This Data Processing Agreement (“DPA”) supplements the Order Form and Platform Access and Services Agreement (“Terms”) (the DPA, along with the Terms, is collectively referred to as the “Agreement”) entered into between Xfinion, Inc. (“Xfinion”) and the Customer (collectively with its affiliates and subsidiaries worldwide, “Customer”); the terms of this DPA are incorporated by reference therein. This DPA shall apply to all Processing of Customer Personal Data by Xfinion to provide the CARTN platform as agreed to in the Order Form.
If there is any conflict between this DPA and the Terms, this DPA shall prevail solely to the extent of such conflict.
1. Definitions
In this DPA, the following terms shall have the meanings set out below and their cognate terms shall be construed accordingly:
1.1 Customer Data has the meaning given to it in the Terms.
1.2 Customer Personal Data means any Customer Data that is Personal Data. Customer Data does not include Unnecessary Data.
1.3 Data Breach means any unauthorized interference with the availability of, or any unauthorized, unlawful or accidental loss, misuse, destruction, alteration, acquisition of, access to, disclosure of, or damage to Customer Data or Confidential Information, or any other unauthorized Processing of Personal Data that may adversely affect the privacy or security of individuals or the Customer. Data Breach does not include unsuccessful attempts or activities that do not compromise the security of Customer Data or Confidential Information, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other similar incidents.
1.4 Data Protection Laws means all applicable laws relating to privacy, security, or protection of Personal Data, as may be defined in such laws, including the EEA Law, the California Consumer Protection Act (“CCPA”), and any subsequent supplements, amendments, or replacements to the same.
1.5 EEA means the European Economic Area and the European Union, Switzerland, and the United Kingdom of Great Britain and Northern Ireland (“UK”).
1.6 EEA Law means EU General Data Protection Regulation (Regulation 2016/679) (“GDPR”), the GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018 and as amended by Schedule 1 to the Data Protection, Privacy and Electronic Communications (Addendums etc.) (EU Exit) Regulations 2019 (“UK GDPR”), the Swiss Federal Data Protection Act and any successor or amendments thereto, and any other law relating to the data protection, security, or privacy of individuals that applies in the EEA.
1.7 Personal Data means any information processed by Xfinion in connection with the performance of the Product, including that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household or with a particular individual’s or household’s device; or any inferences drawn therefrom. Personal Data includes, but is not limited to, name, alias, postal address, identification number, phone number, physical address, email address, location data, online identifiers such as internet protocol addresses, cookie or other unique identifiers, or as otherwise defined under applicable Data Protection Laws.
1.8 Process, processed, or processing means the collection, receipt, recording, organization, structuring, alteration, use, transmission, access, sharing, provision, disclosure, distribution, copying, transfer, storage, management, retention, deletion, combination, restriction, summarizing, aggregation, correlation, inferring, derivation, analysis, adaptation, retrieval, consultation, destruction, disposal, or other handling of Personal Data.
1.9 Services means services provided by Xfinion as agreed to in the Order Form.
1.10 Standard Contractual Clauses means the standard contractual clauses for international transfers published by the European Commission governing the transfer of EEA Personal Data to Third Countries, as adopted by the European Commission, the UK Information Commissioner, or Swiss Federal Data Protection and Information Commissioner (“Swiss FDPIC”), or any successor clauses thereto.
1.11 Third Country means countries that have not received an adequacy decision relating to data transfers from the European Commission, UK ICO, or Swiss FDPIC.
1.12 The terms Controller, Data Processor, Subprocessor, Data Subjects, Sell, and Service Provider shall have the same meaning as in the applicable Data Protection Laws, and their cognate terms shall be construed accordingly.
