Skip to main content

Data Processing Agreement (DPA)

This Agreement is made between:​

  • The Client ("Customer" or “you”, "your”), and
  • The Service Provider ("Processor", or "Convbox", “us”, “we”, “our”), collectively referred to as the "Parties" and each, a "Party".

Whereas:​

  • This DPA is incorporated by reference into and forms part of the commercial agreement ("Main Agreement") governing the use of Convbox’s services.
  • The Processor will process Personal Data on behalf of the Customer, in accordance with the Customer’s instructions, and for the provision of agreed services under the Main Agreement.
  • The Parties wish to comply with the applicable data protection laws, including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), Swiss Federal Data Protection Act (FADP), and the Personal Data Protection Act (PDPA) of Singapore.

1. DEFINITIONS​

Affiliate: Any entity that directly or indirectly controls, is controlled by, or is under common control with a Party. “Control” for purposes of this definition means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.

Applicable Data Protection Laws: All applicable laws, rules, regulations, and governmental requirements relating to the privacy, confidentiality, or security of Personal Data, including but not limited to GDPR, CCPA, FADP, and PDPA.

Customer Personal Data: Means the Personal Data processed by Convbox ("Processor") on behalf of the Customer or Customer Affiliate in connection with the provision of the Services outlined in the Main Agreement.

EEA: Means the European Economic Area.

FDPIC: Means the Swiss Federal Data Protection and Information Commissioner.

GDPR: Means Regulation (EU) 2016/679 (the “EU GDPR”) or, where applicable, the “UK GDPR” as defined in section 3 of the Data Protection Act 2018.

CCPA: Means the California Consumer Privacy Act of 2018, Cal. Civ. Code §§ 1798.100 et. seq. (as amended by the California Privacy Rights Act of 2020) and its implementing regulations, as amended or superseded from time to time.

FADP: Means the Swiss Federal Act on Data Protection of 19 June 1992, and as revised as of 25 September 2020, the “Revised FADP”.

UK GDPR: Means the Data Protection Act 2018, as well as the GDPR as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419).

Standard Contractual Clauses (SCCs): Module Two and/or Module Three of the Standard Contractual Clauses pursuant to Commission Implementing Decision (EU) 2021/914.

Sub-processor: Any third party appointed by the Processor to process Personal Data on behalf of the Customer.

2. Processing of Personal Data​

2.1 Roles of the Parties​

  • The Parties acknowledge and confirm their roles in relation to the Personal Data being processed under this DPA:
  • Customer: Acts as the Data Controller.
  • Convbox (Service Provider): Acts as the Data Processor.
  • The terms “Controller” and “Processor” as used herein shall refer to Customer and Convbox respectively.

2.2 Customer’s Processing of Personal Data​

  • The Customer shall ensure compliance with all applicable Data Protection Laws in its role as Controller. This includes obtaining all necessary consents and maintaining a lawful basis for the processing of Personal Data which is then transferred to Convbox for processing pursuant to the terms of the Main Agreement and this DPA.

2.3 Processor’s Processing of Personal Data​

  • Convbox shall process Personal Data exclusively for the purposes of executing the services specified in the Main Agreement and this DPA, which include:
  • Processing in direct accordance with the terms of the Main Agreement and this DPA.
  • Processing to fulfill the service provisions to the Customer.
  • Adhering to any reasonable and lawful instructions provided by the Customer that are consistent with the terms of the Agreement.
  • If Customer’s instructions will cause Convbox to process Customer Personal Data in violation of Applicable Data Protection Laws or outside the scope of the Agreement or the DPA, Convbox shall promptly inform Customer thereof, unless prohibited by Applicable Data Protection Laws (without prejudice to the SCCs).

2.4 Details of the Processing​

  • The specific details regarding the subject-matter, duration, nature, purpose, type of Personal Data, and categories of Data Subjects processed under this DPA are comprehensively documented in Schedule 1 ("Details of Processing").

2.5 Sensitive Data​

  • The agreed services under the Main Agreement are not designed for the processing of Sensitive Data. Should the Customer intend to process Sensitive Data using Convbox’s services, prior written consent must be obtained from Convbox, along with any necessary amendments to this DPA to address the specific requirements related to Sensitive Data.

