Big learning potential for smaller teams
Transform your business with an industry-leading LMS
Help employees grow with robust AEC & M assessments.
Supercharged features for next-level learning.
Updated May 2024
This Data Processing Addendum (“Addendum“) forms part of the applicable Eagle Point Software Corporation (“Eagle Point”) TERMS AND CONDITIONS (where Licensee has purchased a License to one or more Eagle Point Services defined therein) and/or part of the Eagle Point Software Corporation TERMS AND CONDITIONS – PINNACLE LITE SERVICES (where Licensee has purchased a License to the Pinnacle Lite Services) (each, the “Terms and Conditions”), where and to the extent that Licensee or any of its Permitted Users (as defined in the applicable Terms and Conditions) are citizens or residents of the European Union or otherwise subject to the GDPR.
Licensee and Eagle Point are hereinafter referred to jointly as the “Parties” and each individually as a “Party.”
“Data Protection Law” means the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and any European Union Member State data protection laws implementing or supplementing the GDPR applicable to Licensee, Eagle Point, or the Services.
“Data processor” or “processor”, “data controller” or “controller”, “data subject”, “personal data”, “personal data breach”, “processing”, and “supervisory authority” shall have the meanings given to such terms in the GDPR.
“Licensee personal data” means all personal data subject to Data Protection Law that Eagle Point may process on Licensee’s behalf.
“Data Subject Request” means a communication from a data subject regarding the exercise of rights pursuant to applicable Data Protection Law, including rights to access, rectification, restriction of processing, erasure, and portability of personal data.
“Information Security Incident” means any actual or reasonably suspected personal data breach, security breach, or other unauthorised access, misappropriation, loss, damage, or other compromise of the security, confidentiality, or integrity of any Licensee personal data processed by Eagle Point or a Subprocessor.
“Model Clauses” means the Standard Contractual Clauses for the Transfer of Personal Data to Third Countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council and the Standard Contractual Clauses for the Transfer of Personal Data between Controllers and Processors under Article 28(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council and Article 29(7) of Regulation (EU) 2018/1725 of the European Parliament and of the Council, approved by EC Commission Decision of 4 June 2021 as applicable, attached hereto and incorporated herein by reference as Exhibit 1.
“Services” means the services and other activities that Eagle Point shall provide or carry out for Licensee as set forth in the Terms and Conditions.
“Subprocessor” means another processor engaged by Eagle Point to process Licensee personal data on behalf of Licensee, in accordance with Licensee’s instructions.
2.1 The Parties agree that to the extent that Eagle Point’s performance of the Services in the relevant instance are in such capacity with respect to the provision of the Services, Licensee is the data controller of the personal data and Eagle Point is the data processor of such personal data.
2.2 In accordance with GDPR Article 28(3)(a), Eagle Point and any Subprocessor acting under its authority shall only process Licensee personal data upon Licensee’s documented instructions, as evidenced by the Terms and Conditions or otherwise in writing or electronic form.
2.3 Eagle Point shall inform Licensee if Eagle Point reasonably believes that Licensee’s documented instructions are not compliant with the applicable Data Protection Law.
3.1 This Addendum applies solely to Eagle Point’s processing of Licensee personal data that is subject to Data Protection Law in providing Services to Licensee in accordance with the applicable Terms and Conditions.
3.2 As required by Article 28(3) of the GDPR, the subject matter, nature and purpose of the processing, type of Licensee personal data, and the categories of data subjects associated with Eagle Point’s processing of personal data in the provision of the Services, shall be as set forth in, and in accordance with, the Terms and Conditions and Exhibit 1 to this Addendum.
3.3 The duration of the processing is the term of the Terms and Conditions and until all Licensee personal data has been deleted or returned by Eagle Point in accordance with Section 10 of this Addendum and Exhibit 1 to this Addendum. For the avoidance of doubt, Eagle Point does not have the right to hold back personal data.
3.4 Should the terms of Article 35 of the GDPR become applicable to the Services, Eagle Point shall reasonably support Licensee in Licensee’s conduct of a data processing impact assessment in regard to Licensee Personal Data as processed by Eagle Point and, upon request of Licensee, in communicating with the responsible authorities based on the outcome of such data processing impact assessment.
In performing the Services, Eagle Point shall:
4.1 Implement appropriate technical and organizational measures to provide a level of security appropriate to the risk associated with the processing activity, including the measures referred to in Article 32(1) of the GDPR and provide reasonable assistance to Licensee for the fulfilment of Licensee’s obligation to respond to requests for exercising a data subject’s rights and Licensee’s obligations under Articles 32 to 36 of the GDPR, considering the nature of processing in connection with the Services and the information available to Eagle Point;
4.2 Implement appropriate security measures in accordance with good industry practice in the United States and the European Union and in accordance with the requirements of all applicable Data Protection Law; and
4.3 Regularly monitor compliance with such security safeguards to avoid material decrease in the level of security afforded to Licensee personal data during the duration of the processing.
Exhibit 1 to this Addendum further describes the technical and organization security measures that Eagle Point has implemented with respect to its personal data processing activities, as required by Article 28(3) of the GDPR.
5.1 Eagle Point shall treat all personal data processed on behalf of Licensee in accordance with the Terms and Conditions as confidential information. Licensee shall not use or disclose any nonpublic information provided to it by Eagle Point, including without limitation the identities of Subprocessors, without the express prior written approval of Eagle Point in each instance, unless required by an authority having jurisdiction over Licensee, in which event Licensee shall immediately notify Eagle Point and assist Eagle Point in obtaining confidential treatment of such information.
