Data Protection Addendum
Last Updated Date: June 30, 2023
This Data Protection Addendum (the “Addendum”) applies to the processing of Personal Data by Donut Technologies Inc. (“Donut”) including, without limitation, Personal Data relating to data subjects located in the European Economic Area (“EEA”) or otherwise processed subject to the EU GDPR or data subjects located in Switzerland (“EU Personal Data”), data subjects located in the United Kingdom (“UK”) or otherwise processed subject to the UK GDPR (“UK Personal Data”) and individuals located in California (“CA Personal Data”). For this Addendum’s purposes, EU Personal Data and UK Personal Data are collectively referred to as “European Personal Data.”
“Controller”, “Processor”, “data subject” and “process” have the meanings given in the relevant Data Protection Requirements (as defined below). The term “Supervisory Authority” means (a) in the context of the UK and the UK GDPR (as defined below), the UK Information Commissioner’s Office; and/or (b) in the context of the EEA and EU GDPR (as defined below), the definition of that term in Article 4(21) of the EU GDPR. “Consumer”, “business”, “sale”, and “service provider” shall have the meaning given in the CCPA (as defined below). “Personal Data” means (a) the “personal data” (as defined in GDPR) that Customer provides to Donut for the provision of the Services and (b) any other information that Customer provides to Donut for the provision of the Services that constitutes “personal information” under and governed by the CCPA (as defined below). The term “Data Subject Request” means the exercise of rights by a data subject of Personal Data made under and in accordance with applicable Data Protection Requirements. The term “EU Restricted Transfer” means a transfer of EU Personal Data to any person in a Restricted Country, which would be prohibited without a legal basis therefor under Chapter V of the EU GDPR. The term “Standard Contractual Clauses” means the standard contractual clauses adopted by the European Commission under Article 46 of the EU GDPR for the transfer of Personal Data from data exporters in the EEA to data importers in third countries pursuant to implementing Decision (EU) 2021/914 (a populated copy of which including details specific to this Addendum can be found here). The term “Relevant Body” means (a) in the context of the UK and the UK GDPR, the UK Government; and/or (b) in the context of the EEA and EU GDPR, the European Commission. The term “Restricted Country” means (a) in the context of the UK, a country or territory outside the UK; and/or (b) in the context of the EEA, means a country or territory outside the EEA, that the Relevant Body has not deemed to provide an ‘adequate’ level of protection for Personal Data pursuant to a decision made in accordance with Article 45 of the GDPR. The term “Restricted Transfer” means (a) an EU Restricted Transfer; and or (b) a UK Restricted Transfer, as the context requires. The term “UK Restricted Transfer” means a transfer of UK Personal Data to any person in a Restricted Country, which would be prohibited without a legal basis therefor under Chapter V of the UK GDPR. The term “UK Transfer Addendum” means the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of the UK Mandatory Clauses included in Part 2 thereof (the “UK Mandatory Clauses”).
As between the parties, with regard to European Personal Data, Customer is a Controller or Processor and Donut may be either a Processor or a subprocessor for a Customer.
As between the parties, with regard to CA Personal Data, Customer is a business and Donut is a service provider.
Donut reserves the right to modify this Addendum in order to comply with applicable law and regulation. To the extent that Donut modifies this Addendum in order to ensure such compliance, Donut will provide notice to Customer of the modifications, and Customer’s continued use of the Services will constitute Customer’s agreement to those modifications. Donut may provide that notice in a variety of ways, including, among other things, sending Customer an email, posting a notice on the Service itself, or by posting the revised Addendum on Donut’s website and revising the date at the top of this Addendum.
1. Nature of Data Processing.
The subject matter of the data processing, including the processing operations carried out by Donut on behalf of Customer and Customer’s data processing instructions for Donut, will be described in the Agreement, this Addendum, and each statement of work, order form, or equivalent document where Customer orders Services from Donut, which form integral parts of the Agreement.
Categories of data subjects: Individuals who may use Donut’s Services as provided to Customer under the Agreement.
Types of Personal Data processed: Personal Data provided by Customer to Donut in connection with the Agreement, including name, surname, email address, other profile information, and content of messages sent by data subjects in connection with the Services under the Agreement.
