This Dynamo Data Processing Agreement (“DPA”) supplements the Master Terms (available at https://www.dynamosoftware.com/legal/) and is a part of the Agreement between Customer (on behalf of itself and, for purposes of this DPA, as agent for its Affiliates) and Dynamo (on behalf of itself and, for purposes of this DPA, as agent for its Affiliates).
I. Definitions. All capitalized terms used, but not otherwise defined, in this DPA will have the meaning assigned to such term in Exhibit 1: Defined Terms of the Master Terms. In addition, the following capitalized terms will have the meaning assigned to them below:
1. “CCPA” means the California Consumer Privacy Act of 2018, codified at Title 1.81.5 of Part 4 of Division 3 of the California Civil Code, as amended including by the California Privacy Rights Act of 2020 effective January 1, 2023, along with its implementing regulations.
2.“Controller,” Data Subject,” “Processing,” and “Processor” have the meaning given to them in the GDPR, and “Sell” and “Share” have the meaning given to them in the CCPA.
3. “Data Subject Rights” means all rights granted to Data Subjects by Data Protection Law, including the right to know, access, correct, delete, opt-out, limit the use and disclosure of sensitive personal information, and no retaliation.
4.“GDPR” means the General Data Protection Regulation (EU) 2016/679.
5. “Data Protection Laws” means all data protection and privacy Laws applicable to the Processing of Personal Data under the Agreement, including, where relevant, the Gramm-Leach-Bliley Act, the GDPR, UK GDPR, and CCPA and other applicable comprehensive US state data protection laws.
6. “PersonalData” means Processed Data relating to an identified or identifiable natural personal Processed in connection with the Agreement.
7. “Processed Data” means Customer Data that is Processed by Dynamo in delivering the Services.
8. “Restricted Transfer” means a transfer of the processed Data from Customer to Dynamo, from Dynamo to Customer, or from Dynamo to a Subprocessor, in circumstances where such transfer would be prohibited by Data Protection Laws in the absence of the SCCs, the UK Addendum, or other safeguards approved under the GDPR or UK GDPR.
9. “SCCs” means the Standard Contractual Clauses set out in the European Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679, as updated, amended, replaced, or superseded from time to time by the European Commission.
10. “Subprocessor” means a third party engaged by Dynamo to assist it in Processing Processed Data in order to provide the Service on behalf of Customer.
11. “UK Addendum” means the international data transfer addendum to the SCCs issued by the UK Information Commissioner’s Office under S119A(1) of the Data Protection Act 2018.
12. “UK GDPR” means the GDPR as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.
II. Instruction. As between the parties, Customer is the Controller and Dynamo is the Processor of the Personal Data. Dynamo will only Process Personal Data in accordance with Customer’s written instructions, which shall expressly include the instruction to Process Personal Data as specified in the Agreement and as necessary to perform the Service in accordance with applicable Technical Specifications. Dynamo will promptly inform Customer if, in its judgment, an instruction to Dynamo in relation to the Processing of Personal Data violates an applicable Data Protection Law. The parties will each comply with their respective obligations under applicable Data Protection Laws, including, where required, to obtain consent from and supply notice to applicable Data Subjects for the Processing of their Personal Data. Customer will have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data. Where Data Protection Laws not specifically listed in the definition of Data Protection Laws herein apply to Customer’s intended use of the Service, prior to engaging Dynamo, Customer will provide to Dynamo a list of the relevant additional jurisdiction-specific requirements, and Dynamo will advise Customer on the feasibility of the measures needed to comply with such requirements.
III. Confidentiality. Dynamo will ensure that all Dynamo personnel Processing Personal Data are bound by appropriate obligations of confidentiality with respect to such data.
IV. Subprocessors. Customer acknowledges and agrees to Dynamo’s engagement of Subprocessors for the performance of the Service, a current list of which will be supplied upon request. Dynamo may update its list of approved Subprocessors without amendment to this DPA or the Agreement by adhering to the following procedure: Prior to engaging any new Subprocessor, Dynamo will notify Customer and provide Customer with a reasonable opportunity to object. Examples of reasonable bases for objection include where the Subprocessor cannot provide its services in compliance with Data Protection Law, or its use creates a material security risk. In the event of any such reasonable objection, the parties will work in good faith to identify an alternative solution. Dynamo shall enter into a contract with such Subprocessors that includes data protection terms that provide sufficient guarantees in connection with Data Protection Law.
V. Data Subject Rights and Additional Assistance. Dynamo will provide reasonable assistance to Customer in responding to and complying with Data Subject Rights requests in relation to Personal Data, including where applicable through appropriate technical and organizational measures, as required by Data Protection Law. Dynamo shall promptly inform Customer if it receives a Data Subject Rights request respecting Personal Data and shall act on such request only as instructed by Customer or as required by law.
