Data Processing and Security Terms

The customer agreeing to these terms (“Customer”), and Puzl Cloud, have entered into Puzl Cloud Platform Customer Agreement.

1. Effective Date

These Data Processing and Security Terms, including their appendices (the “Terms”) will be effective and replace any previously applicable data processing and security terms as from the Terms Effective Date (as defined below).

These Terms supplement the Agreement and these Terms supersede the “Privacy” Clause in that agreement (if applicable).

2. Definitions

2.1 Capitalized terms defined in the Agreement (at the end of the document) apply to these Terms.

2.2 The terms “personal data”, “data subject”, “processing”, “controller” and “processor” as used in these Terms have the meanings given in the GDPR irrespective of whether European Data Protection Law or Non-European Data Protection Law applies.

3. Duration

These Terms will notwithstanding expiry of the Term, remain in effect until, and automatically expire upon, deletion of all Customer Data by Puzl Cloud as described in these Terms.

4. Scope of Data Protection Law

4.1 Application of European Law

The parties acknowledge that European Data Protection Law will apply to the processing of Customer Personal Data if, for example: the processing is carried out in the context of the activities of an establishment of Customer in the territory of the EEA or the UK; and/or the Customer Personal Data is personal data relating to data subjects who are in the EEA or the UK and the processing relates to the offering to them of goods or services in the EEA or the UK, or the monitoring of their behavior in the EEA or the UK.

4.2 Application of Non-European Law

The parties acknowledge that Non-European Data Protection Law may also apply to the processing of Customer Personal Data.

4.3 Application of Terms

Except to the extent these Terms state otherwise, these Terms will apply irrespective of whether European Data Protection Law or Non-European Data Protection Law applies to the processing of Customer Personal Data.

5. Processing of Data

5.1 Roles and Regulatory Compliance; Authorization

5.1.1 Processor and Controller Responsibilities

If European Data Protection Law applies to the processing of Customer Personal Data: the subject matter and details of the processing are described in Appendix 1; Puzl Cloud is a processor of that Customer Personal Data under European Data Protection Law; Customer is a controller or processor, as applicable, of that Customer Personal Data under European Data Protection Law; and each party will comply with the obligations applicable to it under European Data Protection Law with respect to the processing of that Customer Personal Data.

5.1.2 Authorization by Third Party Controller

If European Data Protection Law applies to the processing of Customer Personal Data and Customer is a processor, Customer warrants that its instructions and actions with respect to that Customer Personal Data, including its appointment of Puzl Cloud as another processor, have been authorized by the relevant controller.

5.1.3 Responsibilities under Non-European Law

If Non-European Data Protection Law applies to either party’s processing of Customer Personal Data, the relevant party will comply with any obligations applicable to it under that law with respect to the processing of that Customer Personal Data.

5.2 Scope of Processing

5.2.1 Customer’s Instructions

Customer instructs Puzl Cloud to process Customer Personal Data only in accordance with applicable law: (a) to provide the Services and TSS; (b) as further specified via Customer’s use of the Services (including the Admin Console and other functionality of the Services) and TSS; (c) as documented in the form of the Agreement, including these Terms; and (d) as further documented in any other written instructions given by Customer and acknowledged by Puzl Cloud as constituting instructions for purposes of these Terms.

5.2.2 Puzl Cloud’s Compliance with Instructions

Puzl Cloud will comply with the instructions described in Section 5.2.1 (Customer’s Instructions) (including with regard to data transfers) unless European or National Law to which Puzl Cloud is subject requires other processing of Customer Personal Data by Puzl Cloud, in which case Puzl Cloud will notify Customer (unless that law prohibits Puzl Cloud from doing so on important grounds of public interest) before such other processing.

6. Data Deletion

6.1 Deletion by Customer

Puzl Cloud will enable Customer to delete Customer Data during the Term in a manner consistent with the functionality of the Services. If Customer uses the Services to delete any Customer Data during the Term and that Customer Data cannot be recovered by Customer, this use will constitute an instruction to Puzl Cloud to delete the relevant Customer Data from Puzl Cloud’s systems in accordance with applicable law. Puzl Cloud will comply with this instruction as soon as reasonably practicable and within a maximum period of 180 days, unless European or National Law requires storage.

6.2 Deletion on Termination

On expiry of the Term, Customer instructs Puzl Cloud to delete all Customer Data (including existing copies) from Puzl Cloud’s systems in accordance with applicable law. Puzl Cloud will, after a recovery period of up to 30 days following such expiry, comply with this instruction as soon as reasonably practicable and within a maximum period of 180 days, unless European or National Law requires storage. Without prejudice to Section 9.1 (Access; Rectification; Restricted Processing; Portability), Customer is responsible for exporting, before the Term expires, any Customer Data it wishes to retain.

