Data Processing Agreement
This Data Processing Agreement (“DPA”) is incorporated into and forms part of the Agreement (as defined in the Agreement) between Cloud Card, LLC (“CloudCard”) and the Customer identified in the Agreement (“Customer”), each a “Party” and collectively the “Parties”. This DPA applies to and takes precedence over the relevant Order Form (as defined in the Agreement) and the Agreement (collectively, for purposes of this DPA, the “Agreement”), to the extent of any conflict. Capitalized terms not defined herein are defined as in applicable Data Protection Laws.
Customer and CloudCard agree as follows:
1. Definitions. For purposes of this DPA:
a. “Data Protection Laws” means all applicable laws, regulations, and other legal requirements in any jurisdiction relating to privacy, data protection, data security, breach notification, or the Processing of personal data, including without limitation, to the extent applicable, the General Data Protection Regulation, Regulation (EU) 2016/679 (“GDPR”); the United Kingdom Data Protection Act of 2018; the Swiss Federal Act on Data Protection (“FADP”); and the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., as amended and including its regulations (“CCPA”) and other applicable U.S. state and federal privacy and data protection laws. For the avoidance of doubt, if the Parties’ Processing activities involving Personal Data are not within the scope of a given Data Protection Law, such law is not applicable for purposes of this DPA.
b. “Data Subject” means an identified or identifiable natural person to whom Personal Data relates, and is deemed to also refer to “consumer” as defined in Data Protection Laws.
c. “EU SCCs” means the Standard Contractual Clauses issued pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, available at http://data.europa.eu/eli/dec_impl/2021/914/oj and completed as set forth herein.
d. “Personal Data” includes “personal data,” “personal information,” “personally identifiable information,” and analogous terms, as defined by applicable Data Protection Laws, that CloudCard Processes to provide the Services.
e. “Process” and its cognates “Processing,” “Processed,” etc. mean any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, creating, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
f. “Security Breach” means any accidental or unlawful acquisition, destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
g. “Services” means the services that CloudCard performs on behalf of Customer pursuant to the Agreement.
h. “Subprocessor” means any third party or CloudCard Affiliate that CloudCard engages to Process Personal Data to provide the Services.
i. “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner’s Office, located at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-tranfer-addendum.pdf and completed as set forth herein.
j. The terms “Business,” “Controller,” “Processor,” and “Service Provider” are defined as in Data Protection Laws. “Controller” is deemed to also refer to “Business,” and “Processor” is deemed to also refer to “Service Provider.”
2. Roles of the Parties; Scope and Purposes of Processing.
a. This DPA applies to all Personal Data that CloudCard Processes to provide the Services.
b. To the extent that Customer is the Controller of Personal Data, CloudCard is its Processor. To the extent that Customer is a Processor of Personal Data, CloudCard is its Subprocessor.
c. CloudCard will Process Personal Data solely in accordance with Data Protection Laws, on Customer’s behalf, and to provide the Services to Customer under the Agreement for the business purposes set forth in the Agreement and as set forth in this DPA, unless required otherwise to comply with Data Protection Laws (in which case, CloudCard shall, to the extent legally permitted, provide prior notice to Customer of such legal requirement).
d. To the extent that the CCPA applies to CloudCard’s Processing of Personal Data, Customer retains the right to take reasonable and appropriate steps to (i) ensure that CloudCard Processes Personal Data in a manner consistent with the CCPA, and (ii) upon notice, stop and remediate unauthorized Processing of Personal Data subject to the CCPA.
e. Customer is responsible for providing any notices, obtaining any consents or authorizations, and otherwise satisfying its own compliance obligations with respect to the Processing of Personal Data under this DPA. Customer will not instruct CloudCard to Process Personal Data in a violation of Data Protection Laws or any third party’s legal, contractual, or other rights.