VI. Audits. Dynamo submits to reasonable data security and privacy compliance audits in accordance with Dynamo’s Customer Audit Program and shares audit report results with Customer on request. Dynamo will supply Customer with information necessary to demonstrate compliance with its obligations under Data Protection Law and will notify Customer if it can no longer meet such obligations and take reasonable steps, communicated to Customer, to remediate that.
VII. Incident Notifications. Dynamo will promptly notify Customer after becoming aware of the unauthorized or unlawful destruction, loss, alteration, disclosure of, or access to Processed Data (“Security Incident”) as required by applicable Laws. Dynamo will make reasonable efforts to identify the cause of and remediate the Security Incident.
VIII. Retention and Deletion. Dynamo shall cease Processing and return, archive, or destroy Processed Data in its possession, in accordance with Customer’s instructions, upon termination or expiration of this DPA, unless required by Law or legal process to retain such information for a longer period, in which case the terms of this DPA will survive until such data is returned, archived, or destroyed.
IX. EU SCC 2021.
A. For Personal Data that is subject to the GDPR, and the Service involves transfers of such data outside of the EEA, the SCCs will be incorporated into this DPA and shall apply as follows.
(1) Module 2 (Controller to Processor) shall apply;
(2) Clause 7 (Docking Clause) shall apply;
(3) The parties choose Option 2 of Clause 9;
(4) The option in Clause 11(a) (Redress) does not apply;
(5) The SCCs shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of Ireland;
(6) Per Clause 18(b) of the SCCs, disputes arising under the SCCs shall be resolved in the courts of the same country; and
(7) Annex I to this DPA shall serve as Annex I to the SCCs, and Annex II to this DPA shall serve as Annex II to the SCCs, and Annex III to this Agreement shall serve as Annex III
B. For Personal Data that is subject to the GDPR and the Service does not involve transfers of such data outside of the EEA will be incorporated into this DPA and shall apply as follows:
(1) The parties choose Option 1 of Clause 1 (a);
(2) Clause 5 (Docking Clause) shall apply;
(3) The parties choose Option 2 of Clause 7.7 and the specified time shall be 7 days;
(4) The applicable regulation is the GDPR and the parties choose the options referencing that regulation – Option 1 of Clause 8(c)(4); Clause 9.1 items (b) and (c); and Clause 9.2.;
(5) Annex I, part A to the DPA shall serve as Annex I to the EEA Clauses and Annex I, part B to the DPA shall serve as Annex II to the EEA Clauses;
(6) Annex II to the DPA shall serve as Annex III to the EEA Clauses, and Annex III to the DPA shall serve as Annex III to the EEA Clauses;
(7) References to “Data exporter” in the Annexes to the DPA shall be interpreted as references to “Controller” and references to “Data exporter” shall be interpreted as references to “Processor” in the Annexes to the EEA Clauses.
X. UK Addendum. Wherever Personal Data is transferred outside of the United Kingdom, the UK Addendum will be incorporated into this DPA and shall apply in the same way as the SCCs, except for Sections 17 and 18 which shall not be modified and will refer to the laws and/or courts of England and Wales.
XI. Switzerland Addendum. For transfer of Personal Data that is subject to the Swiss Federal Act on Data Protection (“FADP”), the SCCs shall be deemed to be amended to the extent necessary to operate to provide appropriate safeguards for such transfers in accordance with the FADP, including without limitation the following:
(1) Clause 13(a) and Part C of Annex I are not used; the “competent supervisory authority” is the Federal Data Protection and Information Commissioner;
(2) The term “Member State” cannot be interpreted to exclude data subjects in Switzerland from exercising their rights under FADP;
(3) The term “personal data” shall be deemed to include the data of legal entities to the extent such data is protected under the FADP; and
(4) Any amendments required from time to time by the Federal Data Protection and Information Commissioner in order to comply with the FADP.
XII. Additional CCPA Terms. The parties acknowledge and agree that the Service is intended for business-to-business (B2B) relationship purposes and nothing in the normal use of the Service requires the processing of Personal Data beyond business contact details. To the extent the CCPA is applicable to Dynamo’s Processing of Personal Data, Dynamo will not (1) Sell or Share Personal Data; (2) retain, use, or disclose Personal Data for any purpose other than for the limited and specific business purpose of providing the Service pursuant to the Agreement; or (3) combine Personal Data with any personal information that is received from or on behalf of any third party or collected via Dynamo’s own interaction with an individual, unless permitted by the applicable Laws.
XII. Integration. Except as provided herein, this DPA is binding on Dynamo and Customer if and to the extent the Agreement remains in effect. Except to the extent expressly agreed in the Agreement, this DPA shall not create third party beneficiary rights. Dynamo does not accept or submit to additional requirements relating to Processed Data, except as specifically and expressly agreed in writing with explicit reference to the Master Terms and this DPA.
