Scope and incorporation
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the customer (“Controller”) and Eyeleven Inc. (“Processor”) and applies to the extent that the Processor processes Customer Personal Data on the Controller's behalf.
Where the GDPR, UK GDPR, Swiss FADP, or a United States state privacy law applies to that processing, this DPA governs it. In the event of a conflict on the subject of personal data processing, this DPA prevails over the Terms of Service.
This DPA is executed by the parties' acceptance of the Terms of Service; a separately signed copy is available on request for procurement purposes.
Definitions
- “Customer Personal Data” means personal data contained in Customer Data that the Processor processes on the Controller's behalf
- “Data Subject”, “processing”, “controller”, “processor”, and “personal data breach” have the meanings given in the GDPR
- “Sub-processor” means a third party engaged by the Processor to process Customer Personal Data
- “SCCs” means the Standard Contractual Clauses approved by European Commission Decision 2021/914
- “Applicable Data Protection Law” means the GDPR, UK GDPR, Swiss FADP, and applicable United States state privacy laws
Roles of the parties
The Controller determines the purposes and means of processing Customer Personal Data and is responsible for the lawfulness of the instructions it gives, including having a valid legal basis and any required opt-in for messaging the data subjects whose data it submits.
The Processor processes Customer Personal Data only as a processor, on the Controller's documented instructions. For its own business purposes — such as account administration, billing, and securing the Service — the Processor acts as a controller under its Privacy Policy.
Where United States state privacy law applies, the Processor acts as a “service provider” or “processor” and will not sell Customer Personal Data, share it for cross-context behavioural advertising, retain or use it outside the direct business relationship, or combine it with data from other sources except as permitted by law.
Processing instructions
The Terms of Service, this DPA, the Controller's configuration of the Service, and its documented requests constitute the Controller's complete instructions. The Processor will not process Customer Personal Data for any other purpose.
The Processor will inform the Controller if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend performance of that instruction until it is amended or confirmed. The Processor is not obliged to provide a legal assessment of the Controller's instructions.
Details of processing
- Subject matter: provision of the Eyeleven OS AI workforce platform
- Duration: the term of the subscription, plus the deletion periods in this DPA
- Nature and purpose: hosting, storage, transmission, retrieval, and AI-assisted processing of messages and business records to operate the Controller's configured agents
- Categories of data subjects: the Controller's personnel, customers, prospects, and other contacts who communicate with the Controller
- Categories of personal data: identifiers, contact details, message content and metadata, account and configuration data, usage and technical data
- Special categories: not requested and not required; the Controller must not submit special category data unless expressly agreed in writing, and the Service is not configured for it
- Frequency: continuous, for the duration of the subscription
Confidentiality and personnel
The Processor ensures that personnel authorised to process Customer Personal Data are bound by written confidentiality obligations that survive termination of their engagement, receive appropriate data protection training, and access data only on a need-to-know basis under least-privilege controls.
Security measures
The Processor implements and maintains the technical and organisational measures described in the Security Overview, which is incorporated into this DPA as Annex II. Those measures include encryption in transit and at rest, role-based and least-privilege access control, network isolation, audit logging, monitored error reporting, secure development practices, and a documented incident response process.
The Processor may update its measures over time, provided the overall level of security is not materially reduced.
Sub-processors
The Controller grants general written authorisation for the Processor to engage Sub-processors. The current Sub-processors are published in the Sub-processor List, which forms part of this DPA.
The Processor will give at least thirty days' notice before adding or replacing a Sub-processor by updating that list and, for customers who subscribe to notifications, by email. The Controller may object on reasonable data protection grounds within that period; if the objection cannot be resolved, the Controller may terminate the affected subscription and receive a pro-rata refund of prepaid, unused fees.
The Processor imposes data protection obligations on each Sub-processor that are no less protective than those in this DPA, and remains liable for its Sub-processors' performance.
Data subject requests and assistance
The Service provides the Controller with functionality to access, correct, export, and delete Customer Personal Data. Where the Controller cannot fulfil a data subject request using that functionality, the Processor will provide reasonable assistance at the Controller's cost for work beyond the ordinary.
If the Processor receives a request directly from a data subject relating to Customer Personal Data, it will not respond substantively and will refer the request to the Controller without undue delay.
The Processor will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, to the extent the Controller cannot obtain the necessary information from the documentation the Processor publishes.
Personal data breach notification
The Processor will notify the Controller without undue delay, and in any event within seventy-two hours, after becoming aware of a personal data breach affecting Customer Personal Data. Notification will be sent to the security contact on the Controller's account.
The notification will describe the nature of the breach, the categories and approximate volume of data and data subjects affected, the likely consequences, and the measures taken or proposed. Where the information is not all available at once, it will be provided in phases without further undue delay.
The Processor will not delay notification in order to complete its investigation, and will cooperate with the Controller's own regulatory notification obligations. Notification is not an acknowledgement of fault or liability.
International transfers
The Processor is located in the United States. Where the Controller's transfer of Customer Personal Data to the Processor from the EEA, the United Kingdom, or Switzerland requires a transfer mechanism, the parties agree that the SCCs apply and are incorporated by reference.
Module Two (controller to processor) applies where the Controller is a controller, and Module Three (processor to processor) applies where the Controller is itself a processor. Clause 7 (docking) applies; the option in Clause 9(a) is Option 2, general written authorisation, with the thirty-day notice period set out in this DPA; the Clause 11 independent dispute resolution option is not selected; Clause 17 is governed by the law of Ireland; and Clause 18(b) designates the courts of Ireland.
For UK transfers, the UK International Data Transfer Addendum applies to the SCCs. For Swiss transfers, references to the GDPR are read as references to the FADP and the Swiss Federal Data Protection and Information Commissioner is the competent authority.
The Processor intends to certify under the EU–US Data Privacy Framework; until certification is confirmed in writing, the SCCs remain the operative mechanism.
Audits and demonstrating compliance
The Processor will make available the information reasonably necessary to demonstrate compliance with this DPA, including its Security Overview, Sub-processor List, and any third-party audit reports or certifications it holds.
Where that documentation is insufficient, the Controller may audit the Processor's compliance no more than once in any twelve-month period, on at least thirty days' written notice, during business hours, subject to confidentiality, without accessing other customers' data, and at the Controller's cost. A supervisory authority may audit as required by law.
Return and deletion
On termination or expiry, the Processor will make Customer Personal Data available for export for thirty days. After that period, it will delete Customer Personal Data from active systems within thirty days and from backups within a further ninety days as backups cycle.
The Processor may retain Customer Personal Data to the extent required by law, and will continue to protect it under this DPA for as long as it is retained. On request, the Processor will certify deletion in writing.
Liability
Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service. Nothing in this DPA limits a data subject's rights under Applicable Data Protection Law or either party's liability to a supervisory authority.
Contact and execution
Eyeleven Inc. — Privacy and Compliance. To request a countersigned copy of this DPA, to subscribe to sub-processor change notifications, or to raise a data protection matter, contact [email protected].