3. Personal Data Processing Requirements. CloudCard will:
a. Not retain, use, or disclose Personal Data outside of the direct business relationship between Customer and CloudCard, or for any purpose (including any commercial purpose) not set forth in this DPA.
b. Not “sell” or “share” any Personal Data, or use Personal Data for purposes of “targeted advertising,” as such terms are defined in Data Protection Laws.
c. Comply with any applicable restrictions under the CCPA on combining Personal Data with personal data that CloudCard receives from, or on behalf of, another person or persons, or that CloudCard collects from any interaction between it and any individual.
d. Ensure that the persons it authorizes to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
e. To the extent required by Data Protection Laws, assist Customer by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of Customer’s obligation to respond to requests for exercising Data Subjects’ rights as set forth in Data Protection Laws, taking into account the nature of the Processing.
f. To the extent required by Data Protection Laws, provide reasonable assistance to Customer for the fulfillment of Customer’s obligation to complete a data protection impact assessment or consult with supervisory authorities regarding CloudCard’s Processing of Personal Data.
g. Promptly notify Customer if CloudCard determines that it is unable to comply with its obligations under Data Protection Laws or if, in CloudCard’s opinion, an instruction from Customer infringes Data Protection Laws (to the extent CloudCard is legally permitted to notify Customer).
4. Data Security.
CloudCard will implement appropriate administrative, technical, physical, and organizational measures to protect Personal Data, as set forth at Information Security Policy. CloudCard will provide the level of protection for Personal Data that is required under Data Protection Laws applicable to Customer.
5. Security Breach.
CloudCard will notify Customer of any Security Breach without undue delay, and in no event later than seventy-two (72) hours, after becoming aware of such Security Breach. CloudCard will comply with the Security Breach-related obligations directly applicable to it under Data Protection Laws and will assist Customer in Customer’s compliance with its Security Breach-related obligations, including by providing Customer with any information that CloudCard is required to provide under Data Protection Laws, to the extent known to CloudCard. Customer acknowledge that CloudCard may not know all of this information as of the date that CloudCard notifies Customer of a Security Breach, and that CloudCard may provide such information as it becomes available to CloudCard.
6. Subprocessors.
a. Customer acknowledges and agrees that CloudCard may use Subprocessors to Process Personal Data in accordance with this DPA and Data Protection Laws. Customer specifically authorizes CloudCard to engage any Subprocessors listed at https://trust.cloudcard.us/subprocessors.
b. CloudCard will maintain an up-to-date list of its Subprocessors. CloudCard will provide Customer with thirty (30) days’ notice of any new Subprocessor added to the list prior to providing the new Subprocessor with Personal Data or access thereto. If within that 30-day period, Customer makes a reasonable objection to a new Subprocessor on grounds relating to the protection of Personal Data, CloudCard shall have the right to cure the objection through one of the following options (to be selected at CloudCard’s sole discretion): (i) CloudCard will cancel its plans to use the Subprocessor with regard to Personal Data or will offer an alternative to provide the Services without such Subprocessor; (ii) CloudCard will take the corrective steps requested by Customer in its objection (which remove Customer’s objection) and proceed to use the Subprocessor with regard to Personal Data; or (iii) CloudCard may cease to provide or Customer may agree not to use (temporarily or permanently) the particular aspect of the Services that would involve the use of such Subprocessor with regard to Personal Data, subject to a mutual agreement of the Parties to adjust the remuneration for the Services considering the reduced scope of the Services. If the objection has not been resolved within 30 days, Customer will have the right to terminate the relevant Processing and Customer will be entitled to a pro-rata refund for prepaid fees for Services not performed as of the date of termination.
7. Data Transfers.
a. CloudCard may engage in cross-border transfers of Personal Data in compliance with Data Protection Laws. To the extent required by Data Protection Laws, CloudCard shall ensure that a lawful data transfer mechanism is in place prior to engaging in any onward transfers of Personal Data from one country to another.
b. To the extent legally required, by entering into the Agreement, Customer and CloudCard are deemed to have signed the EU SCCs, which form part of this DPA and (except as described in Sections 7(c) and (d) below) are deemed completed as follows:
i. Module 2 applies to transfers of Personal Data from Customer (as a Controller) to CloudCard (as a Processor), and Module 3 applies to transfers of Personal Data from Customer (as a Processor) to CloudCard (as a Subprocessor);
ii. Clause 7 is not included;
iii. Under Clause 9, the Parties select Option 2 (General written authorization). The initial list of Subprocessors and the process for updating that list are set forth in Section 6(b) of this DPA;
iv. Under Clause 11, the optional language requiring that data subjects be permitted to lodge a complaint with an independent dispute resolution body is not included;
v. Under Clause 17, the Parties choose Option 1 (the law of an EU Member State that allows for third-Party beneficiary rights) and select the law of Ireland;
vi. Under Clause 18, the Parties select the courts of Ireland;
vii. Annex IA (List of Parties) is deemed completed as follows:
1. Data Exporter is the Customer, and it is a Controller or Processor, as the case may be. Data Importer is CloudCard, and it is a Processor.
