DATA PROCESSING ADDENDUM
Updated: 10 September 2024
THESE DEMAND-GENIUS TERMS OF SERVICE ("TERMS OF SERVICE"), TOGETHER WITH ANY ORDER (DEFINED BELOW) AND OUR DATA PROCESSING ADDENDUM INCLUDING ANY DOCUMENT REFERENCED IN ANY OF THE SAME (COLLECTIVELY THE “AGREEMENT”), CONSTITUTES A LEGAL AGREEMENT BETWEEN DEMAND-GENIUS LIMITED (“DEMAND-GENIUS”) AND YOU OR THE LEGAL ENTITY YOU REPRESENT AS IDENTIFIED WHEN YOU REGISTERED THE CUSTOMER’S ACCOUNT FOR THE SERVICES (“CUSTOMER” OR “YOU”).
PLEASE READ THE AGREEMENT CAREFULLY AS IT GOVERNS YOUR ACCESS TO, AND USE OF, THE SERVICES (DEFINED BELOW) AND ANY RELATED DOCUMENTATION.
BY CREATING AN ACCOUNT, OR OTHERWISE ACCESSING OR USING THE SERVICES, YOU AGREE TO BE BOUND BY THE TERMS OF THIS AGREEMENT. IF YOU DO NOT AGREE TO THE TERMS OF THIS AGREEMENT, DO NOT ACCESS OR USE THE SERVICES OR ANY RELATED DOCUMENTATION.
AGREED TERMS
- Definitions and Interpretation
The following definitions and rules of interpretation apply in this DPA.
- Definitions:
- Business Purposes: the Services and any other purpose specifically identified in ANNEX A.
- Customer Personal Data: means Personal Data which Demand-Genius Processes on behalf of the Customer in the performance of the Services. It does not include Personal Data for which Demand-Genius is a Controller.
- Commissioner: the Information Commissioner (see Article 4(A3), UK GDPR and section 114, DPA 2018).
- Controller, Processor, Data Subject, Personal Data, Personal Data Breach and Processing: have the meanings given to them in the Data Protection Laws.
- Data Protection Laws: has the meaning set out in the Terms of Service available at https://www.demand-genius.com/terms (or such other web address notified by Demand-Genius to the Customer from time to time) which also form part of the Agreement.
- Services: the SaaS and/or Professional Services to be provided by Demand-Genius to the Customer as described in the Agreement.
- Sub-processor: means any entity which is engaged by Demand-Genius to process the Customer Personal Data for the Business Purposes. For the avoidance of doubt, Sub-processors do not include individual consultants which may be engaged by Demand-Genius to perform any of Demand-Genius’s obligations under the Agreement. Such consultants shall be treated like Demand-Genius’s employees and Demand-Genius shall be liable for their acts and omissions to the same extent as if the acts or omissions were performed by Demand-Genius.
- This DPA is subject to the terms of the Agreement and is incorporated into the Agreement. Interpretations and defined terms set forth in the Agreement apply to the interpretation of this DPA.
- The Annexes form part of this DPA and will have effect as if set out in full in the body of this DPA. Any reference to this DPA includes the Annexes.
- Personal Data types and processing purposes
- The Customer and Demand-Genius agree and acknowledge that for the purpose of the Data Protection Laws:
- the Customer is the Controller and Demand-Genius is the Processor.
- the Customer retains control of the Customer Personal Data and remains responsible for its compliance obligations under the Data Protection Laws, including but not limited to, providing any required notices and obtaining any required consents, and for the written processing instructions it gives to Demand-Genius.
- ANNEX A describes the subject matter, duration, nature and purpose of the processing and the Customer Personal Data categories and Data Subject types in respect of which Demand-Genius may process the Customer Personal Data to fulfil the Business Purposes.