7. Data Security

7.1 Puzl Cloud’s Security Measures, Controls and Assistance

7.1.1 Puzl Cloud’s Security Measures

Puzl Cloud will implement and maintain technical and organizational measures to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access (the “Security Measures”).

7.1.2 Security Compliance by Puzl Cloud Staff

Puzl Cloud will: (a) take appropriate steps to ensure compliance with the Security Measures by its employees, contractors and Subprocessors to the extent applicable to their scope of performance, and (b) ensure that all persons authorized to process Customer Personal Data are under an obligation of confidentiality.

7.1.3 Additional Security Controls

Where technically possible and commercially reasonable Puzl Cloud will make Additional Security Controls available to: (a) allow Customer to take steps to secure Customer Data; and (b) provide Customer with information about securing, accessing and using Customer Data.

7.1.4 Puzl Cloud’s Security Assistance

Puzl Cloud will (taking into account the nature of the processing of Customer Personal Data and the information available to Puzl Cloud) assist Customer in ensuring compliance with its obligations pursuant to Articles 32 to 34 of the GDPR, by: implementing and maintaining the Security Measures in accordance with Section 7.1.1 (Puzl Cloud’s Security Measures); making Additional Security Controls available to Customer in accordance with Section 7.1.3 (Additional Security Controls); complying with the terms of Section 7.2 (Data Incidents); providing Customer with the Security Documentation in accordance with Section 7.5.1 (Reviews of Security Documentation) and the information contained in the Agreement including these Terms; and f subsections (a)-(d) above are insufficient for Customer to comply with such obligations, upon Customer’s request, providing additional reasonable assistance.

7.2 Data Incidents

7.2.1 Incident Notification

Puzl Cloud will notify Customer promptly and without undue delay after becoming aware of a Data Incident, and promptly take reasonable steps to minimize harm and secure Customer Data.

7.2.2 Details of Data Incident

Puzl Cloud’s notification of a Data Incident will describe, to the extent possible, the nature of the Data Incident, the measures taken to mitigate the potential risks and the measures Puzl Cloud recommends Customer take to address the Data Incident.

7.2.3 Delivery of Notification

Notification(s) of any Data Incident(s) will be delivered to the Notification Email Address.

7.2.4 No Assessment of Customer Data by Puzl Cloud

Puzl Cloud has no obligation to assess Customer Data in order to identify information subject to any specific legal requirements.

7.3 Customer’s Security Responsibilities and Assessment

7.3.1 Customer’s Security Responsibilities

Without prejudice to Puzl Cloud’s obligations under Sections 7.1 (Puzl Cloud’s Security Measures, Controls and Assistance) and 7.2 (Data Incidents), and elsewhere in the Agreement, Customer is responsible for its use of the Services and its storage of any copies of Customer Data outside Puzl Cloud’s or Puzl Cloud’s Subprocessors’ systems, including: using the Services and Additional Security Controls to ensure a level of security appropriate to the risk in respect of the Customer Data; securing the account authentication credentials, systems and devices Customer uses to access the Services; and backing up its Customer Data as appropriate.

7.3.2 Customer’s Security Assessment

Customer agrees, based on its current and intended use of the Services, that the Services, Security Measures, Additional Security Controls and Puzl Cloud’s commitments under this Section 7 (Data Security): (a) meet Customer’s needs, including with respect to any security obligations of Customer under European Data Protection Law and/or Non-European Data Protection Law, as applicable, and (b) provide a level of security appropriate to the risk in respect of the Customer Data.

8. Impact Assessments and Consultations

Puzl Cloud will (taking into account the nature of the processing and the information available to Puzl Cloud) assist Customer in ensuring compliance with its obligations pursuant to Articles 35 and 36 of the GDPR, by providing the information contained in the Agreement including these Terms; and if it is insufficient for Customer to comply with such obligations, upon Customer’s request, providing additional reasonable assistance.

9. Access etc.; Data Subject Rights; Data Export

9.1 Access; Rectification; Restricted Processing; Portability

During the Term, Puzl Cloud will enable Customer, in a manner consistent with the functionality of the Services, to access, rectify and restrict processing of Customer Data, including via the deletion functionality provided by Puzl Cloud as described in Section 6.1 (Deletion by Customer), and to export Customer Data.

9.2 Data Subject Requests

9.2.1 Customer’s Responsibility for Requests

During the Term, if Puzl Cloud’s Cloud Data Protection Team receives a request from a data subject in relation to Customer Personal Data, and the request identifies Customer, Puzl Cloud will advise the data subject to submit their request to Customer. Customer will be responsible for responding to any such request including, where necessary, by using the functionality of the Services.