2.6 CCPA Terms​

  • For Customers operating as Businesses under the CCPA, specific terms applicable to the processing of Personal Data subject to the CCPA are detailed in Schedule 5 ("CCPA Terms"). These terms outline additional responsibilities and obligations specific to CCPA compliance.

3. Sub-processors​

3.1 Appointment of Sub-processors​

  • General Authorization: The Customer hereby authorizes the Processor to engage sub-processors to process Personal Data as necessary to provide the Services detailed in the Main Agreement. This includes the engagement of the Processor’s Affiliates as sub-processors.
  • Access to List: The Processor maintains a current list of sub-processors that includes details such as their identities, countries of operation, and types of services provided. This list is accessible to the Customer upon request by emailing privacy@rto.ai with the subject "Request Sub-Processors List." The sub-processor list as of the first use of the Services by the Customer is deemed authorized upon initial service utilization.

3.2 Agreements with Sub-processors​

  • The Processor ensures that it, or its affiliate on its behalf, has entered into written agreements with each sub-processor. These agreements contain data protection obligations that provide at least the same level of protection for Personal Data as those in this DPA, particularly concerning the implementation of appropriate technical and organizational measures.
  • Liability of Sub-processors: The Processor remains liable for the compliance of the sub-processors and for any acts or omissions that cause the Processor to breach any of its obligations under this DPA.

3.3 Notification and Objection to New Sub-processors​

  • Notification: The Processor shall notify the Customer of any new sub-processor(s) it intends to engage to process Personal Data on the Customer’s behalf. This notification will be provided before authorizing the new sub-processor(s) to process Personal Data and will be sent via email from privacy@rto.ai.
  • Objection by Customer: Upon receiving notification, the Customer may object to the new sub-processor if there are reasonable and justified grounds concerning the protection of their Personal Data. Objections must be submitted in writing to privacy@rto.ai within eight (8) days following receipt of the Processor's notification.
  • Resolution of Objections: If the Customer objects to the new sub-processor, the parties shall endeavor to resolve the concerns in good faith. If no resolution can be achieved, the Processor will make commercially reasonable efforts to provide the same level of services without using the objected new sub-processor to process Personal Data.

4. Data Subject Rights Requests​

4.1 Responsibility for Responses​

  • Primary Responsibility: The Customer retains sole discretion and responsibility for responding to Data Subject Requests pertaining to Customer Personal Data. The Customer must handle all such requests in accordance with applicable Data Protection Laws.

4.2 Notification and Referral​

  • Forwarding Requests: Convbox, upon receiving any Data Subject Request related to Customer Personal Data, either directly or through its sub-processors, will promptly forward such requests to the Customer without undue delay.
  • Advisory to Data Subjects: Convbox may inform the individual making the Data Subject Request to direct their request to the Customer, thereby facilitating a direct response from the Customer.

4.3 Assistance in Handling Requests​

  • Support Tools: Convbox will provide the Customer with self-service functionalities through the Services that enable the Customer to manage and respond to Data Subject Requests efficiently. These functionalities are designed to support the Customer's compliance with Data Protection Laws.
  • Additional Assistance: Where the nature of the processing of Customer Personal Data necessitates further assistance beyond the self-service functionalities, Convbox will provide necessary support to help the Customer fulfill its obligations under Data Protection Laws regarding Data Subject Requests.
  • Costs for Additional Assistance: If Convbox provides assistance beyond the included self-service features, Convbox may charge the Customer for such additional services. The Customer agrees to reimburse Convbox for these services, provided such fees are reasonable, pre-agreed upon, and directly attributable to the assistance provided.

5. Security and Audits​

5.1 Implementation of Security Measures​

Convbox will implement and maintain appropriate technical and organizational data protection and security measures to ensure the security of Customer Personal Data. This includes measures to prevent unauthorized or unlawful processing, unauthorized or unlawful access to, disclosure of, alteration of Customer Personal Data, and protection against accidental loss, destruction, or damage.

5.2 Maintenance and Update of Security Measures​

Convbox will maintain at least the security measures outlined in SCHEDULE 2. Convbox may update or modify these measures periodically, including after reviews conducted under the terms of the Standard Contractual Clauses (SCCs), if applicable. Any such updates or modifications will not degrade the overall level of protection provided by Convbox under this Data Processing Agreement (DPA) for Customer Personal Data.

