Register for the our next webinar 'Why Produce8 for MSPs?'
To the extent that we process any personal data that is subject to the General Data Protection Regulation (or GDPR) on your behalf, in the provision of the Services, the following Data Processing Addendum shall apply.
This Data Processing Addendum (the “Addendum”) is made by and between Produce8 Inc. (“Produce8”), with a registered office in Vancouver, BC, Canada, and you (“Customer”).
This Addendum is incorporated into our Terms of Service (“Agreement”) and applies in respect of the provision of the Services to the Customer if the Processing of Customer Personal Data (as defined below) is subject to the GDPR, only to the extent the Customer is a Controller of Customer Personal Data and Produce8 is a Processor. The Addendum is intended to satisfy the requirements of Article 28(3) of the GDPR. This Addendum shall be effective for the term of the Agreement.
For the purposes of the Addendum:
Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement.
The parties acknowledge and agree that Customer is the Controller of Customer Personal Data and we are the Processor of that data. Produce8 will only Process Customer Personal Data as a Processor on behalf of and in accordance with the Customer’s prior written instructions and for no other purpose. Produce8 is hereby instructed to Process Customer Personal Data to the extent necessary to enable Produce8 to provide the Services in accordance with the Agreement.
Produce8 is largely unaware of what Customer Personal Data is actually being stored or made available by the Customer or user of the Service and does not directly access such data except as authorized by the Customer, or as necessary to provide Services to the Customer and its users.
If Produce8 cannot process Customer Personal Data in accordance with Customer’s instructions due to a legal requirement under any applicable European Union or Member State law, Produce8 will (i) promptly notify the Customer of such inability, providing a reasonable level of detail as to the instructions with which it cannot comply and the reasons why it cannot comply, to the greatest extent permitted by applicable law; and (ii) cease all Processing of the affected Customer Personal Data (other than merely storing and maintaining the security of the affected Customer Personal Data) until such time as the Customer issues new instructions with which Produce8 is able to comply. If this provision is invoked, Produce8 will not be liable to the Customer under the Agreement for failure to perform the Services until such time as the Customer issues new instructions. Produce8 will immediately inform Customer if, in its opinion, an instruction from Customer infringes the Data Protection Legislation.
Each of the Customer and Produce8 will comply with their respective obligations under the Data Protection Legislation. Customer shall ensure that Customer has informed its data subjects and obtained (or will obtain) all rights and consents (if required by the applicable Data Protection Legislation) to allow Produce8 to Process Customer Personal Data to provide the Services in accordance with this Addendum and the Agreement.
In connection with the performance of the Agreement, Customer authorizes Produce8 to transfer Customer Personal Data from the European Economic Area (“EEA”) to the United States and Canada. Produce8 commits to comply with its obligations for the Customer Personal Data transferred under the Privacy Shield throughout the term of this Addendum.
All parties agree to protect the other party’s information in confidence and exercise due care, and to not use any information for any purpose other than the purposes under this Addendum. The terms of this Addendum in addition to (but not limited to) any service contracts also constitute confidential information.
Produce8 will ensure that any person whom Produce8 authorizes to Process Customer Personal Data on its behalf is subject to confidentiality obligations in respect of that Customer Personal Data.
Produce8 will implement appropriate technical and organizational measures to protect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
Produce8 will, at the Customer’s request and subject to the Customer paying all of Produce8’s fees at prevailing rates, and all expenses, provide the Customer with reasonable assistance as necessary for the fulfilment of the Customer’s obligation to keep Customer Personal Data secure.
Device information created by the manufacturer does not constitute Customer Personal Data as this information is generated and maintained by the manufacturer independently of the end user. Examples of such data include the device model, serial number, MAC addresses and lifecycle dates.
Customer authorizes Produce8 to appoint sub-Processors to perform specific services on Produce8’s behalf which may require such sub-Processors to Process Customer Personal Data.
Produce8 will, at the Customer’s request and subject to the Customer paying all of Produce8’s fees at prevailing rates, and all expenses, provide the Customer with assistance necessary for the fulfilment of the Customer’s obligation to respond to requests for the exercise of Data Subjects’ rights. Produce8 shall not respond to such requests without Customer’s prior written consent and written instructions. Customer shall be solely responsible for responding to such requests.
Produce8 will notify the Customer as soon as practicable after it becomes aware of any of any Personal Data Breach affecting any Customer Personal Data. At the Customer’s request and subject to the Customer paying all of Produce8’s fees at prevailing rates, and all expenses, Produce8 will promptly provide the Customer with all reasonable assistance necessary to enable the Customer to notify relevant security breaches to the competent data protection authorities and/or affected Data Subjects, if Customer is required to do so under the GDPR. Customer is solely responsible for complying with data incident notification requirements applicable to Customer and fulfilling any third-party notification obligations related to any data incidents.
Produce8 will, at the Customer’s request and subject to the Customer paying all of Produce8’s fees at prevailing rates, and all expenses, provide the Customer with reasonable assistance to facilitate:
in each case solely to the extent that such assistance is necessary and relates to the Processing by Produce8 of the Customer Personal Data, taking into account the nature of the Processing and the information available to Produce8.
At the Customer’s request, Produce8 will return or delete Customer Personal Data to the Customer after the end of the provision of Services relating to the Processing, and delete existing copies unless the applicable European Union or member state law requires storage of the data.
Produce8 will, at Customer’s request and subject to the Customer paying all of Produce8’s fees at prevailing rates, and all expenses, provide the Customer with all information necessary to enable the Customer to demonstrate compliance with its obligations under the GDPR, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, to the extent that such information is within Produce8’s control and Produce8 is not precluded from disclosing it by applicable law, a duty of confidentiality, or any other obligation owed to a third party, and provided that such audits shall be carried out with reasonable notice during regular business hours not more often than once per year.
Each party’s liability towards the other party under or in connection with this Addendum will be limited in accordance with the provisions of the Agreement.
The Customer acknowledges that Produce8 is reliant on the Customer for direction as to the extent to which Produce8 is entitled to Process Customer Personal Data on behalf of Customer in performance of the Services. Consequently, Produce8 will not be liable under the Agreement for any claim brought by a Data Subject arising from any action or omission by Produce8, to the extent that such action or omission resulted directly from the Customer’s instructions or from Customer’s failure to comply with its obligations under the applicable data protection law.
With regard to the subject matter of this Addendum, in the event of inconsistencies between the provisions of this Addendum and the Agreement, the provisions of this Addendum shall prevail.
Cookie Policy / Privacy Policy / Acceptable Use Policy / Terms of Service