2. General Data Processing Obligations
2.1 Role of Parties. The parties acknowledge and agree that with respect to processing of Customer Personal Data, Xfinion is a Data Processor and a Service Provider, and Customer is a Controller, except that if Customer is a Data Processor, then Xfinion is a Subprocessor. If Customer is a Processor of Customer Personal Data, Customer represents and warrants that Customer’s instructions and Processing of Customer Personal Data, including its appointment of Xfinion as a Subprocessor, have been authorized by the respective Controller. Notwithstanding the foregoing, Xfinion will be an independent Controller with respect to any Personal Data of Customer employees and other personnel using the Services or acting as administrative or business representatives with respect to the Services.
2.2 Compliance with Data Protection Laws. Each party will comply with obligations under applicable Data Protection Laws in connection with Processing of Customer Personal Data.
2.3 Purpose of Processing. The purpose of Processing under this DPA is the provision of the Services pursuant to the Agreement. Exhibit 1 (Details of Processing of Customer Personal Data) describes the subject matter and details of the Processing of Customer Personal Data.
2.4 Customer Instructions and Restrictions on Processing.
2.4.1. Xfinion shall use, retain, disclose, or otherwise Process Customer Personal Data only on behalf of the Customer and for the specific business purpose of providing the Services and in accordance with Customer’s instructions, including as described in the Agreement. Xfinion shall not Sell Customer Personal Data, nor use, retain, disclose, or otherwise Process Customer Personal Data outside of its business relationship with the Customer or for any other purpose except as required by law. Xfinion will inform Customer if Xfinion determines that it is no longer able to meet its obligations under Data Protection Laws, or where in Xfinion’s reasonable opinion, any of Customer’s instructions infringes any Data Protection Laws. Customer reserves the right to take reasonable appropriate steps to discontinue and remediate unauthorized use of Customer Personal Data.
2.4.2. Xfinion shall have rights to use Customer Personal Data solely (i) to the extent necessary to (a) perform its obligations under this Agreement; (b) operate, manage, test, maintain and enhance the CARTN platform including as part of its business operations; (c) to disclose aggregate statistics about the Service in a manner that prevents individual identification or reidentification; and/or (d) protect the Service from a threat to the Service or Customer Personal Data; or (ii) if required by court order of a court or authorized governmental agency, provided that prior notice first be given to the Customer; (iii) as otherwise expressly authorized by the Customer.
2.4.3. Xfinion will not combine the Customer Personal Data with Personal Data which it receives from or on behalf of another person or persons, or collects from its own interaction with individuals, provided that Xfinion may combine Personal Data to perform any business purpose permitted or required under the Agreement to perform the Services.
2.4.4. Xfinion certifies that it understands these restrictions and will comply with them.
3. Customer’s Obligations
3.1 Customer is solely responsible for the accuracy, quality, and legality of Customer Personal Data that Customer provides or causes to provide to the Service, including without limitation the means by which Customer collected or obtained the Personal Data. Customer will not provide or cause to provide any data or information that is not necessary for Xfinion to provide Customer the Services identified in the Order Form (“Unnecessary Data”). Unnecessary Data must be removed promptly by Customer upon notice from Xfinion. Customer acknowledges that Xfinion is not responsible for the security of Unnecessary Data. Customer is solely responsible for the security and integrity of any Customer’s systems from where Customer Data is provided to Xfinion.
3.2 Customer shall, in its use of the Services, Process Personal Data in compliance with the requirements of Data Protection Laws, including any applicable industry standards and self-regulatory programs that are binding on Customer. Customer shall be responsible for complying with any notice and consent obligations under such Data Protection Laws.
3.3 Customer understands and agrees that Customer is solely responsible for its own actions and activity in connection with the Customer Account and that Customer will keep its account login information confidential.
4. Confidentiality Obligations
4.1 Each party agrees, both during and after termination of this Agreement, to hold the Confidential Information in the strictest confidence and comply with the applicable confidentiality obligations in the Terms.
5. Xfinion Obligations
5.1 Data Protection Compliance Assistance.
5.1.1 Where Xfinion is acting as a Processor, Xfinion will reasonably assist Customer in complying with its obligations under the applicable Data Protection Laws, including without limitation, conducting data protection impact assessments, and any consultations with the supervisory or regulatory authority.