5.2 Eagle Point shall provide persons authorized by Eagle Point to process Licensee personal data with appropriate training on their responsibilities and require them to have executed written confidentiality agreements that endure through the duration of the processing and after termination or conclusion of processing.
5.3 Eagle Point shall limit access to Licensee personal data to Eagle Point’s personnel who require such access in order to perform the Services. Any such access to Licensee personal data shall be granted on a “need to know” basis.
5.4 The parties acknowledge that any breach of this Section 5 by either of them will result in irreparable harm to the other of them. This Section 5 shall survive the termination or expiration of this Agreement or the applicable Terms and Conditions.
6.1 Licensee expressly consents to the use by Eagle Point of the Subprocessors named in Exhibit 1 to this Addendum provided that each Subprocessor is bound by a written agreement requiring it to adhere to substantially the same data protection obligations, but at least according to Article 28 of the GDPR, as those applicable to Eagle Point under this Addendum and applicable Data Protection Law.
6.2 Eagle Point shall respect the conditions imposed by Article 28(2) and (4) of the GDPR regarding the engagement of Subprocessors.
6.3 Eagle Point shall remain fully liable for any Licensee personal data processing by Subprocessors.
6.4 Pursuant to Section 2 of Article 28 of the GDPR, Licensee grants to Eagle Point the general authorization to engage other Subprocessors, provided that Eagle Point shall inform Licensee of its intention to add or replace Subprocessors. Licensee has the right to object to the addition or replacement of Subprocessors within 30 days after being so informed, and shall notify Eagle Point in writing, stating the reasons for objection, in which case this Addendum and any agreement referring directly or indirectly to this Addendum shall also terminate without any claim for compensation. Licensee’s failure to respond within this 30-day period shall constitute specific authorization in favor of such addition or replacement.
7.1 Eagle Point shall, without undue delay, and in any event within ten (10) business days, notify Licensee if it receives a Data Subject Request. Eagle Point shall not respond to any Data Subject Request unless and until expressly instructed to do so by Licensee.
7.2 Eagle Point shall provide all reasonable assistance to Licensee to enable Licensee to comply with its obligation to respond to Data Subject Requests under applicable Data Protection Law. Eagle Point shall have the right to charge market average fees in case the assistance exceeds the usual requirements to a data processor. If authorized by Licensee, such assistance may include complying with a Data Subject Request in accordance with applicable Data Protection Law and Licensee’s instructions.
7.3 If Licensee requests information from Eagle Point to fulfill its obligation to respond to a Data Subject Request, Eagle Point shall provide the requested information without undue delay, and in any event within ten (10) business days of Licensee’s request for assistance. Eagle Point shall notify Licensee as soon as is reasonably practicable under the circumstances if Eagle Point is unable to comply with the request for assistance within this ten (10) business day period. Such notification shall provide a reasonably detailed explanation as to why Eagle Point considers compliance with such request for assistance to be impossible.
7.4 Eagle Point shall provide Licensee with any personal data that it processes on Licensee’s behalf in a structured, commonly used, electronic, and machine-readable format or in such format as otherwise requested by Licensee.
8.1 Eagle Point shall notify Licensee without undue delay after becoming aware of an Information Security Incident affecting Licensee personal data. Eagle Point shall take action to contain such Information Security Incident and mitigate potential risks to affected data subjects.
8.2 Eagle Point shall provide all reasonable assistance to Licensee to assist Licensee in complying with its obligations regarding any Information Security Incident under applicable Data Protection Law. Eagle Point shall not communicate with any third party (including any affected data subjects or regulatory authorities) regarding any Information Security Incident, except for its attorneys or financial advisors, or its representatives whose duties on behalf of Eagle Point include work related to data security incidents, unless and until expressly instructed to do so by Licensee or required by compulsory process.
Subject to Section 5 and any legal privileges available under applicable law to communications between Eagle Point and its legal counsel that are made in confidence for the purpose of seeking, obtaining or providing legal advice and any work product or other materials prepared in connection therewith, Eagle Point shall make available to Licensee any information of Eagle Point that Licensee may require for purposes of demonstrating compliance with Licensee’s obligations under applicable Data Protection Law and provide Licensee or Licensee’s representatives access to documents and premises in the frame of an inspection according to Art. 28 h) of the GDPR. If Licensee desires Eagle Point to exercise Eagle Point’s rights to obtain such information under Eagle Point’s agreements with Subprocessors, Licensee shall reimburse Eagle Point for all costs of such exercise.
10.1 Eagle Point shall, upon receipt of Licensee’s written request, securely delete or return Licensee personal data to Licensee and delete existing copies, unless EU law or EU Member State law requires storage of Licensee personal data, or unless otherwise prohibited by applicable law.
10.2 Eagle Point shall return all Licensee personal data in a commonly used, structured, electronic, and machine-readable format or in such format as otherwise requested by Licensee.
10.3 Immediately after deleting the Licensee personal data, Eagle Point shall provide to Licensee certified written confirmation of such secure deletion.
Eagle Point’s Data Protection Officer is its CEO; its Data Protection Representative is EDPO.
If Licensee faces an actual or potential claim arising out of or related to an alleged violation of any Data Protection Law, Eagle Point shall promptly provide all materials and information requested by Licensee that are relevant to the defense of such claim and the underlying circumstances concerning the claim, to the extent not subject to the legal privileges described in Section 9 above.