5.3 Audit Rights​

The Customer, or an independent third-party auditor reasonably acceptable to Convbox (excluding any auditors who are not suitably qualified, independent, or are competitors of Convbox), may audit Convbox's compliance with its obligations under this DPA once per year, or more frequently if a Data Incident has occurred, or as required by applicable data protection laws, including when mandated by the Customer’s regulatory or governmental authority.

5.4 Audit Procedure​

To initiate an audit, the Customer must submit a detailed proposed audit plan to Convbox at least four weeks in advance of the proposed audit date. Convbox will review the audit plan and cooperate with the Customer to finalize it. All audits must be conducted during normal business hours, in accordance with the agreed final audit plan and Convbox's health, safety, security, and other relevant policies, and must not unreasonably interfere with Convbox’s business activities. Convbox is not required to breach any confidentiality obligations under this clause.

5.5 Acceptance of Previous Audit Findings​

If the scope of a requested audit has already been covered by an ISO 27001 certification, SOC 2 Type 2 report, or similar audit report conducted by a qualified third-party auditor within the last twelve months, and Convbox confirms that there have been no material changes in the controls audited, the Customer agrees to accept those findings instead of requesting a new audit of the controls covered by the report.

5.6 Notification of Non-Compliance​

The Customer will promptly notify Convbox of any non-compliance found during the course of an audit and will provide Convbox with any audit reports generated, unless such notification or provision is prohibited by applicable law or instructed otherwise by a regulatory or governmental authority. The Customer may use the audit reports only for the purposes of meeting the Customer’s regulatory audit requirements and/or confirming compliance with the requirements of this DPA.

5.7 Audits of Subcontractors​

Convbox shall regularly audit its subcontractors and will, upon the Customer's request, confirm their compliance with data protection laws and the obligations set out in the data processing agreements concluded with them. The Customer may request further audits from Convbox only when reasonably justified, and in such cases, Convbox will conduct further audits to the extent permissible.

5.8 Adequacy of Security Measures​

The Customer acknowledges and agrees that, considering the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the security measures set out in SCHEDULE 2 are adequate to ensure the security of the Customer Personal Data.

All audits shall be conducted at the Customer's expense. The Customer shall reimburse Convbox for any time expended by Convbox or its Sub-processors in connection with such audits. The Customer shall also pay for the corresponding cooperative work provided by Convbox at the standard service hourly rate according to the actual workload as specified in the sales agreement.

6. Data Incident Management and Notification​

The Processor maintains security incident management policies and procedures and, as required under applicable Data Protection Laws, shall notify the Customer without undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data processed on behalf of the Customer (a “Data Incident”), or any data incident or breach as defined in applicable Data Protection Laws involving Personal Data processed on behalf of the Customer. The Processor shall make reasonable efforts to identify and take the necessary and reasonable steps to remediate and/or mitigate the cause of such Data Incident to the extent that remediation and mitigation are within the Processor’s reasonable control. The obligations herein do not apply to incidents caused by the Customer or anyone using the Services on the Customer’s behalf. The Customer shall not make, disclose, release, or publish any findings, admissions of liability, communications, notices, press releases, or reports concerning any Data Incident that directly or indirectly identifies the Processor (including in any legal proceedings or notifications to regulatory or supervisory authorities or affected individuals) without the Processor’s prior written approval, unless compelled to do so under applicable Data Protection Laws. In such cases, unless prohibited by law, the Customer shall provide the Processor with reasonable prior written notice to give the Processor the opportunity to object to such disclosure, and the Customer will limit the disclosure to the minimum scope required.

7. Return and Deletion of Personal Data​

Within 60 days following the termination of the Agreement, the Processor shall, at the choice of the Customer (indicated through the Services or in a written notification to the Processor), delete or return all the Personal Data it processes solely on behalf of the Customer as described in the Agreement, and the Processor shall delete existing copies of such Personal Data unless Data Protection Laws require otherwise. To the extent authorized or required by applicable law, the Processor may also retain one copy of the Personal Data solely for evidence purposes and/or for the establishment, exercise, or defense of legal claims, or for compliance with legal obligations.