5.1.2 Xfinion shall not perform its obligations under this Agreement in such a way as to cause Customer to breach any of its obligations under applicable Data Protection Laws.
5.2 Data Subject Rights.
5.2.1 Where Xfinion is acting as a Processor or Subprocessor, Xfinion will promptly notify Customer in writing, and in any case without undue delay, if Xfinion receives (i) any requests from a Data Subject with respect to Customer Personal Data, including individual opt-out requests, requests for access and/or deletion and all similar individual rights requests; or (ii) any complaint or inquiry relating to the Processing of Customer Personal Data, including allegations that the Processing infringes on any individual’s or third party’s rights. Xfinion will not respond to any such request or complaint unless expressly authorized to do so by Customer or required to respond under applicable Data Protection Laws.
5.2.2 To the extent Customer, in its use of the Services, does not have the ability to respond to a request under this Section 5, Xfinion shall upon Customer’s written request provide reasonable assistance to the Customer in responding to such request.
5.2.3 Xfinion shall comply with any instructions given by the Customer regarding responding to requests under this Section 5.
5.3 Subprocessors.
5.3.1 The Customer hereby consents to the use of Subprocessors by Xfinion for the purposes of providing the Services pursuant to the Agreement. The Subprocessors that are currently authorized to Process Customer Personal Data will be provided to Customer upon request.
5.3.2 Xfinion must ensure that it has a written agreement in place with all Subprocessors which contains obligations on the Subprocessors which are no less onerous than the obligations on Xfinion under this DPA.
5.4 Staff Confidentiality. Xfinion shall ensure that all employees, agents, officers, consultants, Subprocessors and any third party authorized to Process the Customer Personal Data or Confidential Information are subject to written confidentiality agreements or are under an appropriate statutory obligation of confidentiality.
5.5 Security.
5.5.1 Xfinion will implement and maintain commercially reasonable administrative, technical and physical safeguards, including procedures and practices commensurate with the level of sensitivity of the Customer Personal Data and Confidential Information and the nature of its activities under the Agreement, to protect the security, confidentiality and integrity of such information Processed by Xfinion or in its possession and control including such safeguards (a) designed to ensure the security of systems upon which such information is Processed; and (b) designed to prevent a Data Breach. The description of technical and organization measures designed to ensure the security of Personal Data is described more fully in Exhibit 2 (Security Measures) to this DPA.
5.6 Data Breach.
5.6.1 In the event Xfinion discovers or learns of a Data Breach affecting Customer Data, Xfinion shall take appropriate and prompt steps to: (a) investigate, mitigate, and remedy the Data Breach and prevent further Data Breaches; (b) notify Customer of such Data Breach without unreasonable delay; (c) furnish to Customer necessary and relevant details of the Data Breach as may be available; (d) assist Customer, as needed, in its investigation, mitigation, and remedying of the Data Breach; (e) provide information and reasonably assist Customer, as needed, in meeting Customer’s legal obligations, including any applicable obligations to notify individuals affected by the Data Breach; and (f) cooperate with Customer in any other reasonable action, step, or proceeding as may be deemed necessary by Customer in connection with the Data Breach and any dispute, inquiry or claim concerning the Data Breach.
5.6.2 Unless prohibited by an applicable statute or court order, Xfinion shall notify Customer of any third-party legal process relating to any Data Breach, including, but not limited to, any legal process initiated by any governmental entity.
5.6.3 Xfinion will comply with any reasonable instructions given by the Customer regarding any requests in connection with a Data Breach.
5.6.4 Xfinion’s cooperation or obligation to report or respond to Data Breaches under this DPA is not and will not be interpreted as an acknowledgment by Xfinion of any fault or liability of Xfinion with respect to a Data Breach.
5.7 Audits.
5.7.1 Upon written request from the Customer, Xfinion shall make available to the Customer once a year such information as is reasonably required by the Customer to demonstrate Xfinion’s compliance with its obligations under this DPA.