- Demand-Genius’s obligations in respect of Customer Personal Data
- Demand-Genius will only process the Customer Personal Data to the extent, and in such a manner, as is necessary for the Business Purposes in accordance with the Customer’s written instructions as established in the Agreement. Notwithstanding the foregoing, Demand-Genius may process Customer Personal Data as required under the Data Protection Laws. In this situation, Demand-Genius will take reasonable steps to inform the Customer of such a requirement before Demand-Genius processes the data, unless the law prohibits this. Demand-Genius must promptly notify the Customer if, in its opinion, the Customer’s instructions do not comply with the Data Protection Laws.
- Demand-Genius will ensure that all persons authorised to process the Customer Personal Data have committed themselves to contractual obligations of confidentiality.
- Demand-Genius will implement and maintain appropriate technical and organisational measures as set out in ANNEX B to protect the Customer Personal Data from accidental or unlawful destruction, loss, alteration, or unauthorised disclosure or access. The Customer acknowledges that Demand-Genius may change the technical and organisational measures set out in ANNEX B by written notice to the Customer provided that they do not materially diminish the level of protection.
- At the Customer’s reasonable request:
- taking into account the nature of processing, assist the Customer by implementing appropriate technical and organisational measures, insofar as this is possible, to assist with the Customer’s obligation to respond to requests from Data Subjects of Customer Personal Data seeking to exercise their rights under applicable Data Protection Laws (to the extent that the Customer Personal Data is not otherwise accessible to the Customer through the Services);
- taking into account the nature of processing and the information available to Demand-Genius, assist the Customer with its obligations under Articles 32 to 36 of the UK GDPR and EU GDPR, as they relate to Customer Personal Data.
- Personal Data Breach
- Demand-Genius will notify the Customer, without undue delay and in any event within 48 hours, if it becomes aware of a Personal Data Breach in respect of Customer Personal Data. Such notice will, where possible, provide the Customer with sufficient information to allow the Customer to meet any obligations under applicable Data Protection Laws to report or inform Data Subjects, the Commissioner, other in-scope regulators, law enforcement agencies or others of the Personal Data Breach.
- Demand-Genius will, in line with its incident response plans and policies, take reasonable steps to identify, prevent and mitigate the effects of the Personal Data Breach and to remedy the Personal Data Breach to the extent such remediation is within Demand-Genius’s reasonable control.
- Demand-Genius shall, at the Customer’s reasonable request, take such other steps as Customer may reasonably require in respect of the Personal Data Breach including the provision of additional information over and above that described in clause 4.1.
- Cross-border transfers of personal data
- Demand-Genius may process the Customer Personal Data outside the UK/European Economic Area under the following conditions: (a) Demand-Genius processes the Customer Personal Data in a territory which is subject to adequacy regulations or decisions under the applicable Data Protection Laws; or (b) Demand-Genius participates in a valid cross-border transfer mechanism under the applicable Data Protection Laws to ensure an adequate level of protection with respect to the privacy rights of individuals as required by Data Protection Laws in Article 46 of the UK GDPR and EU GDPR.
- Sub-processors
- The Customer consents to Demand-Genius engaging Sub-processors provided that: (i) Demand-Genius remains responsible for its Sub-processors compliance with the obligations of this DPA; and (ii) Demand-Genius enters into written agreements with such Sub-processors imposing data protection terms which are no less protective in any material respect than the obligations provided under this DPA.
- A current list of Sub-processors approved as at the date of this DPA is set out at https://www.demand-genius.com/terms (or such other web address notified by Demand-Genius to the Customer from time to time) (“Sub-processor List”).
- Demand-Genius may add additional Sub-processors or make changes to the Sub-processor List provided that the Customer is given 14 days’ prior notice, and the Customer does not legitimately object, in writing, to such changes within that timeframe. In such event, Demand-Genius will either not appoint the Sub-processor and/or make the proposed changes, or, if this is not possible, notify the Customer of an option to terminate the applicable Services which cannot be provided by Demand-Genius without the objected to Sub-processor addition or changes (without prejudice to any Fees incurred by the Customer prior to suspension or termination).