In accordance with the requirements of Article 30(2) of the GDPR, Eagle Point shall maintain a record of all processing activities carried out on Licensee’s behalf. Eagle Point shall make such record available to Licensee and the applicable supervisory authority upon request. As of the Effective Date, however, the Parties stipulate that the requirements of Article 30(2) do not apply to Eagle Point, and at such time as when they do, Eagle Point shall comply with those requirements.
Eagle Point shall inform Licensee without undue delay and to the extent not prohibited by applicable law from so doing, in case of a request, including subpoena or other legal instruments (“Legal Instruments”), of an authority or another third party outside the EU to transfer or disclose Licensee personal data either at Eagle Point or, if known to Eagle Point, a Subprocessor. For Licensee personal data Eagle Point shall only refrain from informing Licensee in case EU law, the laws of an EU member state, the laws of the United States or associated Legal Instruments prohibit Eagle Point from so informing Licensee.
Eagle Point at its own cost and expense shall take reasonable legal measures to object to any attempt of authorities or third parties to access Licensee personal data through Legal Instruments.
To the extent not prohibited by the laws of the United States from so doing, Eagle Point shall reasonably support Licensee or, with Licensee´s prior written permission, the data subject directly, to assert legal claims against an authority or another third party requesting access to personal data as well as a Subprocessor, which provided personal data to an authority or a third party outside the EU.
Eagle Point shall reimburse Licensee for amounts paid by Licensee as damages to a data subject, which has suffered damage due to a transfer by Eagle Point to third parties or authorities based on a Legal Instrument that is held to be without merit by decision of a court of competent jurisdiction from which no further appeal is taken to an aggregate maximum (for all such claims) equal to those amounts received by Eagle Point from Licensee within the preceding 12 months.
In case of conflicts or deviations between the Model Clauses this Addendum and other agreements, such as the Terms and Conditions, the Model Clauses shall prevail over the Addendum and other agreements. The Addendum shall prevail over the other agreements, including but not limited to terms and conditions, but not over the Model Clauses.
SECTION I
Clause 1
Purpose and scope
(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) for the transfer of personal data to a third country.
(b) The Parties: (i) the natural or legal person(s), public authority/ies, agency/ies or other body/ies (hereinafter ‘entity/ies’) transferring the personal data, as listed in Annex I.A (hereinafter each ‘data exporter’), and
(ii) the entity/ies in a third country receiving the personal data from the data exporter, directly or indirectly via another entity also Party to these Clauses, as listed in Annex I.A (hereinafter each ‘data importer’) have agreed to these standard contractual clauses (hereinafter: ‘Clauses’).
(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
Clause 2
Effect and invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679 and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679, provided they are not modified, except to select the appropriate Module(s) or to add or update information in the Appendix. This does not prevent the Parties from including the standard contractual clauses laid down in these Clauses in a wider contract and/or to add other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, these Clauses or prejudice the fundamental rights or freedoms of data subjects.
(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
Clause 3
Third-party beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer, with the following exceptions:
(i) Clause 1, Clause 2, Clause 3, Clause 6, Clause 7; (ii) Clause 8 – Module One: Clause 8.5 (e) and Clause 8.9(b); Module Two: Clause 8.1(b), 8.9(a), (c), (d) and (e); Module Three: Clause 8.1(a), (c) and (d) and Clause 8.9(a), (c), (d), (e), (f) and (g); Module Four: Clause 8.1 (b) and Clause 8.3(b); (iii) Clause 9 – Module Two: Clause 9(a), (c), (d) and (e); Module Three: Clause 9(a), (c), (d) and (e); (iv) Clause 12 – Module One: Clause 12(a) and (d); Modules Two and Three: Clause 12(a), (d) and (f); (v) Clause 13; (vi) Clause 15.1(c), (d) and (e); (vii) Clause 16(e); (vii) Clause 18 – Modules One, Two and Three: Clause 18(a) and (b); Module Four: Clause 18. (b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
Clause 4
Interpretation
(a) Where these Clauses use terms that are defined in Regulation (EU) 2016/679, those terms shall have the same meaning as in that Regulation.
(b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679.
(c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5
Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, existing at the time these Clauses are agreed or entered into thereafter, these Clauses shall prevail.
Clause 6
Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7
Docking clause
(a) An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.
(b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses and have the rights and obligations of a data exporter or data importer in accordance with its designation in Annex I.A.
(c) The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party.
SECTION II – OBLIGATIONS OF THE PARTIES
Clause 8
Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organisational measures, to satisfy its obligations under these Clauses.
MODULE TWO: Transfer controller to processor
8.1 Instructions
(a) The data importer shall process the personal data only on documented instructions from the data exporter. The data exporter may give such instructions throughout the duration of the contract.
(b) The data importer shall immediately inform the data exporter if it is unable to follow those instructions.
8.2 Purpose limitation
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I. B, unless on further instructions from the data exporter.
8.3 Transparency
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including the measures described in Annex II and personal data, the data exporter may redact part of the text of the Appendix to these Clauses prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand the its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information. This Clause is without prejudice to the obligations of the data exporter under Articles 13 and 14 of Regulation (EU) 2016/679.
8.4 Accuracy
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to erase or rectify the data.
8.5 Duration of processing and erasure or return of data
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
8.6 Security of processing
(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, the Parties shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subjects. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the personal data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify the data exporter without undue delay after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the breach including, where appropriate, measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.
8.7 Sensitive data
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.
8.8 Onward transfers
The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
(i) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer; (ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 Regulation of (EU)2016/679 with respect to the processing in question; (iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or (iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.