5.7.2 If the Customer in its reasonable opinion determines that the information provided under Section 5.7.1 is not sufficient, Xfinion will assist with Customer’s request for additional information through completing a reasonable questionnaire or request for information provided by Customer (“Questionnaire”), or a third party acting on Customer’s behalf, regarding Xfinion’s compliance with this DPA.
5.7.3 If the Customer in its reasonable opinion determines that the information provided under Section 5.7.2 is not sufficient, Xfinion will allow the Customer or a third party acting on behalf of the Customer to conduct audits solely as necessary to fulfill Customer’s obligations under Data Protection Laws no more than once annually.
5.7.4 Any such audit under this Section 5.7 will occur only after Customer has provided Xfinion with at least 60 days’ prior written notice and during a mutually agreed upon date, time, and location. Audits must not unreasonably interfere with Xfinion’s business or operations and the scope of such audit will be subject to Xfinion’s reasonable pre-approval. Individuals responsible for conducting such audit shall be subject to a contract of confidentiality with Xfinion. The work required by Xfinion to participate in any audit may result in additional fees (at a mutually agreed upon hourly rate) to be paid by the Customer, unless otherwise agreed in writing prior to the commencement of such audit. If the audit reveals any vulnerability or inadequacy, Xfinion shall correct any such vulnerability or inadequacy at its sole cost and expense and shall certify the same in writing to Customer.
5.7.5 To ensure that Xfinion complies with applicable Data Protection Laws and its contractual obligations regarding data privacy and security, the Customer agrees that Xfinion is not required to provide the Customer with access to Xfinion’s systems or information in a manner that may compromise the security, privacy, or confidentiality of Xfinion’s other Customers’ confidential or proprietary information. Any information disclosed pursuant to this Section 5.7 will be deemed Xfinion’s Confidential Information.
6. Data Transfers
6.1 As of the date this DPA was last updated, all Customer Personal Data is Processed in the United States by Xfinion. In its role as a Processor, Xfinion will not Process any Customer Personal Data subject to EEA Law outside of the United States or a country recognized as “adequate” by the E.U. Commission without Customer’s written authorization.
6.2 Xfinion may Process Customer Personal Data in various jurisdictions in which it operates provided Xfinion reasonably cooperates with the Customer to comply with applicable data transfer restrictions and obligations required by this DPA and applicable Data Protection Laws.
6.3 To the extent Customer Personal Data that is subject to EEA Law is processed, the parties will execute appropriate data processing terms (including any transfer terms) in connection with such processing and transfer.
6.4 To the extent Data Protection Laws require any further steps to be taken in order to permit the transfer of Customer Personal Data to Xfinion (including in relation to data export restrictions under applicable Data Protection Laws outside the EEA), Xfinion will work with Customer in good faith (including, where reasonably necessary, by entering into contractual clauses with Customer) to ensure that the transfer of Customer Personal Data meets the requirements of Data Protection Laws.
7. Return or Destruction of Customer Personal Data
7.1 Either upon request or direction by Customer or termination or expiration of this Agreement, Xfinion will (a) provide a copy of all Customer Personal Data in Xfinion’s possession to the Customer and upon written verification from Customer of Customer’s receipt of such Customer Personal Data, destroy such information in accordance with this Section 7; (b) subject to Section 7.1(a), promptly and securely destroy all such Customer Personal Data in accordance with applicable Data Protection Laws; and (c) certify in writing that it has complied with this Section 7, except to the extent that Xfinion is required by applicable law to keep a copy of the Customer Personal Data and notifies Customer of the same.
7.2 Xfinion agrees to comply with the terms of this DPA to the extent any Customer Personal Data remains in its possession or control in accordance with Section 7.1.
Exhibit 1 — Details of Processing of Customer Personal Data
This Exhibit 1 includes details of the Processing of Customer Personal Data by Xfinion.