8. Cross-Border Data Transfers​

8.1 Adequate Level Transfers​

Personal Data may be transferred from the European Economic Area (EEA), Switzerland, and the United Kingdom (UK) to countries deemed to provide an adequate level of data protection under the adequacy decisions issued by the relevant data protection authorities of the EEA, the European Union, its Member States, the European Commission, Switzerland, and/or the UK. Such transfers do not require additional safeguards to be implemented.

8.2 Transfers to Non-Adequate Countries​

If the Processor’s handling of Personal Data involves transferring data from the EEA, the UK, or Switzerland to countries not covered by an adequacy decision, and if these transfers are not conducted through a recognized compliance mechanism adopted by the Processor for the lawful transfer of Personal Data outside the EEA, the UK, or Switzerland, the following terms shall apply:

  • (i) For transfers originating from the EEA (EEA Transfers), the stipulations in Part 1 of Schedule 4 (EEA Cross Border Transfers) shall apply.
  • (ii) For transfers originating from the UK (UK Transfers), the stipulations in Part 2 of Schedule 4 (UK Cross Border Transfers) shall apply.
  • (iii) For transfers originating from Switzerland (Swiss Transfers), the stipulations in Part 3 of Schedule 4 (Swiss Cross Border Transfers) shall apply.
  • (iv) Additional safeguards as set forth in Part 4 of Schedule 4 (Additional Safeguards) shall apply to all such transfers.

9. OTHER PROVISIONS​

9.1 Data Protection Impact Assessment and Prior Consultation​

Upon the Customer's reasonable request, the Processor shall provide the Customer, at the Customer's expense, with necessary cooperation and assistance to fulfill the Customer's obligations under the applicable Data Protection Laws for conducting a data protection impact assessment or data protection assessment (as applicable), particularly in relation to the Customer's use of the Services. This assistance is provided to the extent that the Customer lacks access to the necessary information, and such information is available to the Processor. Furthermore, the Processor will offer reasonable assistance, also at the Customer's expense, for the cooperation or prior consultation with the Supervisory Authority as required to perform the tasks specified in this Section 11.1, in accordance with applicable Data Protection Laws.

9.2 Support for Cross-Border Data Transfers​

Convbox shall provide the necessary support to assist the Customer in complying with the data transfer requirements applicable to data subjects located in the European Economic Area (EEA), Switzerland, and the UK. Upon the Customer’s request, Convbox will supply the information that is reasonably necessary for the Customer to complete a Transfer Impact Assessment (TIA). Additionally, Convbox agrees to implement supplementary measures, as detailed in Schedule 4 of this Data Processing Agreement (DPA), to facilitate compliance with the regulatory obligations associated with the transfer of personal data to third countries. Convbox may invoice the Customer for any support provided concerning TIAs, data protection impact assessments, or consultations with supervisory authorities, and the Customer agrees to reimburse Convbox for such support as per the terms set out in this DPA.

9.3 Revision of the Clauses​

Either party may, by providing at least forty-five (45) calendar days' prior written notice to the other party, request written amendments to this DPA as necessitated by any changes in Data Protection Laws or decisions by relevant regulatory authorities, ensuring the continued processing of Personal Data complies with legal requirements. Following such notice:

  • (a) The parties will undertake commercially reasonable efforts to accommodate the modifications requested by either the Customer or the Processor as necessary.
  • (b) The Customer shall not unreasonably withhold or delay consent to any consequential changes to this DPA proposed by the Processor to safeguard against additional risks or to compensate the Processor for any additional actions and costs incurred due to changes requested by the Customer. The parties will promptly discuss the proposed changes and negotiate in good faith to agree and implement those changes or alternative adjustments to meet the requirements specified in the notice from the Customer or the Processor as quickly as possible. If the parties fail to agree within 30 days of the notice, then either the Customer or Processor may terminate the Agreement with immediate effect by written notice to the other party, specifically relating to the Services impacted by the proposed or absent changes. Upon such termination, the Customer shall have no further claims against the Processor, including but not limited to claims for refunds for the Services, as described in this section.

SCHEDULE 1 - DETAILS OF THE PROCESSING​

Nature and Purpose of Processing​

  1. Providing the Services to Customer: Facilitating the services outlined in the Agreement to the Customer.
  2. Performing the Agreement, this DPA, and Other Contracts: Execution and administration of the Agreement, this DPA, and any other related contracts between the Parties.
  3. Acting Upon Customer’s Instructions: Processing activities are conducted based on the Customer’s instructions that align with the terms of the Agreement.
  4. Compliance with Laws and Regulations: Adhering to all applicable legal and regulatory requirements.

