Regarding the Processing of Personal Data of EU Customers
(hereinafter referred to as “Folsom Labs DPA”)
by and between
Folsom Labs Inc. 363 Clementina St, 2nd Floor, San Francisco, CA 94103, USA
— hereinafter referred to as “Folsom Labs” —
Folsom Labs’ customers being subject to the rules under the European General Data Protection Regulation or the Standard Contractual Clauses for Processors pursuant to European Commission Decision of February 5, 2010.
— hereinafter referred to as “Customer” —
— Folsom Labs and Customer hereinafter referred to as “Parties” and each as “Party” —
- Terms used but not defined in this Section, including but not limited to “personal data”, “personal data breach”, “processing”, “controller”, “processor” and “data subject”, will have the same meaning as set forth in Art. 4 GDPR.
- “Applicable Law” means all laws, rules and regulations applicable to either party’s performance under this Data Processing Agreement, including but not limited to those applicable to the processing of personal data. This means in particular the GDPR and all national laws validly amending the applicable rules for the processing of personal data.
SUBJECT, DURATION, PURPOSE, AND SPECIFICATION OF PROCESSING
- The categories of data and data subjects which may be concerned by the processing are listed in Exhibit, Appendix 1.
- This Folsom Labs DPA is by way of reference an integral part of any agreement entered into between Folsom Labs and Customer.
STANDARD CONTRACTUAL CLAUSES
FOLSOM LABS’S OBLIGATIONS
- In addition to Clause 5 (a) SCC, Folsom Labs shall in the course of providing Services, including with regard to transfers of personal data to a third country, process Customer’s personal data only on behalf of and under the documented Instructions of Customer unless required to do so otherwise by EU or Member State Law; in such a case, Folsom Labs shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;
- Folsom Labs shall take all steps reasonably necessary to ensure that any natural person acting under its authority who has access to personal data does not process such personal data except on Instructions from the Customer, unless Folsom Labs, he or she is otherwise required to do so by EU or Member State Law.
- Folsom Labs ensures that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality and that the obligation will remain after termination of this Folsom Labs DPA.
Technical and Organizational Data Security Measures
- In addition to Clause 5 (c) SCC, the measures specified in Exhibit, Appendix 2 are subject to technical advancements and development.
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Folsom Labs shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Art. 32 GDPR. This may include as appropriate:
- the pseudonymization and encryption of personal data;
- the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; and
- the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.
- When assessing the appropriate level of security, account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored or otherwise processed.
- If Folsom Labs significantly modifies measures specified in Exhibit, Appendix 2, such modifications have to meet the obligations pursuant to Sect. 4.4.2 and 4.4.3. Folsom Labs shall make available to Customer a description of such measures which enables Customer to assess compliance with Art. 32 GDPR and allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer as permitted by Clause 5 (f) SCC. Folsom Labs and Customer shall agree on such significant modifications by signing the modified Exhibit, Appendix 2 after every amendment. Customer shall not refuse to accept any modification that meets the requirements pursuant to Sect. 4.4.2 and 4.4.3 of this Folsom Labs DPA.
- Folsom Labs shall implement a data protection management procedure according to Art. 32 para 1 lit. d) GDPR, for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures to appropriately ensure the security of the processing. Folsom Labs will further, by way of regular self-audits, reasonably ensure that the processing of Customer’s personal data conforms with the provisions as agreed with Customer or to Customer’s Instructions.
- Folsom Labs shall, while taking into account the nature of the processing, assist Customer through appropriate technical and organizational measures, with the fulfilment of Customer’s obligations to respond to requests for exercising rights of data subjects in accordance with Applicable Law, in particular Art. 15 through 18 and 21 GDPR.
- Taking into account the nature of the processing and the information available to Folsom Labs, Folsom Labs shall assist Customer with ensuring compliance with the obligations pursuant to Art. 33 through 36 GDPR (Data Security Breach Notification, Data Protection Impact Assessment, Consultation with Data Protection Supervisory Authorities).
Documentation and Audit Rights
- Folsom Labs may, in its discretion provide data protection compliance certifications issued by a commonly accepted certification issuer which has been audited by a data security expert, by a publically certified auditing company or by another customer of Folsom Labs.