- The Customer’s obligations in respect of Customer Personal Data
- The Customer shall not disclose (and shall not permit any Data Subject to disclose) any sensitive data (special categories) of Personal Data or Personal Data that imposes specific data security or data protection obligations on Demand-Genius in addition to, or different from, those specified in this DPA or the Agreement to Demand-Genius for processing except where and to the extent expressly disclosed in ANNEX A.
- The Customer shall comply with all necessary transparency and lawful requirements under the Data Protection Laws in order to disclose the Customer Personal Data to Demand-Genius for the Business Purposes.
- Term and termination
- This DPA will remain in full force and effect so long as:
- the Agreement remains in effect; or
- Demand-Genius retains any of the Customer Personal Data related to the Agreement in its possession or control,
- Any provision of this DPA that expressly or by implication should come into or continue in force on or after termination of the Agreement in order to protect the Customer Personal Data will remain in full force and effect.
- Data return and destruction
- Upon termination or expiry of the Agreement, Demand-Genius shall destroy all Customer Personal Data (including all copies of the Customer Personal Data) in its possession or control, except as otherwise stated in the Agreement. This requirement shall not apply to the extent that Demand-Genius is required by any applicable law to retain some or all of the Customer Personal Data, or to Customer Personal Data it has archived on back-up systems, in which event Demand-Genius shall isolate and protect the Customer Personal Data from any further processing except to the extent required by such law until deletion is possible.
- Audit
- On the Customer's written request, Demand-Genius will provide a summary copy of any applicable audit or certification report(s) such as ISO 27001.
- Where the information detailed in the audit or certification report(s) provided under clause 10.1 is not sufficient under Data Protection Laws, the Customer may also request Demand-Genius to respond, no more than once annually, to any audit questionnaire as reasonably required to help with the Customer's assessment of Demand-Genius's compliance with its obligations under this DPA. In the event: (A) Demand-Genius fails to respond to a questionnaire issued in accordance with this clause within 60 days of its receipt; or (B) the responses (and, where applicable, documentary evidence) provided by Demand-Genius demonstrates a material breach of this DPA by Demand-Genius, then the Customer may engage a third party auditor to assess Demand-Genius’s compliance with the terms of this DPA. Such third party shall have access to Demand-Genius’s processing facilities and receive the necessary information in order to be able to assess and audit if Demand-Genius complies with its obligations under the DPA, including ensuring that the appropriate technical and organisational security measures have been implemented.
- Demand-Genius's audit or certification report(s), Demand-Genius’s responses to audit questionnaires, together with any supporting material provided by or acquired from Demand-Genius, shall be considered Confidential Information of Demand-Genius.
- The Customer shall be responsible for all costs and fees, including all reasonable costs and fees for any and all time Demand-Genius expends under clause 10.2 except where the audit reveals a material failure by Demand-Genius to comply with its obligations under this DPA.
- Warranties
- Each party warrants that in relation to this DPA, it is compliant with and will remain compliant with the Data Protection Laws.
- Limitation of Liability
- The total combined liability of either party to the other, whether in contract, tort or under any other theory of liability, shall be limited to the amounts set forth in the Agreement as well as any disclaimers, exclusions or limitations contained therein. Any reference in such section to the liability of a party means the aggregate liability of that party under the Agreement (which includes this DPA).
- Nothing in this DPA shall exclude or limit either party’s liability which cannot be excluded or limited by applicable laws.
- Notice
- Any notice or other communication given to a party under or in connection with this DPA must be in writing (including email) and delivered in accordance with the Notices provision in the Terms of Service.
- Governing Law and Jurisdiction
- This DPA is governed by the laws of England and Wales.
- Any dispute arising in connection with this DPA will be submitted to the exclusive jurisdiction of the courts of England.
- Personal Data processing purposes and details
Type
Description
Data Subject Types
Customer’s users of the Services
Customer’s end clients and prospective clients
Categories of Personal Data
Contact details (such as name, telephone number, Address, City, State/Region email address), job title, user ID and IP address.