Duration of Processing​

The processing of Personal Data will continue for the duration of the Agreement, as defined within the DPA and the Agreement itself, unless a different term is agreed upon in writing. This includes handling any events related to the expiration or termination of the Agreement.

Type of Personal Data​

The Customer has the autonomy to decide the extent of Personal Data submitted to the Services, which is managed according to the Customer's sole discretion.

Categories of Data Subjects​

Personal Data processed and transferred is determined by the Customer's configuration of the Service and may involve, but is not limited to, data relating to the following categories of data subjects:
Visitors and Shoppers: Individuals who interact with the Customer’s online platforms or purchase products and services from the Customer online.

SCHEDULE 2 - TECHNICAL AND ORGANIZATIONAL MEASURES​

The technical and organizational measures are implemented by Convbox to ensure an appropriate level of security relative to the potential risks to personal data. These measures are informed by the nature, scope, context, and purposes of the data processing activities undertaken by Convbox, as well as the risk posed to the rights and freedoms of natural persons:

  1. Organizational Management and Dedicated Staff: Convbox employs a dedicated team responsible for the development, implementation, and maintenance of its information security program. This team is tasked with the continual oversight of Convbox's security practices.
  2. Audit and Risk Assessment Procedures: Regular audits and risk assessments are conducted to evaluate the risks to Convbox’s organization, ensure compliance with Convbox's policies, and report the status of information security and compliance to internal senior management.
  3. Encryption Technologies: Convbox uses commercially available and industry-standard encryption technologies to secure Customer Personal Data, specifically:
    • During transmission over public networks or when transmitted wirelessly.
    • While at rest or stored on portable or removable media such as laptops, CDs/DVDs, USB drives, and backup tapes.
  4. Data Security Controls: Convbox enforces data security controls including, but not limited to:
    • Logical segregation of data.
    • Access controls based on authority levels and job functions, such as need-to-know access, use of unique IDs and passwords, and timely modification or revocation of access.
  5. Password Controls: Password policies are enforced to ensure password strength and security, including requirements for length, complexity, and periodic changes. Passwords are not stored in a readable format within Convbox’s systems.
  6. System Audit and Event Logging: Systematic logging of user access and system activities is performed for routine security reviews.
  7. Operational Procedures and Controls: Procedures and controls are in place for the configuration, monitoring, and maintenance of technology and information systems according to industry standards, including secure disposal of systems and media.
  8. Change Management Procedures: These procedures ensure that all changes to Convbox’s technology and information assets undergo testing, approval, and monitoring.
  9. Incident and Problem Management Procedures: Procedures to investigate, respond to, mitigate, and notify in the event of technology or information asset incidents.
  10. Network Security Controls: Network defenses include the use of firewalls, intrusion detection systems, and traffic/event correlation to protect systems from intrusion and to contain successful attacks.
  11. Vulnerability Assessment, Patch Management, and Threat Protection: Regular monitoring and updates are performed to protect against security threats, viruses, and malicious software.
  12. Business Resiliency/Continuity and Disaster Recovery: Procedures are in place to ensure continued service and recovery from emergencies or disasters, aiming to minimize downtime and data loss. These measures are periodically reviewed and updated as necessary to respond to new security challenges and technological advancements.

SCHEDULE 3 - SUPPLEMENTARY SAFEGUARDS​

Convbox commits to adopting additional safeguards based on the recommendations of EU supervisory authorities to reinforce the protection of Customer Personal Data processed in third countries, as detailed in this Schedule 4.

1. Additional Technical Measures (Encryption)​

1.1 Personal data transmissions (among the Parties, between Convbox data centers, and to/from Sub-processors) employ robust encryption.

1.2 Personal data stored at rest by Convbox is secured using robust encryption.

2. Additional Organizational Measures​

2.1 Internal policies for data transfer governance, especially within corporate groups:

  • (a) Establish comprehensive internal policies specifying clear responsibilities for data transfers, communication channels, and standard procedures for handling both formal and informal public authority data access requests.
  • (b) Formulate targeted training programs for personnel responsible for handling data access requests from public authorities. These programs should be regularly updated to reflect new legal and judicial developments within the third country and the EEA.