- If Customer has justifiable reason to believe that Folsom Labs is not complying with the terms and conditions under this agreement, in particular with the obligation to implement and maintain the agreed technical and organizational data security measures, and only once per year, Customer is entitled to audit Folsom Labs. This audit right can be exercised by (i) requesting additional information, (ii) accessing the databases which process Customer's personal data or (iii) by inspecting Folsom Labs’ working premises whereby in each case no access to personal data of other customers or Folsom Labs’ confidential information will be granted. Alternatively, Customer may also engage third party auditors to perform such tasks on its behalf. The costs associated with such audits and/or for providing additional information shall be borne by Customer unless such audit reveals Folsom Labs’ material breach with this Folsom Labs DPA.
- If Customer intends to conduct an audit at Folsom Labs’ working premises, Customer shall give reasonable notice to Folsom Labs and agree with Folsom Labs on the time and duration of the audit. In the case of a special legitimate interest, such audit can also be conducted without prior notice. Both Parties shall memorialize the results of the audit in writing.
In addition to Clause 5 (d) SCC, Folsom Labs shall inform Customer without undue delay in text form (e.g. letter, fax or e-mail) of the events listed in Clause 5 (d) SCC and the following events:
- Requests from third parties including from a data protection supervisory authority regarding Customer’s personal data;
- Threats to Customer’s personal data in possession of Folsom Labs by garnishment, confiscation, insolvency and settlement proceedings or other incidents or measures by third parties. In such case, Folsom Labs shall immediately inform the respective responsible person/entity that Customer holds the sovereignty and ownership of the personal data.
For the purpose of complying with Clause 5 (d) SCC and for enabling Customer to comply with its own data breach notification obligations pursuant to Art. 33 para 2 GDPR, Folsom Labs shall notify Customer without undue delay after becoming aware of a personal data breach. Such notice will, at a minimum, include the following information:
- a description of the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
- information pursuant to Sect. 4.10;
- description of the likely consequences of the personal data breach; and
- description of the measures taken or proposed to be taken by the Customer to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
- Folsom Labs shall inform Customer immediately if, from its point of view, an Instruction of Customer may lead to a violation of the GDPR or other Union or Member State data protection provisions. Until the Customer either confirms or alternates the Instruction, Folsom Labs may refuse to comply.
Rectification, Erasure (Deletion), Restriction
- At Customer’s request, Folsom Labs shall conduct a data protection-compliant destruction of data media and other material if so provided by Customer. Alternatively, at the request of Customer, Folsom Labs shall provide the data media and other material to Customer or store it on Customer’s behalf.
- Unless Union or Member State law requires a retention of the personal data, Folsom Labs shall, upon completion of the Services at the choice of the Customer, either delete or return all Customer’s personal data in its possession to Customer.
- Without prejudice to the generality of clause 5(d) of the SCC, if a data subject addresses Folsom Labs with claims for rectification, erasure or restriction, Folsom Labs shall refer the data subject to Customer.
- Folsom Labs will inform Customer of the name and the official contact details of its data protection officer if Folsom Labs is, by Applicable Law, required to appoint a data protection officer. If Folsom Labs is not required to appoint a data protection officer, Folsom Labs shall name a person responsible for dealing with questions relating to applicable data protection law and data security in the context of performing this Folsom Labs DPA.
- In the case claims based on Art. 82 GDPR are raised against Customer, Folsom Labs shall reasonably support Customer with its defense to the extent the claim arises in connection with the processing of personal data by Folsom Labs in connection with performing the Services to the Customer.
- Folsom Labs will make available to Customer all information necessary to demonstrate compliance with the obligations laid down in Folsom Labs DPA and Art. 28 GDPR.
- Folsom Labs will on request make available a record of its processing activities based on Art. 30 GDPR unless the exception of Art. 30 para 5 GDPR applies.
- In addition to Clause 4 (b) SCC, Customer shall provide all Instructions pursuant to this Folsom Labs DPA to Folsom Labs in written or electronic form.
- Customer shall inform Folsom Labs immediately if processing by Folsom Labs might lead to a violation of data protection regulations.
- In the case claims based on Art. 82 GDPR are raised against Folsom Labs, Customer shall reasonably support Folsom Labs with its defense to the extent the claim arises in connection with the processing of personal data by Folsom Labs in connection with performing the Services to the Customer.