Any other personal data provided by the Customer or uploaded or transmitted by Customer’s users into the Services and any personal data Customer expressly instructs Demand-Genius to capture on their behalf related to their end clients and prospective clients excluding always Special Categories of personal data.
Special Categories of Personal Data (if appropriate)
N/A
Nature of Processing
The processing required to deliver the Services to the Customer as described in the Agreement
Duration of Processing
The duration of the Agreement
- Technical and Organisational Measures
Demand-Genius will apply the following technical and organizational measures, as may be updated by Demand-Genius from time to time in accordance with clause 3.3:
1. Physical Access Controls
1.1 Purpose
Demand-Genius shall implement physical access controls to prevent unauthorized physical access to premises, buildings, or rooms where personal data is processed.
1.2 Measures
Demand-Genius shall employ the following measures:
- Access Authorization: Access to secure areas shall be limited to authorized personnel only, based on roles and responsibilities.
- Entry Logs: Detailed logs of all entries to secure areas shall be maintained and regularly reviewed.
- Surveillance: The use of video surveillance systems to monitor access points to secure areas where personal data is processed.
- Visitor Management: Visitors shall be registered, issued visitor badges, and accompanied by authorized personnel at all times.
- Physical Barriers: Secure areas shall be protected by locked doors, security gates, and other physical barriers.
2. System Access Controls
2.1 Purpose
Demand-Genius shall ensure that systems used to process personal data are protected against unauthorized access.
2.2 Measures
Demand-Genius shall implement the following controls:
- User Authentication: Systems shall require strong user authentication methods, such as passwords, multi-factor authentication (MFA), or biometrics.
- Access Rights Management: Access rights shall be granted based on the principle of least privilege and regularly reviewed to ensure appropriateness.
- Session Controls: Sessions shall be automatically timed out after periods of inactivity, requiring re-authentication to regain access.
- Audit Logs: Access to systems shall be logged, including user identification, access times, and the nature of access, with logs regularly reviewed for unauthorized access attempts.
3. Data Access Controls
3.1 Purpose
Demand-Genius shall ensure that access to personal data within systems is restricted to authorized individuals based on their roles and responsibilities.
3.2 Measures
Demand-Genius shall implement the following controls:
- Role-Based Access Control (RBAC): Access to personal data shall be controlled based on the user’s role within the organization, ensuring that individuals can only access the data necessary for their duties.
- Data Access Monitoring: Access to personal data shall be logged and monitored to detect unauthorized or suspicious activity.
- Encryption: Personal data at rest shall be encrypted to protect against unauthorized access by individuals who bypass other controls.
4. Transmission Controls
4.1 Purpose
Demand-Genius shall protect personal data during transmission to prevent unauthorized access, alteration, or loss.
4.2 Measures
Demand-Genius shall implement the following controls:
- Encryption in Transit: All personal data transmitted over networks, whether internally or externally, shall be encrypted using industry-standard encryption protocols (e.g., TLS, SSL).
- Secure Transfer Protocols: Data transfers shall be conducted using secure transfer protocols (e.g., SFTP, HTTPS).
- Integrity Checks: Mechanisms shall be in place to verify the integrity of transmitted data and to detect any unauthorized alterations.
- Access Controls: Access to data transmission channels shall be restricted to authorized personnel only.
5. Data Segregation
5.1 Purpose
Demand-Genius shall ensure that personal data is segregated to prevent unauthorized access or commingling with other data.
5.2 Measures
Demand-Genius shall implement the following controls:
- Logical Segregation: Personal data belonging to different customers or datasets shall be logically segregated within systems to prevent unauthorized access or mixing of data.
- Access Controls: Access to each segregated dataset shall be restricted based on user roles and responsibilities.
- Environment Separation: Production, testing, and development environments shall be separated to ensure that personal data is not used or accessed in non-production environments.
- Data Masking: Where feasible, personal data used in testing or development shall be anonymized or masked to prevent exposure.