XIV. Security. Dynamo applies technical, administrative, and organizational data security measures (“TOMs”) for the protection of Processed Data that meet or exceed the following commitments. Dynamo may update and modify its TOMs from time to time, provided that Dynamo must not reduce the level of security provided thereunder, except with Customer’s consent or with 60 days prior written notice.
1. Policies and Procedures
Dynamo maintains policies and procedures to ensure the confidentiality, integrity, and availability of Processed Data and protect it from accidental, unauthorized, or improper disclosure, use, alteration, or destruction (the “Security Program”).
2. Access Controls
Dynamo maintains policies, procedures, and operational processes that:
2.1. limit physical access to Processed Data and the facility or facilities in which it is stored to properly authorized persons;
2.2. ensure that all members of the Dynamo workforce (including contractors) who require access to Processed Data have appropriately controlled access, and to prevent those workforce members and others who should not have access from obtaining access;
2.3. authenticate and permit access only to authorized individuals and prevent members of Dynamo workforce from providing Processed Data or information relating thereto to unauthorized individuals;
2.4. restrict access to Processed Data to only those people with a “need-to-know” for a permitted purpose;
2.5. maintain a list of people and services with access to Processed Data in the Dynamo application, and remove accounts that no longer require access;
2.6. maintain and enforce “account lockout” by disabling accounts with access to Processed Data when an account exceeds a threshold number of consecutive incorrect password attempts;
2.7. regularly review access logs for signs of malicious behavior or unauthorized access.
3. Security Awareness and Training
Dynamo maintains an ongoing security awareness and training program for all members of Dynamo’s workforce (including contractors and management).
4. Security Incident Procedures
Dynamo maintains policies and procedures to detect, respond to, and otherwise address security incidents, including procedures to monitor systems and to detect actual and attempted attacks on or intrusions into Processed Data or information systems relating thereto, and procedures to identify and respond to suspected or known security incidents, mitigate harmful effects of security incidents, and document security incidents and their outcomes. If Dynamo becomes aware of any security incident that leads to a data breach impacting Processed Data, Dynamo will:
4.1. notify Customer without undue delay; and
4.2. reasonably cooperate with Customer to investigate and remediate the breach and mitigate any further risk to Processed Data.
5. Contingency Planning
Dynamo maintains policies, procedures, and operational processes for responding to an emergency, or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages Processed Data or systems that contain Processed Data.
6. Device and Media Controls
Dynamo does not permit Processed Data to be downloaded or otherwise stored on laptops or other portable devices, unless such devices are subject to all of the protections required herein. Such protective measures shall include, at a minimum, that all devices accessing Processed Data shall be encrypted and use up-to-date anti-malware detection prevention software.
7. Audit Controls
Dynamo maintains hardware, software, services, platforms and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic information, including appropriate logs and reports concerning these security requirements and compliance therewith.
8. Storage and Transmission Security
Dynamo maintains technical security measures to guard against unauthorized access to Processed Data that is being transmitted over an electronic communications network. Dynamo will:
8.1. maintain a working network firewall to protect data accessible via the Internet and will keep all Dynamo Information protected by the firewall at all times;
8.2. use anti-malware software at all times and will keep the anti-malware software up to date;
8.3. maintain technical and security measures to encrypt Processed Data in transit and at rest;
8.4. regularly review access logs for signs of malicious behavior or unauthorized access;
8.5. keep Dynamo’s systems and software up-to-date with the latest applicable upgrades, updates, new versions, and other modifications necessary to ensure security of Processed Data.
9. Assigned Security Responsibility
Dynamo has a designated security official responsible for the development, implementation, and maintenance of the Security Program.
10. Testing
Dynamo regularly tests key controls, systems and procedures of Dynamo’s Security Program to ensure that they are properly implemented and effective in addressing the threats and risks identified.
11. Third Party Dynamo Management
Dynamo may use third party vendors in support of Dynamo’s services to Customers. Dynamo performs a security and privacy risk-based assessment of prospective vendors before working with vendors to validate that they meet Dynamo’s privacy and security standards.
12. Disclosure by Law
In the event Dynamo is required by law, regulation, or legal process to disclose any Processed Data, Dynamo will (a) give Customer, to the extent possible, reasonable advance notice prior to disclosure so Customer may contest the disclosure or seek a protective order, and (b) reasonably limit the disclosure to the minimum amount that is legally required to be disclosed.
13. Updates
Dynamo continually monitors, evaluates, and adjusts, as appropriate, the Security Program in light of any relevant changes in technology or industry security standards, the sensitivity of the Processed Data, and internal or external threats to Processed Data.