9.2.2 Puzl Cloud’s Data Subject Request Assistance

Puzl Cloud will (taking into account the nature of the processing of Customer Personal Data) assist Customer in fulfilling its obligations under Chapter III of the GDPR to respond to requests for exercising the data subject’s rights by: complying with Sections 9.1 (Access; Rectification; Restricted Processing; Portability) and 9.2.1 (Customer’s Responsibility for Requests); and if the above is insufficient for Customer to comply with such obligations, upon Customer’s request, providing additional reasonable assistance.

10. Data Transfers

10.1 Data Storage and Processing Facilities

Puzl Cloud may store and process Customer Data anywhere Puzl Cloud or its Subprocessors maintain facilities, subject to Puzl Cloud’s obligations under: a) Section 10.2 (Transfers of Data); and b) the Service Terms with respect to data location.

10.2 Transfers of Data

10.2.1 Puzl Cloud’s Transfer Obligations

If the storage and/or processing of Customer Personal Data involves transfers of Customer Personal Data out of the EEA, Switzerland or the UK, and European Data Protection Law applies to the transfers of such data (“Transferred Personal Data”), Puzl Cloud will: a) ensure that Puzl Cloud enters into Model Contract Clauses with Customer as the exporter of such data if requested to do so by Customer, and ensure that the transfers are made in accordance with such Model Contract Clauses; and/or b) offer an Alternative Transfer Solution in respect of such data, ensure that the transfers are made in accordance with such Alternative Transfer Solution, and make information available to Customer about such Alternative Transfer Solution.

10.2.2 Customer’s Transfer Obligations

In respect of Transferred Personal Data, Customer will: a) enter into Model Contract Clauses as the exporter of such data, if under European Data Protection Law Puzl Cloud reasonably requires Customer to do so; and b) use an Alternative Transfer Solution offered by Puzl Cloud in respect of such data and take any action (which may include execution of documents) strictly required to give full effect to such solution if under European Data Protection Law Puzl Cloud reasonably requires Customer to do so.

10.3 Data Center Information

Information about the locations of Puzl Cloud facilities is available at: Puzl Cloud Data Center Locations (as may be updated by Puzl Cloud from time to time).

10.4 Disclosure of Confidential Information Containing Personal Data

If Customer has entered into Model Contract Clauses as described in Section 10.2 (Transfers of Data), Puzl Cloud will, notwithstanding any term to the contrary in the Agreement, ensure that any disclosure of Customer’s Confidential Information containing personal data, and any notifications relating to any such disclosures, will be made in accordance with such Model Contract Clauses.

11. Subprocessors

Customer specifically authorizes the engagement as Subprocessors of: (a) those entities as of the Terms Effective Date; and (b) all other Puzl Cloud Affiliates from time to time. In addition, Customer generally authorizes the engagement as Subprocessors of any other third parties (“New Third Party Subprocessors”). If Customer has entered into Model Contract Clauses as described in Section 10.2 (Transfers of Data), the above authorizations constitute Customer’s prior written consent to the subcontracting by Puzl Cloud of the processing of Customer Data.

11.2 Information about Subprocessors

Information about Subprocessors, including their functions and locations, regularly provided to Customer and may be updated by Puzl Cloud from time to time in accordance with these Terms.

11.3 Requirements for Subprocessor Engagement

When engaging any Subprocessor, Puzl Cloud will: a) ensure via a written contract that: the Subprocessor only accesses and uses Customer Data to the extent required to perform the obligations subcontracted to it, and does so in accordance with the Agreement (including these Terms) and any Model Contract Clauses entered into or Alternative Transfer Solution adopted by Puzl Cloud as described in Section 10.2 (Transfers of Data); and b) if the GDPR applies to the processing of Customer Personal Data, the data protection obligations described in Article 28(3) of the GDPR, as described in these Terms, are imposed on the Subprocessor; and remain fully liable for all obligations subcontracted to, and all acts and omissions of, the Subprocessor.

12. Cloud Data Protection Team; Processing Records

12.1 Puzl Cloud’s Cloud Data Protection Team

Puzl Cloud’s Cloud Data Protection Team can be contacted by legal@puzl.cloud (and/or via such other means as Puzl Cloud may provide from time to time).

12.2 Puzl Cloud’s Processing Records

To the extent the GDPR requires Puzl Cloud to collect and maintain records of certain information relating to Customer, Customer will, where requested, use the Admin Console to supply such information and keep it accurate and up-to-date. Puzl Cloud may make any such information available to the Supervisory Authorities if required by the GDPR.