- Customer shall name a person responsible for dealing with questions relating to applicable data protection law and data security in the context of performing this Folsom Labs DPA.
- In addition to the provisions contained in Clause 11 SCC, any subprocessor is obliged, before initiating the processing, to commit itself in writing, for the benefit of Customer [and Customer’s Customers] to comply with the same data protection obligations as the ones under this Folsom Labs DPA or legal Act within the meaning of Art. 28 para 3, 4 and 6 GDPR vis-à-vis Customer (the sub-processing agreement must provide at least the same level of data protection as required under this Folsom Labs DPA). Where the subprocessor fails to fulfil its data protection obligations, Folsom Labs shall remain fully liable to the Customer for the performance of the subprocessor’s obligations.
- Where a subprocessor refuses to be bound by the same data protection obligations as the ones under this Folsom Labs DPA, Customer may consent thereto whereby such consent shall not be unreasonably withheld.
- Folsom Labs may provide for a website or provide another notice that lists all subprocessor which have access to personal data of its Customer as well as the limited or ancillary services they provide. At least 14 days before authorizing any new subprocessor to access personal data, Folsom Labs will update its website, notify Customer and grant the opportunity to object to such change. Upon Customer’s request, Folsom Labs will provide all information necessary to demonstrate that the subprocessor will meet all requirements pursuant to Sect. 6.1 and 6.3. In the case Customer objects to the subprocessing, Folsom Labs can choose to either not engage the subprocessor or to terminate the Folsom Labs DPA with two (2) months prior written notice.
- Upon written request, Folsom Labs will make the list of applicable Subprocessors available to Customer.
Customer and Folsom Labs shall be each liable for damages of concerned data subjects according to Art. 82 GDPR (external liability):
- Folsom Labs’ liability under Sect. Error! Reference source not found. shall be limited to the damage caused by processing where it has not complied with obligations of the GDPR specifically directed to Folsom Labs or where it has acted outside or contrary to lawful Instructions of the Customer.
- Customer and Folsom Labs shall be exempt from liability under Sect. Error! Reference source not found. and 7.1.1 if they prove to not be in any way responsible for the event giving rise to the damage.
- Where more than one Customer and Folsom Labs, or both, the Customer and Folsom Labs, are involved in the same processing and under Sect. Error! Reference source not found. and 7.1.1 are responsible for any damage caused by processing, each Customer or Folsom Labs shall be held liable for the entire damage.
- Sect. 7.1.1, 7.1.2, 7.1.3 and 7.1.4 shall apply only, where more beneficial for data subjects as compared to Clause 3 and 6 SCC. In any other case, Clauses 3 and 6 SCC shall prevail.
- Customer and Folsom Labs shall be entitled to claim back from the other, Folsom Labs or Customer, that part of the compensation corresponding to their part of responsibility for the damage.
COSTS FOR ADDITIONAL SERVICES
If Customer’s Instructions lead to a change from or increase of the agreed Services or in the case of Folsom Labs’ compliance with its obligations pursuant to Sects. 4.6, 4.9 or 4.11 to assist Customer with Customer’s own statutory obligations, Folsom Labs is entitled to charge reasonable fees for such tasks which are based on the prices agreed for rendering the Services and/or notified to Customer in advance.
Folsom Labs may modify or supplement this Folsom Labs DPA, with notice to Customer, (i) if required to do so by a supervisory authority or other government or regulatory entity, (ii) if necessary to comply with Applicable Law, (iii) to implement standard contractual clauses laid down by the European Commission or (iv) to adhere to an approved code of conduct or certification mechanism approved or certified pursuant to Articles 40, 42 and 43 of the GDPR. The Customer shall notify Folsom Labs if it does not agree to a modification, in which case Folsom Labs may terminate the DP Amendment Agreement with two (2) months' prior written notice.
Any side agreements to this Folsom Labs DPA as well as changes and amendments of this Folsom Labs DPA, including this Sect. 11, shall be in writing (textform being sufficient).
CHOICE OF LAW
This Folsom Labs DPA is governed by, and shall be interpreted in accordance with, the law of the EU Member State in which the Customer [or, if the Customer is not controller, the Customer’s Customer] resides, excluding its conflict of law provisions, to the extent not otherwise provided by Clause 7 SCC.