2.2 Measures for transparency and accountability:

Periodically release transparency reports or summaries detailing governmental data access requests and the responses provided, as permitted by local legislation.

2.3 Organizational strategies and data minimization practices:

Develop and implement best practices to ensure timely and appropriate involvement of and information access for their respective data protection officers (if appointed) and legal and internal audit teams concerning international data transfers.

2.4 Additional measures:

Convbox will continually reassess and update its internal policies to evaluate the effectiveness of existing supplementary measures and to identify and integrate new or alternative measures as needed. This ensures that the transferred personal data retains a level of protection essentially equivalent to that guaranteed within the EEA.

SCHEDULE 4 - CROSS BORDER TRANSFERS​

PART 1 – EEA Cross Border Transfers​

STANDARD CONTRACTUAL CLAUSES​

  1. The parties agree that the terms of the Standard Contractual Clauses are incorporated by reference and apply to EEA Transfers.
  2. Module Two (Controller to Processor) of the Standard Contractual Clauses applies where the EEA Transfer is initiated by the Customer as the data controller and Convbox as the data processor.
  3. The Docking Clause (Clause 7 of the Standard Contractual Clauses) does not apply.
  4. Option 2: GENERAL WRITTEN AUTHORIZATION in Clause 9 of the Standard Contractual Clauses applies, detailing the method for appointing and the time period for prior notice of Sub-processor changes as set forth in Section 5.3 of the DPA.
  5. Optional language in Clause 11 of the Standard Contractual Clauses will not apply.
  6. Under Clause 17 of the Standard Contractual Clauses, Option 1 is selected, stipulating that the Standard Contractual Clauses are governed by the laws of the Republic of Ireland.
  7. Clause 18(b) specifies that disputes will be resolved before the courts of the Republic of Ireland.
  8. Annex I.A of the Standard Contractual Clauses is completed as follows:
    • Data Exporter: Customer.
    • Contact details: As specified in the Agreement.
    • Role: Data Exporter is a data controller.
    • Signature and Date: By entering into the Agreement and DPA, the Data Exporter is deemed to have signed these Standard Contractual Clauses as of the Effective Date.
    • Data Importer: Convbox.
    • Contact details: As specified in the Agreement.
    • Role: Data Importer is a data processor.
    • Signature and Date: By entering into the Agreement and DPA, the Data Importer is deemed to have signed these Standard Contractual Clauses as of the Effective Date.
  9. Annex I.B of the Standard Contractual Clauses is completed as follows:
    • The categories of personal data and data subjects are described in Schedule 1 of the DPA.
    • Sensitive Data is not intended for transfer.
    • The frequency of the transfer is continuous for the duration of the Agreement.
    • The nature and purpose of the Processing are as described in Schedule 1 of the DPA.
    • The retention period for the Personal Data is for the duration of the Agreement unless agreed otherwise.
  10. Annex I.C of the Standard Contractual Clauses is completed as follows:
    • The competent supervisory authority is the one stipulated in Section 7 above.
  11. The Security Documentation referred to in the DPA serves as Annex II of the Standard Contractual Clauses.
  12. In the event of any conflict between the Standard Contractual Clauses and other terms in this DPA or the Agreement, the provisions of the Standard Contractual Clauses will prevail.

PART 2 – UK Cross Border Transfers​

The International Data Transfer Addendum to the Standard Contractual Clauses issued by the UK Information Commissioner’s Office under S119A(1) of the UK Data Protection Act 2018 is incorporated by reference for UK Transfers as specified in this Part 2, along with the Standard Contractual Clauses from Part 1 of this Schedule.

Part 1 (Tables) of the UK Addendum is completed as follows:​

Table 1: The Parties​

  • Details are as specified in Section 9 of Part 1 of Schedule 1.

Table 2: Selected SCCs, Modules, and Selected Clauses​

  • As detailed in Part 1 of Schedule 1.

Table 3: Appendix Information​

  • This includes information necessary for the selected modules as outlined in the Appendix of the Standard Contractual Clauses, excluding details about the Parties themselves, and is specified in Part 1 of Schedule 1.

Table 4: Ending this Addendum when the Approved Addendum Changes​

  • Neither Party is permitted to end the UK Addendum incorporated in this DPA as outlined in Section 19 of the UK Addendum.