2. Compliance with Laws.
The parties shall each comply with their respective obligations under all applicable laws, regulations, and other legal requirements relating to (i) privacy and data security; and (ii) the use, collection, retention, storage, security, disclosure, transfer, disposal, and other processing of any Personal Data (“Privacy Laws”), including, without limitation, the California Consumer Privacy Act of 2018 (as amended) (“CCPA”). With regard to European Personal Data, the parties will comply with each of their respective obligations under (i) the European Union Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “General Data Protection Regulation” or “EU GDPR”) and any subordinate legislation and regulation implementing the EU GDPR which may apply; and (ii) the EU GDPR as it forms part of United Kingdom law by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended (“UK GDPR”) (collectively, with Privacy Laws, the “Data Protection Requirements”). Together, the EU GDPR and UK GDPR shall be referred to as the “GDPR.” References to “Articles” and “Chapters” of the GDPR shall be construed accordingly.
3. Customer Obligations.
provide instruction to Donut and determine the purposes and general means of Donut’s processing of Personal Data on behalf of Customer under the Agreement; and
comply with its personal data protection, data security and other obligations prescribed by Data Protection Requirements for Controllers by, without limitation, meeting its obligations under Data Protection Requirements to:
- establish and maintain a procedure for the exercise of the rights of the individuals whose Personal Data Donut processes on behalf of Customer;
- as required by Data Protection Requirements, provide notice and obtain consent from the individuals whose Personal Data Donut processes on behalf of Customer;
- establish or ensure that another party has established a legal basis for Donut’s processing of Personal Data contemplated by this Addendum;
- process only data that have been lawfully and validly collected and ensure that such data will be relevant and proportionate to the respective uses; and
- ensure compliance with the provisions of this Addendum by its personnel and by any person accessing or using Personal Data on its behalf.
By entering into this Addendum, Customer instructs Donut to process Customer Personal Data only in accordance with applicable law: (a) to provide the Services; (b) as authorised by the Agreement, including this Addendum; and (c) as further documented in any other written instructions given by Customer and acknowledged in writing by Donut as constituting instructions for purposes of this Addendum.
4. Donut Obligations.
Donut, in its capacity as a Processor or subprocessor of Personal Data, shall:
- process Personal Data solely for the purposes of providing the Services as described in the Agreement (which shall encompass the processing authorized by Customer’s instructions), and in compliance with the instructions received from Customer and the Agreement;
- not sell any CA Personal Data or retain, use or disclose CA Personal Data outside of the direct business relationship between Donut and Customer;
- inform Customer immediately if, in Donut’s opinion, an instruction from Customer violates applicable Data Protection Requirements;
- adopt and maintain appropriate security measures including organizational and technical measures (the “Security Measures“), designed to maintain a level of security appropriate to the risks presented by processing the Personal Data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons;
- grant access to Personal Data only to personnel who need such access for the scope of their job duties, and are subject to appropriate confidentiality arrangements;
- if it intends to engage one or more third parties acting on its behalf (“subprocessor”) to help it to satisfy its obligations in accordance with this Addendum or to delegate all or part of the processing activities to such subprocessors, (i) remain responsible, and liable, to Customer for the subprocessors’ acts and omissions with regard to data protection; and (ii) enter into contractual arrangements with such subprocessors requiring them to provide a substantially similar level of data protection compliance and information security to that provided for herein. Subject to the requirements of this Section 4.1(6), Customer hereby generally authorizes the engagement of subprocessors. Information about subprocessors is available at https://help.donut.ai/en/articles/4120017-do-you-use-any-subprocessors (as may be updated by Donut from time to time). When any new subprocessor is engaged during the term of the Agreement, Donut will notify Customer of the engagement by updating this website and providing notice of its update(s) to the website via the Services’ dashboard for Customer’s administrative users, each at least 15 days before the new subprocessor processes Personal Data. If Customer objects to such engagement in a written notice to Donut within 15 days of being informed thereof on reasonable grounds relating to the protection of Personal Data, Donut and Customer will work together in good faith to find a mutually acceptable resolution to address such objection. If the parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, Customer may, as its sole and exclusive remedy, terminate the Agreement and cancel the Services by providing written notice to Donut. If Customer does not object to Donut’s appointment of a subprocessor during the 15-day period referred to in Section 4.1(6), Customer shall be deemed to have approved Donut’s engagement and ongoing use of that subprocessor.
Donut shall inform Customer without delay if Donut becomes aware of:
- any legally binding request for disclosure of Personal Data by a law enforcement authority; or
- any notice, inquiry or investigation by a Supervisory Authority with respect to Personal Data.
Donut further agrees to notify Customer of any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data in Donut’s possession, custody or control (“Personal Data Breach”) without undue delay and in any event within 72 hours of becoming aware of a Personal Data Breach. Personal Data Breaches do not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.