- For the determination of the data protection obligations, entitlement to provide orders and control, responsibilities, liabilities and consequences of objectives, the Folsom Labs DPA shall prevail over all other agreements between the Parties.
- This Folsom Labs DPA may only be amended, supplemented or changed upon the written agreement of the Parties.
Exhibit – Standard Contractual Clauses for Processors
Standard Contractual Clauses for Processors
For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection.
Customer are hereinafter referred to as the "Data Exporter" with respect to the personal data provided by that Data Exporter.
Folsom Labs as defined in the Folsom Labs DPA is hereinafter referred to as the "Data Importer".
The Data Exporter(s) and the Data Importer, each a “party” and collectively “the parties” HAVE AGREED on the following Contractual Clauses (the Clauses) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the Data Exporter to the Data Importer of the personal data specified in Appendix 1.
For the purposes of the Clauses:
- 'personal data', 'special categories of data', 'process/processing', 'controller', 'processor', 'data subject' and 'supervisory authority' shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
- 'the Data Exporter' means the controller who transfers the personal data;
- 'the Data Importer' means the processor who agrees to receive from the Data Exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses and who is not subject to a third country's system ensuring adequate protection within the meaning of Article 25(1) of Directive 95/46/EC;
- 'the subprocessor' means any processor engaged by the Data Importer or by any other subprocessor of the Data Importer who agrees to receive from the Data Importer or from any other subprocessor of the Data Importer personal data exclusively intended for processing activities to be carried out on behalf of the Data Exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;
- 'the applicable data protection law' means the legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the Data Exporter is established;
- 'technical and organisational security measures' means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.
Details of the transfer
The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 which forms an integral part of the Clauses.
Third-party beneficiary clause
- The data subject can enforce against the Data Exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.
- The data subject can enforce against the Data Importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the Data Exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the Data Exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the Data Exporter, in which case the data subject can enforce them against such entity.
- The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the Data Exporter and the Data Importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the Data Exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the Data Exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
- The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.
Obligations of the Data Exporter
The Data Exporter agrees and warrants:
- that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the Data Exporter is established) and does not violate the relevant provisions of that State;
- that it has instructed and throughout the duration of the personal data processing services will instruct the Data Importer to process the personal data transferred only on the Data Exporter's behalf and in accordance with the applicable data protection law and the Clauses;
- that the Data Importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this contract;
- that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;
- that it will ensure compliance with the security measures;
- that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection within the meaning of Directive 95/46/EC;
- to forward any notification received from the Data Importer or any subprocessor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the Data Exporter decides to continue the transfer or to lift the suspension;
- to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;
- that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the Data Importer under the Clauses; and
- that it will ensure compliance with Clause 4(a) to (i).
Obligations of the Data Importer
The Data Importer agrees and warrants:
- to process the personal data only on behalf of the Data Exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the Data Exporter of its inability to comply, in which case the Data Exporter is entitled to suspend the transfer of data and/or terminate the contract;
- that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the Data Exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the Data Exporter as soon as it is aware, in which case the Data Exporter is entitled to suspend the transfer of data and/or terminate the contract;
- that it has implemented the technical and organisational security measures specified in Appendix 2 before processing the personal data transferred;
that it will promptly notify the Data Exporter about:
- any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation,
- any accidental or unauthorised access, and
- any request received directly from the data subjects without responding to that request, unless it has been otherwise authorised to do so;
- to deal promptly and properly with all inquiries from the Data Exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;
- at the request of the Data Exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the Data Exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the Data Exporter, where applicable, in agreement with the supervisory authority;
- to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the Data Exporter;
- that, in the event of subprocessing, it has previously informed the Data Exporter and obtained its prior written consent;
- that the processing services by the subprocessor will be carried out in accordance with Clause 11;
- to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the Data Exporter.
- The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor, is entitled to receive compensation from the Data Exporter for the damage suffered.
If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the Data Exporter, arising out of a breach by the Data Importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the Data Exporter has factually disappeared or ceased to exist in law or has become insolvent, the Data Importer agrees that the data subject may issue a claim against the Data Importer as if it were the Data Exporter, unless any successor entity has assumed the entire legal obligations of the Data Exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity.
The Data Importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities.