8.9 Documentation and compliance
(a) The data importer shall promptly and adequately deal with enquiries from the data exporter that relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the data exporter.
(c) The data importer shall make available to the data exporter all information necessary to demonstrate compliance with the obligations set out in these Clauses and at the data exporter’s request, allow for and contribute to audits of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non- compliance. In deciding on a review or audit, the data exporter may take into account relevant certifications held by the data importer.
(d) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.
(e) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.
MODULE THREE: Transfer processor to processor
(a) The data exporter has informed the data importer that it acts as processor under the instructions of its controller(s), which the data exporter shall make available to the data importer prior to processing.
(b) The data importer shall process the personal data only on documented instructions from the controller, as communicated to the data importer by the data exporter, and any additional documented instructions from the data exporter. Such additional instructions shall not conflict with the instructions from the controller. The controller or data exporter may give further documented instructions regarding the data processing throughout the duration of the contract.
(c) The data importer shall immediately inform the data exporter if it is unable to follow those instructions. Where the data importer is unable to follow the instructions from the controller, the data exporter shall immediately notify the controller.
(d) The data exporter warrants that it has imposed the same data protection obligations on the data importer as set out in the contract or other legal act under Union or Member State law between the controller and the data exporter.
The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I. B., unless on further instructions from the controller, as communicated to the data importer by the data exporter, or from the data exporter.
On request, the data exporter shall make a copy of these Clauses, including the Appendix as completed by the Parties, available to the data subject free of charge. To the extent necessary to protect business secrets or other confidential information, including personal data, the data exporter may redact part of the text of the Appendix prior to sharing a copy, but shall provide a meaningful summary where the data subject would otherwise not be able to understand its content or exercise his/her rights. On request, the Parties shall provide the data subject with the reasons for the redactions, to the extent possible without revealing the redacted information.
If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay. In this case, the data importer shall cooperate with the data exporter to rectify or erase the data.
Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the controller and certify to the data exporter that it has done so, or return to the data exporter all personal data processed on its behalf and delete existing copies. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit return or deletion of the personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process it to the extent and for as long as required under that local law. This is without prejudice to Clause 14, in particular the requirement for the data importer under Clause 14(e) to notify the data exporter throughout the duration of the contract if it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under Clause 14(a).
(a) The data importer and, during transmission, also the data exporter shall implement appropriate technical and organisational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to that data (hereinafter ‘personal data breach’). In assessing the appropriate level of security, they shall take due account of the state of the art, the costs of implementation, the nature, scope, context and purpose(s) of processing and the risks involved in the processing for the data subject. The Parties shall in particular consider having recourse to encryption or pseudonymisation, including during transmission, where the purpose of processing can be fulfilled in that manner. In case of pseudonymisation, the additional information for attributing the personal data to a specific data subject shall, where possible, remain under the exclusive control of the data exporter or the controller. In complying with its obligations under this paragraph, the data importer shall at least implement the technical and organisational measures specified in Annex II. The data importer shall carry out regular checks to ensure that these measures continue to provide an appropriate level of security.
(b) The data importer shall grant access to the data to members of its personnel only to the extent strictly necessary for the implementation, management and monitoring of the contract. It shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
(c) In the event of a personal data breach concerning personal data processed by the data importer under these Clauses, the data importer shall take appropriate measures to address the breach, including measures to mitigate its adverse effects. The data importer shall also notify, without undue delay, the data exporter and, where appropriate and feasible, the controller after having become aware of the breach. Such notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, categories and approximate number of data subjects and personal data records concerned), its likely consequences and the measures taken or proposed to address the data breach, including measures to mitigate its possible adverse effects. Where, and in so far as, it is not possible to provide all information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
(d) The data importer shall cooperate with and assist the data exporter to enable the data exporter to comply with its obligations under Regulation (EU) 2016/679, in particular to notify its controller so that the latter may in turn notify the competent supervisory authority and the affected data subjects, taking into account the nature of processing and the information available to the data importer.
Where the transfer involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences (hereinafter ‘sensitive data’), the data importer shall apply the specific restrictions and/or additional safeguards set out in Annex I.B.
The data importer shall only disclose the personal data to a third party on documented instructions from the controller, as communicated to the data importer by the data exporter. In addition, the data may only be disclosed to a third party located outside the European Union (6) (in the same country as the data importer or in another third country, hereinafter ‘onward transfer’) if the third party is or agrees to be bound by these Clauses, under the appropriate Module, or if:
(i) the onward transfer is to a country benefitting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer; (ii) the third party otherwise ensures appropriate safeguards pursuant to Articles 46 or 47 of Regulation (EU) 2016/679; (iii) the onward transfer is necessary for the establishment, exercise or defence of legal claims in the context of specific administrative, regulatory or judicial proceedings; or (iv) the onward transfer is necessary in order to protect the vital interests of the data subject or of another natural person.
Any onward transfer is subject to compliance by the data importer with all the other safeguards under these Clauses, in particular purpose limitation.
(a) The data importer shall promptly and adequately deal with enquiries from the data exporter or the controller that relate to the processing under these Clauses.
(b) The Parties shall be able to demonstrate compliance with these Clauses. In particular, the data importer shall keep appropriate documentation on the processing activities carried out on behalf of the controller.
(c) The data importer shall make all information necessary to demonstrate compliance with the obligations set out in these Clauses available to the data exporter, which shall provide it to the controller.
(d) The data importer shall allow for and contribute to audits by the data exporter of the processing activities covered by these Clauses, at reasonable intervals or if there are indications of non-compliance. The same shall apply where the data exporter requests an audit on instructions of the controller. In deciding on an audit, the data exporter may take into account relevant certifications held by the data importer.