1. Data Exporter
Company Name — As mentioned in the applicable Order Form
Address — As mentioned in the applicable Order Form
Contact name, position, and contact information — As mentioned in the applicable Order Form
Role — Controller
2. Data Importer
Company Name — Xfinion, Inc.
Contact — legal@xfinion.com
Role — Processor
3. Activities Relevant to the Data Transferred
The activities relevant to the data transferred are the Services more fully described in the Agreement and applicable ordering documents.
4. Processing Information
Categories of data subjects whose personal data is processed: Customer may submit or give access to Customer Data to Xfinion, the extent of which is determined and controlled by Customer in its sole discretion, and which may include but is not limited to Customer Data relating to:
- Customer’s authorized users, employees, agents, or representatives
- Customer’s customers
Categories of personal data processed: Customer may submit Customer Data to Xfinion which may include the following categories of Customer Data: contact details of the individual which may include first and last name, email address, and IP address; phone numbers and postal address.
Sensitive personal data processed: None
Frequency of the processing: Continuous
Nature and purpose of the processing: The objective of Processing of Customer Data by Xfinion is the performance of the Agreement and this DPA.
Period for which personal data will be retained: Subject to Section 7 of this DPA, Xfinion will process Customer Data for the duration of the Agreement, unless otherwise agreed upon in writing.
Exhibit 2 — Security Measures
Xfinion will implement and maintain a written security program with commercially reasonable administrative, technical, and physical safeguards, including procedures and practices commensurate with the level of sensitivity of the Customer Data and the nature of its activities under the Agreement, to protect the security, confidentiality, availability, and integrity of Customer Data Processed by Xfinion or in its possession and control.
Without limiting the foregoing, Xfinion will:
- Develop and use reasonable steps to select and retain agents and subcontractors that assist Xfinion in performing its obligations under the Agreement, requiring such Subprocessors to agree by written contract to comply with terms substantially similar to those contained in this DPA;
- Conduct routine risk assessments to identify, document, and remediate material internal and external risks to the security, confidentiality, availability, and integrity of Customer Data that could result in a Data Breach, and assess the sufficiency of any security measures in place to control these risks;
- At a minimum, conduct risk assessments covering: (i) employee training and management; (ii) secure system design and testing; (iii) quarterly security and vulnerability scans; and (iv) review, assessment, and response to internal and third-party security vulnerability reports;
- Design and implement reasonable safeguards to control the risks identified through the risk assessments, including regular testing or monitoring of the effectiveness of the safeguards’ key controls, systems, and procedures;
- Establish and enforce written procedures that follow role-based access control principles to control access to systems, networks, services, and facilities that may Process or store Customer Data;
- Monitor access by Xfinion personnel to Customer Data and limit any such access to those with a need to know in order to perform its obligations under the Agreement;
- Implement multi-factor authentication for any system Processing Customer Data;
- Implement and conduct routine security training for Xfinion personnel with access to Customer Data;
- Implement anti-malware software on any systems that Process Customer Data;
- Encrypt Customer Data in transit across public networks and at rest when stored on any device or storage media using industry standard encryption tools;
- Provide reasonable assistance to Customer in Customer’s assessment and implementation of appropriate administrative, technical, and physical safeguards;
- Automatically collect system, application, and user level logs on an ongoing basis for any network or system Processing Customer Data and retain such logs for at least one year;
- Implement, maintain, and monitor physical security controls for any processing facilities; and
- Evaluate and adjust its security program in light of the results of testing and monitoring, any material changes to Xfinion’s operations or business arrangements, or any other circumstances that may have a material impact on the effectiveness of its security program.
Business Continuity and Disaster Recovery: During the term of the Agreement or so long as Xfinion Processes Customer Data, whichever is longer, Xfinion shall implement and maintain a disaster recovery plan that ensures that all Customer Data Processed by Xfinion is capable of being recovered, and that the integrity of all such recovered Customer Data is retained, in the event that Xfinion’s network, systems or other facilities experience a Data Breach or any significant interruption or impairment of operation.