- If a data subject is not able to bring a claim against the Data Exporter or the Data Importer referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the Data Exporter and the Data Importer have factually disappeared or ceased to exist in law or have become insolvent, the subprocessor agrees that the data subject may issue a claim against the data subprocessor with regard to its own processing operations under the Clauses as if it were the Data Exporter or the Data Importer, unless any successor entity has assumed the entire legal obligations of the Data Exporter or Data Importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the subprocessor shall be limited to its own processing operations under the Clauses.
Mediation and jurisdiction
The Data Importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the Data Importer will accept the decision of the data subject:
- to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;
- to refer the dispute to the courts in the Member State in which the Data Exporter is established.
- The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.
Cooperation with supervisory authorities
- The Data Exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.
- The parties agree that the supervisory authority has the right to conduct an audit of the Data Importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the Data Exporter under the applicable data protection law.
- The Data Importer shall promptly inform the Data Exporter about the existence of legislation applicable to it or any subprocessor preventing the conduct of an audit of the Data Importer, or any subprocessor, pursuant to paragraph 2. In such a case the Data Exporter shall be entitled to take the measures foreseen in Clause 5 (b).
The Clauses shall be governed by the law of the Member State in which the Data Exporter is established.
Variation of the contract
The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.
- The Data Importer shall not subcontract any of its processing operations performed on behalf of the Data Exporter under the Clauses without the prior written consent of the Data Exporter. Where the Data Importer subcontracts its obligations under the Clauses, with the consent of the Data Exporter, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on the Data Importer under the Clauses (This requirement may be satisfied by the subprocessor co-signing the contract entered into between the Data Exporter and the Data Importer which is based on the terms and conditions of this Agreement.). Where the subprocessor fails to fulfil its data protection obligations under such written agreement the Data Importer shall remain fully liable to the Data Exporter for the performance of the subprocessor's obligations under such agreement.
- The prior written contract between the Data Importer and the subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the Data Exporter or the Data Importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the Data Exporter or Data Importer by contract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
- The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the Data Exporter is established.
- The Data Exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the Data Importer pursuant to Clause 5 (j), which shall be updated at least once a year. The list shall be available to the Data Exporter's data protection supervisory authority.
Obligation after the termination of personal data processing services
- The parties agree that on the termination of the provision of data processing services, the Data Importer and the subprocessor shall, at the choice of the Data Exporter, return all the personal data transferred and the copies thereof to the Data Exporter or shall destroy all the personal data and certify to the Data Exporter that it has done so, unless legislation imposed upon the Data Importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the Data Importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.
- The Data Importer and the subprocessor warrant that upon request of the Data Exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1.
APPENDIX 1 TO THE STANDARD CONTRACTUAL CLAUSES
This Appendix forms part of the Clauses and must be completed and signed by the parties. The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix.
Folsom Labs’ Data Exporters are businesses worldwide who are involved in designing, engineering, and selling solar PV arrays.
Folsom Labs is engaged in providing a platform as-a-service-platform to individuals and companies to use the Software HelioScope. HelioScope is a tool, designated to designers and engineers to plan solar arrays.
The Data subjects are:
Customer’s customers and employees that use Folsom’s services.
Categories of data
The personal data transferred concern the following categories of data:
We collect user data when users create a trial account on HelioScope. This data is necessary to validate the providence of a free 30-day trial:
- First name
- Last name
- Company name
- Email address
- Phone number
Additionally, users input data on the solar projects they are working on. These include the locations of projects, names of customers, engineering details (such as components used in the array, system size, and energy yield calculations), and the costs and revenues generated by the solar plant. This data is intrinsic to the service our product provides (solar design, engineering and sales).
Special categories of data (if appropriate)
The personal data transferred concern the following special categories of data:
We do not collect any special categories of data per the definition in Directive 95/46/EC.
The personal data transferred will be subject to the following basic processing activities:
- User data (especially email address) are saved to enable user login (for those who purchase a license) and to validate future free trials (in order to to prevent abuse of the free trial).
- Project details (engineering, cost, and energy production) are saved for access by the user as they use HelioScope, our design program.
- Energy simulation data is calculated by HelioScope based in part on the project details entered by the user. This is also saved and made available by the user.