13. Liability

13.1 Liability Cap

If Model Contract Clauses have been entered into as described in Section 10.2 (Transfers of Data) then, subject to Section 13.2 (Liability Cap Exclusions), the total combined liability of either party and its Affiliates towards the other party and its Affiliates under or in connection with the Agreement and such Model Contract Clauses combined will be limited to the Agreed Liability Cap for the relevant party.

13.2 Liability Cap Exclusions

Nothing in Section 13.1 (Liability Cap) will affect the remaining terms of the Agreement relating to liability (including any specific exclusions from any limitation of liability).

14. Effect of These Terms

Notwithstanding anything to the contrary in the Agreement, to the extent of any conflict or inconsistency between these Terms and the remaining terms of the Agreement, these Terms will govern.

Definitions

  • Additional Security Controls means security resources, features, functionality and/or controls that Customer may use, if available, including the Admin Console, encryption, logging and monitoring, identity and access management, security scanning, and firewalls.
  • Agreed Liability Cap means the maximum monetary or payment-based amount at which a party’s liability is capped under the Agreement.
  • Alternative Transfer Solution means a solution, other than the Model Contract Clauses, that enables the lawful transfer of personal data to a third country in accordance with European Data Protection Law (for example, Privacy Shield).
  • Customer Data has the meaning given in the Agreement or, if no such meaning is given, means data provided by or on behalf of Customer or Customer End Users via the Services under the Account.
  • Customer End Users has the meaning given in the Agreement or, if not such meaning is given, has the meaning given to “End Users” in the Agreement.
  • Customer Personal Data means the personal data contained within the Customer Data.
  • Data Incident means a breach of Puzl Cloud’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data on systems managed by or otherwise controlled by Puzl Cloud.
  • EEA means the European Economic Area.
  • EU GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
  • European Data Protection Law means, as applicable: (a) the GDPR; and/or (b) the Federal Data Protection Act of 19 June 1992 (Switzerland).
  • European or National Law means, as applicable: (a) EU or EU Member State law (if the EU GDPR applies to the processing of Customer Personal Data); and/or (b) the law of the UK or a part of the UK (if the UK GDPR applies to the processing of Customer Personal Data).
  • GDPR means, as applicable: (a) the EU GDPR; and/or (b) the UK GDPR.
  • Model Contract Clauses or MCCs mean the standard data protection clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, as described in Article 46 of the EU GDPR.
  • Non-European Data Protection Law means data protection or privacy laws in force outside the European Economic Area, Switzerland and the UK.
  • Notification Email Address means the email address(es) designated by Customer in the Admin Console, or in the Order Form or Ordering Document (as applicable), to receive certain notifications from Puzl Cloud. Customer is responsible for using the Admin Console to ensure that its Notification Email Address remains current and valid.
  • Privacy Shield means, as applicable, the EU-U.S. Privacy Shield legal framework, the Swiss-U.S. Privacy Shield legal framework, and any equivalent legal framework that may apply between the UK and the United States.
  • Security Measures has the meaning given in Section 7.1.1 (Puzl Cloud’s Security Measures).
  • Subprocessor means a third party authorized as another processor under these Terms to have logical access to and process Customer Data in order to provide parts of the Services and TSS.
  • Supervisory Authority means, as applicable: (a) a “supervisory authority” as defined in the EU GDPR; and/or (b) the “Commissioner” as defined in the UK GDPR.
  • Term means the period from the Terms Effective Date until the end of Puzl Cloud’s provision of the Services, including, if applicable, any period during which provision of the Services may be suspended and any post-termination period during which Puzl Cloud may continue providing the Services for transitional purposes.
  • Terms Effective Date means the date on which Customer accepted, or the parties otherwise agreed to, these Terms.
  • UK GDPR means the EU GDPR as amended and incorporated into UK law under the UK European Union (Withdrawal) Act 2018, if in force.

Appendix 1: Subject Matter and Details of the Data Processing

Subject Matter

Puzl Cloud’s provision of the Services and TSS to Customer

Duration of the Processing

The Term plus the period from the expiry of the Term until deletion of all Customer Data by Puzl Cloud in accordance with the Terms.

Nature and Purpose of the Processing

Puzl Cloud will process Customer Personal Data for the purposes of providing the Services and TSS to Customer in accordance with the Terms.

Categories of Data

Data relating to individuals provided to Puzl Cloud via the Services, by (or at the direction of) Customer or by Customer End Users.

Data Subjects

Data subjects include the individuals about whom data is provided to Puzl Cloud via the Services by (or at the direction of) Customer or by Customer End Users.