Donut shall reasonably assist Customer regarding:
- any requests from data subjects in respect of access to or the rectification, erasure, restriction, portability, blocking or deletion of Personal Data. In the event that a data subject sends such a request directly to Donut, Donut will direct the data subject to submit such request to Customer directly, and Customer shall be responsible for responding to such requests. Where relevant, Customer acknowledges and agrees, both generally and specifically for the purpose of Clause 10(a) of Module Three of the Standard Contractual Clauses, that there are no circumstances in which it would be appropriate for Donut to notify any third-party controller of any data subject request and that any such notification shall be the Customer’s responsibility;
- the investigation of Personal Data Breaches and the notification to the Supervisory Authority and data subjects in respect of such breaches by providing available details of the Personal Data breaches, including steps Donut has taken to mitigate the potential risks and steps Donuts recommends Customer take to address the Information Security Incident; and
- the preparation of data protection impact assessments and, where applicable, carrying out consultations with any Supervisory Authority.
For the purposes of Clause 15.1(a) of the Standard Contractual Clauses, except to the extent prohibited by applicable law and/or the relevant public authority, as between the Parties, Customer agrees that it shall be solely responsible for making any notifications to relevant Data Subject(s) if and as required thereunder.
If Donut is required by Data Protection Requirements to process any Personal Data other than as set forth in this Addendum, Donut shall inform Customer of this requirement in advance of any processing, unless Donut is legally prohibited from informing Customer of such processing.
5. Audit; Certification.
Customer may audit Donut’s compliance with this Addendum up to once per year and on such other occasions as may be required by Data Protection Requirements. Donut will cooperate with the audit by providing Customer or Customer’s Supervisory Authority with the information and assistance reasonably necessary to conduct the audit. Customer will reimburse Donut for its reasonable expenses incurred to cooperate with such an audit. The audit must be conducted during regular business hours, subject to an agreed upon audit plan and Donut’s safety, security or other relevant policies, and may not unreasonably interfere with Donut’s business activities. Donut shall not be required to breach any duties of confidentiality in connection with such audit, and Customer may use the audit reports only for the purposes of meeting Customer’s regulatory audit requirements and/or confirming compliance with the requirements of this Addendum.
6. Data Transfers.
- Donut is located in the United States and may store and process Personal Data in the United States or anywhere Donut or its subprocessors maintains facilities. Accordingly, Customer acknowledges that certain Restricted Transfers may be effected under this Addendum. The provisions of this Section 6 shall apply to any such Restricted Transfers (if and as applicable, having regard to the nature of those transfers and the application or otherwise of Chapter V of the EU GDPR and/or UK GDPR).
- The Standard Contractual Clauses referred to in this Section 6 shall only have effect if and to the extent permitted and required under the EU GDPR and/or UK GDPR to establish a valid basis under Chapter V of the EU GDPR and/or UK GDPR (if and as applicable) in respect of the transfer to Donut of Personal Data.
- Notwithstanding the foregoing, the Standard Contractual Clauses (or obligations the same as those under the Standard Contractual Clauses) will not apply to the extent an alternative recognized compliance standard for the lawful transfer of European Personal Data outside the EEA or UK Personal Data outside the UK (e.g., binding corporate rules) applies to a Restricted Transfer.
6.2 EU Restricted Transfers.
- To the extent that any processing of European Personal Data under this Addendum involves an EU Restricted Transfer, the parties shall comply with their respective obligations set out in the Standard Contractual Clauses, which are hereby deemed to be entered into by the Parties, incorporated by reference into this Addendum and signed by the Parties by their entry into the Agreement in accordance with its terms.
- The following modules of the Standard Contractual Clauses apply in the manner set out below (having regard to the Customer’s role):
- Module 2 of the Standard Contractual Clauses applies to any Restricted Transfer involving processing of European Personal Data in respect of which Customer is a Controller in its own right; and/or
- Module 3 of the Standard Contractual Clauses applies to any Restricted Transfer involving processing of European Personal Data in respect of which Customer is itself acting as a processor on behalf of any other person.
6.3 UK Restricted Transfers
- To the extent that any processing of UK Personal Data under this Addendum involves an UK Restricted Transfer, the parties shall comply with their respective obligations set out in the Standard Contractual Clauses, which are hereby deemed to be:
- varied to address the requirements of the UK GDPR in accordance with the UK Transfer Addendum in the manner set out in 6.3(2), below; and
- entered into by the Parties, incorporated by reference into this Addendum and signed by the Parties by their entry into the Agreement in accordance with its terms.