(e) Where the audit is carried out on the instructions of the controller, the data exporter shall make the results available to the controller.
(f) The data exporter may choose to conduct the audit by itself or mandate an independent auditor. Audits may include inspections at the premises or physical facilities of the data importer and shall, where appropriate, be carried out with reasonable notice.
(g) The Parties shall make the information referred to in paragraphs (b) and (c), including the results of any audits, available to the competent supervisory authority on request.
Clause 9
Use of sub-processors
(a) GENERAL WRITTEN AUTHORISATION The data importer has the data exporter’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least thirty (30) days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the data exporter with the information necessary to enable the data exporter to exercise its right to object.
(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the data exporter), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
(c) The data importer shall provide, at the data exporter’s request, a copy of such a sub-processor agreement and any subsequent amendments to the data exporter. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.
(d) The data importer shall remain fully responsible to the data exporter for the performance of the sub-processor’s obligations under its contract with the data importer. The data importer shall notify the data exporter of any failure by the sub-processor to fulfil its obligations under that contract.
(e) The data importer shall agree a third-party beneficiary clause with the sub-processor whereby – in the event the data importer has factually disappeared, ceased to exist in law or has become insolvent – the data exporter shall have the right to terminate the sub-processor contract and to instruct the sub-processor to erase or return the personal data.
(a) GENERAL WRITTEN AUTHORISATION The data importer has the controller’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least thirty (30) daysin advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s). The data importer shall provide the controller with the information necessary to enable the controller to exercise its right to object. The data importer shall inform the data exporter of the engagement of the sub-processor(s).
(b) Where the data importer engages a sub-processor to carry out specific processing activities (on behalf of the controller), it shall do so by way of a written contract that provides for, in substance, the same data protection obligations as those binding the data importer under these Clauses, including in terms of third-party beneficiary rights for data subjects. The Parties agree that, by complying with this Clause, the data importer fulfils its obligations under Clause 8.8. The data importer shall ensure that the sub-processor complies with the obligations to which the data importer is subject pursuant to these Clauses.
(c) The data importer shall provide, at the data exporter’s or controller’s request, a copy of such a sub-processor agreement and any subsequent amendments. To the extent necessary to protect business secrets or other confidential information, including personal data, the data importer may redact the text of the agreement prior to sharing a copy.
Clause 10
Data subject rights
(a) The data importer shall promptly notify the data exporter of any request it has received from a data subject. It shall not respond to that request itself unless it has been authorised to do so by the data exporter.
(b) The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679. In this regard, the Parties shall set out in Annex II the appropriate technical and organisational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the data exporter.
(a) The data importer shall promptly notify the data exporter and, where appropriate, the controller of any request it has received from a data subject, without responding to that request unless it has been authorised to do so by the controller.
(b) The data importer shall assist, where appropriate in cooperation with the data exporter, the controller in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable. In this regard, the Parties shall set out in Annex II the appropriate technical and organizational measures, taking into account the nature of the processing, by which the assistance shall be provided, as well as the scope and the extent of the assistance required.
(c) In fulfilling its obligations under paragraphs (a) and (b), the data importer shall comply with the instructions from the controller, as communicated by the data exporter.
Redress
(a) The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
(b) In case of a dispute between a data subject and one of the Parties as regards compliance with these Clauses, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
(c) Where the data subject invokes a third-party beneficiary right pursuant to Clause 3, the data importer shall accept the decision of the data subject to:
(i) lodge a complaint with the supervisory authority in the Member State of his/her habitual residence or place of work, or the competent supervisory authority pursuant to Clause 13; (ii) refer the dispute to the competent courts within the meaning of Clause 18.
(d) The Parties accept that the data subject may be represented by a not-for-profit body, organisation or association under the conditions set out in Article 80(1) of Regulation (EU) 2016/679.
(e) The data importer shall abide by a decision that is binding under the applicable EU or Member State law.
(f) The data importer agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.
Liability
(a) Each Party shall be liable to the other Party/ies for any damages it causes the other Party/ies by any breach of these Clauses.
(b) The data importer shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data importer or its sub-processor causes the data subject by breaching the third-party beneficiary rights under these Clauses.
(c) Notwithstanding paragraph (b), the data exporter shall be liable to the data subject, and the data subject shall be entitled to receive compensation, for any material or non-material damages the data exporter or the data importer (or its sub- processor) causes the data subject by breaching the third-party beneficiary rights under these Clauses. This is without prejudice to the liability of the data exporter and, where the data exporter is a processor acting on behalf of a controller, to the liability of the controller under Regulation (EU) 2016/679 or Regulation (EU) 2018/1725, as applicable.
(d) The Parties agree that if the data exporter is held liable under paragraph (c) for damages caused by the data importer (or its sub-processor), it shall be entitled to claim back from the data importer that part of the compensation corresponding to the data importer’s responsibility for the damage.
(e) Where more than one Party is responsible for any damage caused to the data subject as a result of a breach of these Clauses, all responsible Parties shall be jointly and severally liable and the data subject is entitled to bring an action in court against any of these Parties.
(f) The Parties agree that if one Party is held liable under paragraph (e), it shall be entitled to claim back from the other Party/ies that part of the compensation corresponding to its/their responsibility for the damage.
(g) The data importer may not invoke the conduct of a sub-processor to avoid its own liability.
Clause 13
Supervision
(a) The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 as regards the data transfer, as indicated in Annex I.C, shall act as competent supervisory authority.