PART 3 – Swiss Cross Border Transfers​

The Parties have agreed to modify the Standard Contractual Clauses as follows for Swiss Transfers under the FADP:

  1. Standard Contractual Clauses Reference: The references to the Standard Contractual Clauses shall be interpreted as referring to the Standard Contractual Clauses as modified by this Part 3.
  2. Supervisory Authority: The Swiss Federal Data Protection and Information Commissioner shall serve as the sole Supervisory Authority for Swiss Transfers that are exclusively governed by the FADP.
  3. Inclusion of FADP: The terms “General Data Protection Regulation” or “Regulation (EU) 2016/679” as used in the Standard Contractual Clauses shall also encompass the FADP when referring to Swiss Transfers.
  4. Removal of EU Regulation Reference: References to Regulation (EU) 2018/1725 are hereby removed from the context of Swiss Transfers.
  5. Authority Oversight: For Swiss Transfers subject to both the FADP and the GDPR, the EU Supervisory Authority listed in Annex I.C to Part 1 of this Schedule 2 shall oversee these transfers.
  6. Inclusive Interpretation: References to the “Union”, “EU”, and “EU Member State” in the context of Swiss Transfers shall not exclude the rights of Data Subjects in Switzerland from exercising their rights within their place of habitual residence as per Clause 18(c) of the Standard Contractual Clauses.
  7. Exclusive FADP Application: For Swiss Transfers solely governed by the FADP, all references to the GDPR in the Standard Contractual Clauses shall be construed as references to the FADP.
  8. Dual Regulation Transfers: For Swiss Transfers subject to both the FADP and the GDPR, all references to the GDPR in the Standard Contractual Clauses should be interpreted as references to the FADP, insofar as the transfer is regulated by the FADP.

PART 4 – Additional Safeguards​

Additional safeguards for EEA, UK, or Swiss Transfers include appropriate security measures such as data encryption in transit and at rest, and legal mechanisms to challenge requests for access to personal data by government authorities.

SCHEDULE 5 - TERMS OF THE CALIFORNIA CONSUMER PRIVACY ACT (CCPA)​

1. Scope, Application, and Interpretation​

  • This Schedule 5 applies and binds the parties if:
    1. The Customer operates as a Business under the CCPA.
    2. Convbox processes Personal Information (as defined below) subject to the CCPA while providing services to Customers under the Agreement.
  • This Schedule 5 supersedes any conflicting terms in the Agreement or the Data Processing Agreement (DPA) but does not otherwise alter those agreements.
  • This Schedule 5 shall be interpreted to support compliance with the CCPA, resolving ambiguities in a manner consistent with the CCPA.
  • All capitalized terms not defined herein retain their meanings from the DPA, as modified by this Schedule.

2. Definitions​

  • “Business,” “Collects,” “Consumer,” “Deidentified,” “Business Purpose,” “Sell,” “Share,” and “Service Provider” have the meanings provided in the CCPA.
  • “Personal Information” means information that can identify, relate to, describe, be associated with, or link, directly or indirectly, to a specific consumer or household, processed by Convbox solely for the Customer under this Schedule and the Agreement.

3. Processing of Personal Information​

  • The Customer designates Convbox as a Service Provider to process Personal Information according to the CCPA. The Customer will ensure compliance with the CCPA, including notice and consent provisions as necessary.
  • Convbox will process Personal Information only for purposes outlined in the DPA and necessary for this Schedule and CCPA compliance. This includes executing Business Purposes such as providing ecommerce solutions and features referred to as the "Permitted Purposes."
  • Standard sections of the DPA applicable to Personal Information processing will be modified as follows for consistency with CCPA definitions and requirements.
  • Convbox commits to processing Personal Information in a manner that meets the privacy protection standards required by the CCPA.
  • Convbox confirms it does not process Personal Information as a form of payment for services provided under the Agreement. It will not sell or share Personal Information without prior written consent from the Customer and will not engage in transactions that classify the data transfer as a sale under the CCPA.
  • Convbox will not aggregate or merge the processed Personal Information with other data in ways that would contravene the CCPA.
  • If Convbox receives deidentified information, it will take steps to ensure it remains non-identifiable with any specific consumer or household.
  • Convbox will inform the Customer if it is unable to comply with the obligations set forth in this Schedule or the CCPA.