- Where relevant, the Standard Contractual Clauses shall apply to any UK Restricted Transfers as varied by the UK Transfer Addendum in the following manner:
- ‘Part 1 to the UK Transfer Addendum’: (A) the Parties agree: Tables 1, 2 and 3 to the UK Transfer Addendum are deemed populated with the corresponding details (i.e., Appendix Information) set out in Annex I and Annex II to the Standard Contractual Clauses; and (B) Table 4 to the UK Transfer Addendum is completed with ‘Data Importer’ only; and
- ‘Part 2 to the UK Transfer Addendum’: the Parties agree to be bound by the UK Mandatory Clauses of the UK Transfer Addendum and that the Standard Contractual Clauses shall apply to any UK Restricted Transfers as varied in accordance with those Mandatory Clauses.
- As permitted by section 17 of the UK Mandatory Clauses, the Parties agree to the presentation of the information required by ‘Part 1: Tables’ of the UK Transfer Addendum in the manner set out in 6.3(2), above; provided that the Parties further agree that nothing in the manner of that presentation shall operate or be construed so as to reduce the Appropriate Safeguards (as defined in section 3 of the UK Mandatory Clauses).
- In relation to any UK Restricted Transfer to which they apply, where the context permits and requires, any reference in the Addendum to the Standard Contractual Clauses, shall be read as a reference to those Standard Contractual Clauses as varied in the manner set out in this Section 6.2.
This Addendum shall remain in effect as long as Donut carries out Personal Data processing operations on behalf of Customer or until the termination of the Agreement and all associated order forms (and all Personal Data has been returned or deleted in accordance with section 9 below).
9. Data Return and Deletion.
The parties agree that upon the expiration or termination of the Agreement, Donut shall securely destroy all Personal Data and, at the request of Customer, certify that it has taken such measures, unless applicable laws prevent Donut from returning or destroying all or part of the Personal Data disclosed. In such case, Donut agrees to preserve the confidentiality of the Personal Data retained by it and that it will only actively process such Personal Data after such date in order to comply with the laws it is subject to.
The total combined liability of either party towards the other party, whether in contract, tort or any other theory of liability, under or in connection with this Addendum and the Standard Contractual Clauses (if entered into as described in Section 6 of this Addendum) combined will be limited to the liability limitations or other liability caps agreed to by the parties in the Agreement.
Notwithstanding the foregoing, nothing in this Section 10 will affect any party’s liability to data subjects under the third-party beneficiary provisions of the Standard Contractual Clauses to the extent the limitation of such rights is prohibited by Privacy Laws or Local Data Protection Laws, where applicable.
11. Precedence and Application of Standard Contractual Clauses.
- In the event of any conflict or inconsistency between:
- this Addendum and the Agreement, this Addendum shall prevail to the extent of such conflict or inconsistency; or
- any Standard Contractual Clauses that apply pursuant to Section 6 and this Addendum and/or the Agreement, those Standard Contractual Clauses shall prevail in the context of the Restricted Transfer(s) to which they apply to the extent of such conflict or inconsistency; provided that, in order to establish the operational clarity in relation to certain provisions of the Standard Contractual Clauses, it is agreed that the following shall apply when complying with its transparency obligations under Clause 8.3 of the Standard Contractual Clauses, Customer agrees that it shall not provide or otherwise make available, and shall take all appropriate steps to protect, Donut’s and its licensors trade secrets, business secrets, confidential information and/or other commercially sensitive information;
- the audits described in Clauses 8.9(c) and 8.9(d) of the Standard Contractual Clauses shall be performed in accordance with Section 5 of this Addendum and shall be subject to any relevant conditions, limitations or restrictions therein;
- in respect of subprocessors
- any approval by Customer of Donut’s appointment of a subprocessor that is given expressly or deemed given pursuant to Section 4.1 constitutes Customer’s documented instructions to effect onwards transfers to any relevant subprocessors if and as required under Clause 8.8 of the Standard Contractual Clauses;
- for the purposes of Clause 9(a) of the Standard Contractual Clauses, the Parties are deemed to have selected Option 2, and the timeframe for advance notice of intended changes is as set out in Section 4.1; and
- the terms and conditions of Section 4.1 apply generally to Donut’s appointment and use of subprocessors for the purposes of both sets of Standard Contractual Clauses.
- certification of deletion of Personal Data as described Clauses 8.5 and 16(d) of the Standard Contractual Clauses shall be provided upon Customer’s written request.