(b) The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.
SECTION III – LOCAL LAWS AND OBLIGATIONS IN CASE OF ACCESS BY PUBLIC AUTHORITIES
Clause 14
Local laws and practices affecting compliance with the Clauses
(a) The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses. This is based on the understanding that laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679, are not in contradiction with these Clauses.
(b) The Parties declare that in providing the warranty in paragraph (a), they have taken due account in particular of the following elements:
(i) the specific circumstances of the transfer, including the length of the processing chain, the number of actors involved and the transmission channels used; intended onward transfers; the type of recipient; the purpose of processing; the categories and format of the transferred personal data; the economic sector in which the transfer occurs; the storage location of the data transferred; (ii) the laws and practices of the third country of destination– including those requiring the disclosure of data to public authorities or authorising access by such authorities – relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards; (iii) any relevant contractual, technical or organisational safeguards put in place to supplement the safeguards under these Clauses, including measures applied during transmission and to the processing of the personal data in the country of destination.
(c) The data importer warrants that, in carrying out the assessment under paragraph (b), it has made its best efforts to provide the data exporter with relevant information and agrees that it will continue to cooperate with the data exporter in ensuring compliance with these Clauses.
(d) The Parties agree to document the assessment under paragraph (b) and make it available to the competent supervisory authority on request.
(e) The data importer agrees to notify the data exporter promptly if, after having agreed to these Clauses and for the duration of the contract, it has reason to believe that it is or has become subject to laws or practices not in line with the requirements under paragraph (a), including following a change in the laws of the third country or a measure (such as a disclosure request) indicating an application of such laws in practice that is not in line with the requirements in paragraph (a). [For Module Three: The data exporter shall forward the notification to the controller.]
(f) Following a notification pursuant to paragraph (e), or if the data exporter otherwise has reason to believe that the data importer can no longer fulfil its obligations under these Clauses, the data exporter shall promptly identify appropriate measures (e.g. technical or organisational measures to ensure security and confidentiality) to be adopted by the data exporter and/or data importer to address the situation . The data exporter shall suspend the data transfer if it considers that no appropriate safeguards for such transfer can be ensured, or if instructed by the competent supervisory authority to do so. In this case, the data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses. If the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise. Where the contract is terminated pursuant to this Clause, Clause 16(d) and (e) shall apply.
Clause 15
Obligations of the data importer in case of access by public authorities
15.1 Notification
(a) The data importer agrees to notify the data exporter and, where possible, the data subject promptly (if necessary with the help of the data exporter) if it:
(i) receives a legally binding request from a public authority, including judicial authorities, under the laws of the country of destination for the disclosure of personal data transferred pursuant to these Clauses; such notification shall include information about the personal data requested, the requesting authority, the legal basis for the request and the response provided; or (ii) becomes aware of any direct access by public authorities to personal data transferred pursuant to these Clauses in accordance with the laws of the country of destination; such notification shall include all information available to the importer.
For Module Three: The data exporter shall forward the notification to the controller.
(b) If the data importer is prohibited from notifying the data exporter and/or the data subject under the laws of the country of destination, the data importer agrees to use its best efforts to obtain a waiver of the prohibition, with a view to communicating as much information as possible, as soon as possible. The data importer agrees to document its best efforts in order to be able to demonstrate them on request of the data exporter.
(c) Where permissible under the laws of the country of destination, the data importer agrees to provide the data exporter, at regular intervals for the duration of the contract, with as much relevant information as possible on the requests received (in particular, number of requests, type of data requested, requesting authority/ies, whether requests have been challenged and the outcome of such challenges, etc.). [For Module Three: The data exporter shall forward the information to the controller.]
(d) The data importer agrees to preserve the information pursuant to paragraphs (a) to (c) for the duration of the contract and make it available to the competent supervisory authority on request.
(e) Paragraphs (a) to (c) are without prejudice to the obligation of the data importer pursuant to Clause 14(e) and Clause 16 to inform the data exporter promptly where it is unable to comply with these Clauses.
15.2 Review of legality and data minimisation
(a) The data importer agrees to review the legality of the request for disclosure, in particular whether it remains within the powers granted to the requesting public authority, and to challenge the request if, after careful assessment, it concludes that there are reasonable grounds to consider that the request is unlawful under the laws of the country of destination, applicable obligations under international law and principles of international comity. The data importer shall, under the same conditions, pursue possibilities of appeal. When challenging a request, the data importer shall seek interim measures with a view to suspending the effects of the request until the competent judicial authority has decided on its merits. It shall not disclose the personal data requested until required to do so under the applicable procedural rules. These requirements are without prejudice to the obligations of the data importer under Clause 14(e).
(b) The data importer agrees to document its legal assessment and any challenge to the request for disclosure and, to the extent permissible under the laws of the country of destination, make the documentation available to the data exporter. It shall also make it available to the competent supervisory authority on request. [For Module Three: The data exporter shall make the assessment available to the controller.]
(c) The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure, based on a reasonable interpretation of the request.
SECTION IV – FINAL PROVISIONS
Clause 16
Non-compliance with the Clauses and termination
(a) The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses, for whatever reason.
(b) In the event that the data importer is in breach of these Clauses or unable to comply with these Clauses, the data exporter shall suspend the transfer of personal data to the data importer until compliance is again ensured or the contract is terminated. This is without prejudice to Clause 14(f).
