ANNEX I TO THE CLAUSES

A. LIST OF PARTIES

Data exporter(s)

Name and Address: Customer, as described in the Agreement and its applicable Affiliates

Contact person’s name, position and contact details: The Subscription Administrator listed in the Order Form, unless otherwise agreed in writing

Activities relevant to the data transferred under these Clauses:  as described in the Agreement and applicable Order Form

Signature and date: same as in the applicable Order Form

Role (controller/processor): controller

Data importer(s)

Name and Address: Dynamo, as described in the Agreement and its applicable Affiliates

Contact person’s name, position and contact details: Dynamo’s Privacy Officer (as designated by Dynamo), privacy@dynamosoftware.com

Activities relevant to the data transferred under these Clauses: as described in the Agreement and applicable Order Form

Signature and date: same as in the applicable Order Form

Role (controller/processor): processor

B. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred

Customer’s Users, Investors, investees, representatives of actual and prospective transaction counterparties and other business contacts.

Categories of personal data transferred

All categories of personal data related to the processing associated with the Services provided by Dynamo, which may include and is not limited to:

  • Personal identification data (name, title, address (professional/private), previous addresses, telephone number (professional/private), characteristics)
  • Professional activities of the Data Subject (type of activities, nature of goods or services used or supplied by the Data Subject, business relations)
  • Professional qualifications (which may include licenses, certificates and professional trainings)
  • Professional experience (which may also include professional interests, research interests, academic interests, teaching experience)
  • Current occupation (employer, work place, specialization or type of company, previous experiences with current employer)

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

Nothing in the ordinary use of the Service suggests a need to transfer or otherwise process sensitive data. Dynamo does not control the categories of data that Customer enters into the Dynamo application but the permissioning capabilities of the application allow Customer to limit access to such personal data only to persons who have a business need to access it.  To the extent Customer uses the Service to process sensitive data, it has to provide confidentiality training of such personnel and use a data minimization approach in determining the categories of transferred personal data. Dynamo has also implemented additional security measures set forth in Annex II (in addition to the TOMs described in the DPA).

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).

Continuous basis while Dynamo continues to provide its Services.

Nature of the processing

Dynamo processes personal data in the context of providing the Services to Customer as further described in the Agreement.

Purpose(s) of the data transfer and further processing

The purpose of the data transfer and further processing is to enable Dynamo to provide the Services to Customer as set forth in the Agreement.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

While performing the Services and as required by applicable laws.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

N/A except for hosting, and except as stipulated in the Agreement.

C. COMPETENT SUPERVISORY AUTHORITY

Identify the competent supervisory authority/ies in accordance with Clause 13

The supervisory authority/ies of the following countries:

Where Dynamo Processes Customer Personal Data originating from the EEA, the competent supervisory authority shall be determined in accordance with Clause 13 of the Standard Contractual Clauses.

Where Dynamo Processes Customer Personal Data originating from the UK, the competent supervisory authority shall be the UK Information Commissioner’s Office.

 

ANNEX II – TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

Measures of pseudonymisation and encryption of personal data

  • Encryption of data at rest at the disk layer in the production and backup environments.  Within the application, data in Dynamo’s SQL database can be encrypted at the data field level (a choice which is controlled and managed by client administrators).

Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services

  • Access to all systems and data is controlled by a number of evolving controls documented in Dynamo’s Information Security Policy. 

Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident

  • System redundancy is accomplished through resiliency mechanisms as documented in Dynamo’s Business Continuity and Disaster Recovery Plan.

Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing

  •  Internal and external controls and tests (e.g. SOC 2 review) are performed in accordance with Dynamo’s Information Technology and Information Security policies.

 Measures for user identification and authorisation

  • Controlled access to customer production environment with multi-factor authentication and user authorization levels and limited access supported.

Measures for the protection of data during transmission

  • Encryption of data in transit between the Dynamo application and the clients, using TLS 1.2.

Measures for the protection of data during storage

  • Encryption of data at rest at the disk layer in the production and backup environments. Within the application, data in Dynamo’s SQL database can be encrypted at the data field level (a choice which is controlled and managed by client administrators).

Measures for ensuring physical security of locations at which personal data are processed

  • Secured data center and office location with key card access, access logs, and periodic review of access.

Measures for ensuring events logging

  • Sys log file capture for all platform information and changes. Administrator logs for user access, field changes, etc.

 

Measures for internal IT and IT security governance and management

  • An overlapping system of policies, procedures and controls with regular training and testing.

Measures for certification/assurance of processes and products

  • Internal and external party reviews of security environment, training, and processes.

Measures for ensuring limited data retention

  • Deletion of data options provided inside the application.

 

ANNEX III – LIST OF SUB-PROCESSORS

Customer has authorised the use of sub-processors as described in the Agreement.