- We do have APIs that are made available to third-party developers. However, in order to access any user’s data, these third parties must obtain the user’s explicit permission to download the data (i.e. the user must go into the third party program, and configure the link between the two applications to enable the data sharing). Third parties never obtain customer data without the explicit approval of the user who owns the data.
The personal data is processed and stored for the following retention periods:
- Project data is stored for a reasonable period of time after the trial or subscription ends, in order to ensure continuity of business operations for customers, and as described in Folsom Labs’ Terms of Service.
- Customer emails (specifically business users) are retained for at least two years after the creation of a trial account, as the email address is used to validate the authenticity of a new trial user (and so the data must be maintained in order to prevent trial abuse).
APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES
This Appendix forms part of the Clauses and must be completed and signed by the parties
Description of the technical and organizational security measures implemented by the Data Importer in accordance with Clauses 4(d) and 5(c) and Art. 32 GDPR (or document/legislation attached):
Sub-Processors will be bound to adhere to similar but not identical organizational security measures which shall not fall below the level of data security as agreed herein. Any organizational security measures are subject to change as technical standards evolve and such changes can be implemented by Data Importer. If so requested, data importer will provide data exporter with a description of the then current measures.
Pseudonymisation and Encryption, Art. 32 (1) a) GDPR
Pseudonymisation contains measures that enable one to process personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is stored separately, and is subject to appropriate technical and organizational measures. Encryption contains measures that enable one to convert clearly legible information into an illegible string by means of a cryptographic process.
- Passwords in HelioScope are encrypted in transit, and salted and hashed at rest.
- User data in HelioScope is encrypted in transit, though not at rest.
The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, Art. 32 (1) b) GDPR
Confidentiality and integrity is ensured by the secure processing of personal data, including protection against unauthorized or unlawful processing and against accidental loos, destruction or damage.
Physical access control
Measures that prevent unauthorized persons from gaining access to data processing systems with which personal data are processed or used.
- HelioScope user data is housed on Amazon Web Services, with substantial user access controls to their physical servers.
System/Electronic access control
Measures that prevent data processing systems from being used without authorization.
- HelioScope database access is only allowed from whitelisted IP addresses to prevent unauthorized third-party access to the data.
Internal Access Control
Measures that ensure that persons entitled to use a data processing system have access only to the data to which they have a right of access, and that personal data cannot be read, copied, modified or removed without authorization in the course of processing or use and after storage.
- HelioScope database access is only made available on an as-needed basis among employees internally, and is never made available to any third-parties or external entities.
Measures to ensure that data collected for different purposes can be processed (storage, amendment, deletion, transmission) separately.
- There is only one purpose of the user data (using the HelioScope application), so there is no natural partition in the database.
- When users request that their data is removed, we will run a script to delete their data and confirm deletion.
- Billing data is collected and stored entirely separately (i.e. through a third party).
Measures that ensure that, in the case of commissioned processing of personal data, the data are processed strictly corresponding the instructions of the principal.
- As we have no third-party processing of personal data, there is no procedure in place to manage this process.
- Physical access control
Data transmission control
Measures ensure that personal data cannot be read, copied, modified or removed without authorization during electronic transmission or transport, and that it is possible to check and establish to which bodies the transfer of personal data by means of data transmission facilities is envisaged.
- HelioScope data is encrypted in transit.
Data input control
Measures that ensure that it is possible to check and establish whether and by whom personal data have been input into data processing systems, modified or removed.
- Our database records indicate when personal data was modified or added.
- Data transmission control
Availability and Resilience of Processing Systems and Services
Availability includes measures that ensure that personal data is protected from accidental destruction or loss due to internal or external influences. Resilience of processing systems and services includes measures that ensure the ability to withstand attacks or to quickly restore systems to working order after an attack.
- AWS provides backup infrastructure to withstand attacks or restore after an outage.
The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident, Art. 32 (1) c) GDPR
Organizational measures that ensure the possibility to quickly restore the system or data in the event of a physical or technical incident.
- Our in-house team of engineers monitors the database, in order to quickly restore the data in the event of an incident or outage.
A process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing, Art. 32 (1) d) GDPR
Organizational measures that ensure the regular review and assessment of technical and organizational measures.
- Our engineering team conducts regular reviews of our security procedures in order to ensure that we are conforming to the best state-of-the-art for security processes.