(c) The data exporter shall be entitled to terminate the contract, insofar as it concerns the processing of personal data under these Clauses, where:
(i) the data exporter has suspended the transfer of personal data to the data importer pursuant to paragraph (b) and compliance with these Clauses is not restored within a reasonable time and in any event within one month of suspension; (ii) the data importer is in substantial or persistent breach of these Clauses; or (iii) the data importer fails to comply with a binding decision of a competent court or supervisory authority regarding its obligations under these Clauses.
In these cases, it shall inform the competent supervisory authority of such non- compliance. Where the contract involves more than two Parties, the data exporter may exercise this right to termination only with respect to the relevant Party, unless the Parties have agreed otherwise.
(d) For Modules Two and Three: Personal data that has been transferred prior to the termination of the contract pursuant to paragraph (c) shall at the choice of the data exporter immediately be returned to the data exporter or deleted in its entirety. The same shall apply to any copies of the data The data importer shall certify the deletion of the data to the data exporter. Until the data is deleted or returned, the data importer shall continue to ensure compliance with these Clauses. In case of local laws applicable to the data importer that prohibit the return or deletion of the transferred personal data, the data importer warrants that it will continue to ensure compliance with these Clauses and will only process the data to the extent and for as long as required under that local law.
(e) Either Party may revoke its agreement to be bound by these Clauses where (i) the European Commission adopts a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 that covers the transfer of personal data to which these Clauses apply; or (ii) Regulation (EU) 2016/679 becomes part of the legal framework of the country to which the personal data is transferred. This is without prejudice to other obligations applying to the processing in question under Regulation (EU) 2016/679.
Clause 17
Governing law
These Clauses shall be governed by the law of the EU Member State in which the data exporter is established. Where such law does not allow for third-party beneficiary rights, they shall be governed by the law of another EU Member State that does allow for third-party beneficiary rights. The Parties agree that this shall be the law of the Member State in which Licensee is domiciled.
Clause 18
Choice of forum and jurisdiction
(a) Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State.
(b) The Parties agree that those shall be the courts of the Member State in which Licensee is domiciled.
(c) A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of the Member State in which he/she has his/her habitual residence.
(d) The Parties agree to submit themselves to the jurisdiction of such courts.
APPENDIX
ANNEX I
A. LIST OF PARTIES
Data exporter: [Name and address of Licensee]
Data importer: Eagle Point Software Corporation, 600 Star Brewery Drive, Suite 200 Dubuque, IA 52001 (“Eagle Point”)
B. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred: Employees, contractors, agents, and consultants of the Data Exporter authorized by the Data Exporter to access and use the Data Importer’s services (“Permitted Users”).
Categories of personal data transferred:
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures. No sensitive personal data are transferred unless requested by the Data Exporter.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): The frequency of the transfer is on continuous basis while using the services of the Data Importer.
Nature of the processing: The Data Importer provides a learning platform in accordance with the Terms and Conditions referenced in the Data Processing Addendum to which these Standard Contractual Clauses are attached (“Contract”) and processes personal data to provide Permitted Users access to such platform.
Purpose(s) of the data transfer and further processing: The platform is located at the data centers of the Importer and therefore the Importer has to import the personal data to its data centers in order to grant the Permitted Users access to the platform as provided by the Contract.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: For the term of the Contract.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: Transfers to subprocessors by the Data Importer are required for billing, invoicing and other financial matters, for cloud storage and retrieval services, to measure usage and user satisfaction, and to manage Data Exporter’s subscription information.
C. COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with Clause 13: [Insert authority of Member State in which Licensee is domiciled]
ANNEX II
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
This Annex II describes the technical and organizational security measures that Eagle Point has implemented in accordance with Section 4 of this Addendum and applicable Data Protection Law.
Eagle Point undertakes the pseudonymisation, encryption, and security of personal data as follows:
Eagle Point may collect relevant personal information from employees or customers or data subjects for equal opportunities monitoring purposes as required by the licensing customer. Where such information is collected, the organization will anonymize it unless the purpose to which the information is put requires the full use of the individual’s personal information.
Eagle Point will ensure that personal information about a data subject, including information in personnel files, is securely retained. The organization will keep hard copies of information in a locked filing cabinet. Information stored electronically will be subject to access controls, and passwords and encryption software will be used where necessary in accordance with industry standards.
Eagle Point ensures the ongoing confidentiality, integrity, availability and resilience of its processing systems and services, and has a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing, as follows:
Information Security Objective
The objective of Eagle Point information security is to ensure that its core and supporting business operations continue to operate by preventing and minimizing the impact of security incidents. Eagle Point endeavors to ensure that all information that is disbursed or produced by Eagle Point has integrity and that all relevant information is managed and stored with appropriate confidentiality procedures. In deploying the Eagle Point information security systems, the Information Security Team aims to maintain known risks at their current low level and ensure that new and changing risks are managed in an equally consistent and professional manner.
Roles and Responsibilities
Policy Statements
Maintenance of the policy
The compliance to this policy and supporting policies shall be audited on a yearly basis.
This security policy shall be reviewed annually unless there is a major change in the organization or the environment affecting the organization, in which case it shall be done on a need basis.
This security policy shall be reviewed and revised whenever a major security risk or an incident is identified.
Enforcement of policy
All employees of Eagle Point, contractors, vendors and partners who require access to information and associated assets are responsible for ensuring that this policy is adhered to. The Information Security Team is responsible for ensuring that the users are aware of, and adhere to, this policy.
Violation of information security policy shall result in corrective action. Disciplinary action shall be taken in accordance with the severity of the violation, as determined by an investigation, and may include, but not limited to:
Violation or deviation of the policy shall be reported to the Information Security Team and a security incident record shall be created for the further investigation of the incident.
