alteration, disclosure, acquisition or access.

6. Zyte shall without undue delay, and in any event no later than seventy-two (72) hours, notify Client of a Security Event. Where, and insofar as, it is not possible to provide all information at the same time, the initial notification of a Security Event shall contain the information then available and further information shall be provided as it becomes available without undue further delay.

7. Zyte will provide Client with information about:

   1. the details of a contact point where more information concerning the Security Event can be obtained;

   2. the nature of the Security Event including the categories and approximate number of Data Subjects and Personal Data records concerned;

   3. the likely consequences of the Security Event; and

   4. the steps Zyte has taken to address the Security Event.

8. Zyte shall:

   1. take all necessary steps to mitigate the effects and to minimize any damage resulting from the Security Event and to prevent a recurrence of such Security Event; and

   2. provide such assistance and cooperation as Client requires in responding to the Security Event including in relation to notifying any relevant regulatory authority and/or affected Data Subject(s) of the Security Event. 

Sub-Processors

1. Client agrees that Zyte may share Personal Data with the Sub-Processors listed in Annex III.  Zyte may remove or replace the current Sub-Processors from time to time as necessary to provide the Services and will notify You of any such changes. 

2.  Zyte must ensure that a written contract is entered into with each Sub-Processor that is compliant with the Data Protection Laws. Zyte shall be responsible and liable for any acts or omissions of the Sub-Processor.

3.  Instructions given by Zyte to any Sub-Processor shall be within the scope of this DPA.

Third Country Transfer of Personal Data

1. The Parties acknowledge and agree Zyte may from time to time transfer Contact Data and Service Personal Data outside of the EEA.

2. In the event of a Restricted Transfer, the Parties agree that the Standard Contractual Clauses will be incorporated by reference and form part of this DPA as follows:

   1. Client shall be the “data importer” and Zyte shall be the “data exporter”.

   2. In relation to Client’s contact information, Module One shall apply as the Parties are independent Controllers. In relation to data extracted using Zyte Services, Module Four shall apply as Client is the Controller and Zyte is the Processor.

   3. In Clause 7, the optional docking clause shall not apply

   4. In Clause 9, Option 2 shall apply with at least 7 days prior notice (including email).

   5. In Clause 11, the optional language shall not apply.

   6. In Clause 17, the law of Ireland shall apply.

   7. In Clause 18, the courts of Ireland shall apply.

   8. the Annex I and II to the Standard Contractual Clauses are set out in the Annex I and II to this DPA

3. In the event of a change in any applicable Data Protection Laws relating to the country/countries where an adequate level of data protection exists requiring an alternative Transfer Solution to be implemented to permit the continued transfers of Personal Data anticipated in the Agreement, the Parties each agree to act reasonably to seek to agree an alternative Transfer Solution permitting the relevant Party to continue Processing the Personal Data in the relevant country/countries and the relevant international transfer(s) to continue.

4.  In the event the European Commission issues any replacement or substitution of the Standard Contractual Clauses, upon receipt of written notice from a Party requiring the same, the Standard Contractual Clauses incorporated into this DPA pursuant to this clause 6.4 shall be deemed to be deleted and replaced with such replacement or substitution which each Party agrees shall be deemed to be incorporated into this Agreement in place of the Standard Contractual Clauses (and all references in this DPA shall be deemed to refer to such replacement or substitutions clauses accordingly).  To the extent necessary, each Party agrees to co-operate taking such other measures as may be necessary to give effect to such replacement or substitution of the Standard Contractual Clauses in order to comply with applicable Data Protection Laws and/or otherwise satisfy any administrative or documentary requirements relating to the same.

General

1. Nothing in this DPA reduces the Client's obligations under the Agreement in relation to the protection of Personal Data. 

2. This DPA and any disputes or claims arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by, and construed, in accordance with, the laws of Ireland.

3. The Parties irrevocably agree that in relation to any dispute or claim that arises out of or in connection with the DPA or its subject matter or formation (including non-contractual disputes or claims) the courts of Ireland shall have jurisdiction.