2. The Parties’ names, addresses, and contact person’s information is deemed to be set forth with the relevant information in the Order Form.
3. Customer’s activities relevant to the data being transferred are receiving CloudCard’s Services, and CloudCard’s activities relevant to the data being transferred are providing such Services.
4. Both Parties are deemed to have signed Annex IA by entering into the Agreement.
viii. Annex IB (Description of the transfer) is deemed completed as follows:
1. Categories of Data Subjects whose Personal Data is transferred: Individuals for whom Customer instructs CloudCard to process ID photos. Depending on the nature of Customer’s organization, this may include, but is not limited to, Customer’s employees, contractors, or students.
2. Categories of Personal Data transferred: Name, title, photograph, email address, ID number assigned by Customer (e.g., employee ID or student ID). The only data required for CloudCard to provide service is an ID number and email address.
3. Sensitive data transferred (if applicable) and applied restrictions or safeguards: N/A.
4. The frequency of the transfer: Continuous for the duration of the Agreement.
5. Nature of the processing: CloudCard’s Processing activities shall be limited to those discussed in the Agreement and the DPA.
6. Purpose(s) of the data transfer and further processing: The purpose of the transfer to and further Processing of Personal Data by CloudCard is for CloudCard to provide the Services to Customer as set forth in the Agreement.
7. The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: Personal Data will be retained as long as necessary for CloudCard to provide the Services to Customer and/or in accordance with applicable legal requirements.
8. For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing: Same as above to the extent that Personal Data is provided to Subprocessors for purposes of providing the Services.
ix. Under Annex IC, the competent supervisory authority is, to the extent legally permissible, the Irish Data Protection Commission.
x. Annex II (Technical and organizational measures) is deemed completed by the information available at: Information Security Policy; and Trust Center
xi. Annex III is not applicable because the Parties have chosen General Authorization under Clause 9.
c. To the extent legally required, by entering into the Agreement, the Parties are deemed to be signing the UK Addendum, which forms part of this DPA and takes precedence over the rest of this DPA as set forth in the UK Addendum. The Tables within the UK Addendum are deemed completed as follows:
i. Table 1: The Parties’ details shall be the Parties to the extent any of them is involved in such transfer, and the Key Contact shall be the contacts indicated in the Exhibit A below.
ii. Table 2: The Approved EU SCCs referenced in Table 2 shall be the EU SCCs as executed by the Parties and completed in Section 7(b) of this DPA.
iii. Table 3: Annexes I and II are completed as set forth above. Annex III is inapplicable.
iv. Table 4: Either Party may end this DPA as set out in Section 19 of the UK Addendum.
d. For transfers of Personal Data that are subject to the FADP, the EU SCCs form part of this DPA as set forth in Section 7(b) of this DPA, but with the following differences to the extent required by the FADP: (i) references to the GDPR in the EU SCCs are to be understood as references to the FADP insofar as the data transfers are subject exclusively to the FADP and not to the GDPR; (ii) the term “member state” in EU SCCs shall not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs; and (iii) the relevant supervisory authority is the Swiss Federal Data Protection and Information Commissioner (for transfers subject to the FADP and not the GDPR), or both such Commissioner and the supervisory authority identified in the EU SCCs (where the FADP and GDPR apply, respectively).
8. Audits.
CloudCard will make available to Customer all information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by Customer or another auditor mandated by Customer, provided that such audit shall occur not more than once every twelve (12) calendar months (unless required more frequently by Data Protection Laws), upon reasonable prior written notice, and to the extent CloudCard’s personnel are required to cooperate therewith, during CloudCard’s normal business hours.
9. Return or Destruction of Personal Data.
Except to the extent required otherwise by Data Protection Laws, CloudCard will, at the choice of Customer, return to Customer and/or securely destroy all Personal Data upon (a) written request of Customer or (b) termination of the Agreement. Except to the extent prohibited by Data Protection Laws, CloudCard will inform Customer if it is not able to return or delete Personal Data.
10. Indemnification and Limitation of Liability.
To the extent permitted by Data Protection Laws, the Parties will indemnify each other and their liability will be limited as provided in the Agreement.
11. Survival.
The provisions of this DPA survive the termination or expiration of the Agreement for so long as CloudCard or its Subprocessors Process Personal Data.