Policy Exception
Any exception to the information security policy or supporting policies shall be assessed and approved by the Information Security Team. All the exceptions requests and approvals shall be formally documented.
Eagle Point will implement the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident as follows:
Once it’s established that a breach has happened, Eagle Point should not only try to contain the incident but should also perform a risk analysis. This will help Eagle Point in taking appropriate measures to contain and address the breach and to determine whether notification is required to the Supervisory Authority and to Data Subjects.
The following factors can be taken into consideration while performing a Risk Assessment.
When assessing the risk that is likely to result from a breach, Eagle Point should consider the severity of the impact on the rights and freedoms of individuals and the likelihood of the breach occurring. When the consequences of a breach or the likelihood of these occurrences are severe or higher, the risk is higher.
Should the breach cause a disruption in Eagle Point’s services or operations, Eagle Point has adopted a policy to facilitate business continuity through the development of contingency plans as follows:
Information Security Team shall identify and document the following:
Contingency plans shall be reviewed on an annual basis to determine the effectiveness of the plan and Eagle Point’s readiness to execute the plan.
The following areas should be addressed in a contingency plan review, as applicable:
Information Security Team along with representatives from all departments shall coordinate the review activity. Results of the review shall be documented for analysis and continual improvement of the business continuity plan.
Training related to contingency procedures shall be given to Eagle Point staff and contractors at least once a year. Training shall be customized according to the roles and responsibilities of the personnel.
ANNEX III
LIST OF SUB-PROCESSORS
EXPLANATORY NOTE: This Annex must be completed for Modules Two and Three, in case of the specific authorisation of sub-processors (Clause 9(a), Option 1).
The controller has authorised the use of the following sub-processors:
2. Name: Salesforce, Inc. Address: 415 Mission St., 3rd Floor, San Fransisco, CA 94105 USA Contact Person’s name, position and contact details: privacy@salesforce.com Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorized): Salesforce is used to store contact information and interaction notes for the sales and customer success teams.
3. Name: Gainsight, Inc. Address: 350 Bay St Suite 100, San Francisco, CA 94133 Contact person’s name, position and contact details: privacy@gainsight.com Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Gainsight provides services in support of customer onboarding and implementation initiatives managed by Eagle Point’s customer success team.
4. Name: Intuit Quickbooks. Address: 2632 Marine Way, Mountain View, CA 94043 USA Contact person’s name, position and contact details: https://www.intuit.com/privacy/submit-a-question/ or https://security.intuit.com/contact_us Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Eagle Point uses Quickbooks Online for accounting services.
5. Name: Rackspace Address: One Fanatical Place, San Antonio, TX 78218 USA Contact person’s name, position and contact details: Chief Privacy Officer, privacy@rackspace.com Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Rackspace hosts the Cloud Service for the KnowledgeSmart Service.
6. Name: Maxio, LLC Address: 6675 The Corners Parkway, Ste 400, Peachtree Corners, GA 30092 USA Contact person’s name, position and contact details: maxio@privacy.maxio.com Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Eagle Point uses Maxio for accounting services in conjunction with Intuit Quickbooks.
7. Name: GoTo Technologies USA, Inc. Address: 333 Summer Street, 5th Floor Boston, MA 02210 USA Contact person’s name, position and contact details: privacy@goto.com Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Eagle Point uses GoTo products to conduct live web meetings with groups of people.
8. Name: ZenDesk, Inc. Address: 989 Market Street, San Francisco, CA 94103 USA Contact person’s name, position and contact details: Attn: Privacy Team and DPO (Same address) – privacy@zendesk.com, euprivacy@zendesk.com Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Eagle Point uses ZenDesk for customer support ticket creation and tracking.
9. Name: Calendly, LLC. Address: 88 N Avondale Rd Ste 603 Avondale Estates, GA 30002-1323 Contact person’s name, position and contact details: support@calendly.com Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Used for scheduling meetings.
10. Name: Nice Reply, s.r.o. Address: Štefanovičova 2971/8, 811 04 Bratislava, the Slovak Republic, ID No. 46 682 007 Contact person’s name, position and contact details: contact@nicereply.com Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Used to survey support customers for purposes of evaluation, training and customer relations management.
11. Name: FiveTran Address: 1221 Broadway, Suite 2400, Oakland, CA 94612 USA Contact person’s name, position and contact details: privacy@fivetran.com Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Used to control database replication activities used for Pinnacle Series system enhancements.
12. Name: Fathom Video Inc. Address: 2261 Market Street #4156, San Fransico, CA 94114 USA Contact person’s name, position, and contact details: privacy@fathom.video If located in the UK or Europe, you may write DataRep, the Cusbe, Monahan Road, Cork, T12 H1XY, Republic of Ireland or Datarep, BPM 335368, 372 Old Street, EC1V 9AU, London, United Kingdom Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Used to record and take notes during meetings. Attendees will be notified upon entering the meeting that the platform is in use.
13. Name: Alphabet Inc. (Google – BigQuery) Address: 1600 Amphitheatre Pkwy, Mountain View, CA 94043 USA Contact person’s name, position, and contact details: Privacy Help Center Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Used to migrate data from Eagle Point solutions into Salesforce and Gainsight for the purpose of data consistency and health scores.
14. Name: Docusign Address: 221 Main Street, Suite 1550, San Francisco, CA 94105 USA Contact person’s name, position, and contact details: privacy@docusign.com Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Used for electronic document (primarily legal) signing.
