This Data Processing Agreement (“Agreement”) is made and entered into as of active signup by and between:
FogHosted Global Technologies, and the client.
- FogHosted, (“Data Processor”).
WHEREAS, the Data Controller wishes to engage the Data Processor to process specific personal data on its behalf in connection with the services that the Data Processor provides.
NOW, THEREFORE, in consideration of the mutual covenants herein contained, the parties agree as follows:
Definitions
1.1 Personal Data means any information relating to an identified or identifiable natural person, including but not limited to names, email addresses, and payment information.
1.2 Processing means any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, erasure, or destruction.
1.3 Data Subject means an identified or identifiable natural person to whom the Personal Data relates.
1.4 Applicable Data Protection Law means all applicable laws and regulations relating to the processing of Personal Data, including but not limited to the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the California Consumer Privacy Act (“CCPA”), and any other applicable privacy legislation.
2. Subject Matter of Processing
2.1 The Data Processor shall process Personal Data on behalf of the Data Controller for the following purposes: customer relationship management and payment processing.
3. Nature and Purpose of Processing
3.1 The Data Processor shall process Personal Data to provide services to the Data Controller, including but not limited to:
- Managing customer relationships
- Processing payments
4. Types of Personal Data
4.1 The Data Processor shall process the following types of Personal Data:
- Personal customer data
- Email addresses
- Payment information
5. Obligations of the Data Processor
5.1 The Data Processor shall:
- Process Personal Data only on documented instructions from the Data Controller, unless required to do so by law.
- Ensure that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
- Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including, as appropriate:
- The pseudonymization and encryption of Personal Data
- The ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services
- The ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident
- A process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
- Assist the Data Controller in ensuring compliance with its obligations under Applicable Data Protection Law, including but not limited to:
- The right of Data Subjects to access their Personal Data
- The right of Data Subjects to rectify inaccurate Personal Data
- The right of Data Subjects to erase Personal Data
- The right of Data Subjects to restrict processing
- The right of Data Subjects to data portability
- Notify the Data Controller without undue delay upon becoming aware of a personal data breach.
- At the choice of the Data Controller, delete or return all Personal Data to the Data Controller after the end of the provision of services relating to processing, and delete existing copies unless applicable law requires storage of the Personal Data.
6. Sub-Processing
6.1 The Data Processor shall not engage another processor (“Sub-Processor”) without prior specific or general written authorization of the Data Controller.
6.2 In the case of general written authorization, the Data Processor shall inform the Data Controller of any intended changes concerning the addition or replacement of Sub-Processors, thereby allowing the Data Controller to object to such changes.
6.3 The Data Processor shall ensure that any Sub-Processor is bound by data protection obligations that are no less protective than those set out in this Agreement.
7. International Data Transfers
7.1 The Data Processor shall not transfer Personal Data outside the jurisdiction without the prior written consent of the Data Controller and shall ensure that any such transfer complies with Applicable Data Protection Law.
8. Audit Rights
8.1 The Data Controller shall have the right to conduct audits or inspections of the Data Processor’s processing activities to ensure compliance with this Agreement and Applicable Data Protection Law.
9. Liability and Indemnity
9.1 Each party shall be liable for any damage caused by processing that infringes Applicable Data Protection Law.
9.2 The Data Processor shall indemnify the Data Controller against any claims, losses, damages, or expenses arising from a breach of this Agreement or Applicable Data Protection Law by the Data Processor.
10. Governing Law
11. Miscellaneous
11.1 This Agreement constitutes the entire agreement between the parties regarding the subject matter hereof and supersedes all prior agreements and understandings.
11.2 If any provision of this Agreement is found to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.
IN WITNESS WHEREOF, the parties hereto have executed this Data Processing Agreement as of the date of active signup
Data Controller: FogHosted Global Technologies
