Gen AI
Contact

Data Processing Agreement

Updated June 2022

This Data Processing Agreement (“DPA”) is an agreement between you and the entity you represent (Customer, “You or “Your”) and the phData Contracting Party (together, “phData”). This DPA also supplements any agreement between Customer and phData governing the Services when the GDPR applies to the Services to process Customer Data (the “Agreement”). Unless otherwise defined in this DPA or in the Agreement, all capitalized terms used in this DPA have the meanings given to them in Section 16 of this DPA.

  1. Data Processing
  • This DPA applies when Customer Data is processed by phData.
  • Details of Data Processing.
    • Subject Matter. The subject matter of the data processing under this DPA is Customer Data.
    • Duration. As between phData and Customer, the duration of the data processing under this DPA is determined by Customer.
    • Business Purpose. The purpose of the data processing under this DPA is the provision of Services initiated by Customer from time to time (the “Business Purpose”).
    • Nature of the processing. Technology consulting, SaaS, and such other Services as described in the Agreement.
    • Type of Customer Data. All Customer Data in phData’s technology environment.
    • Categories of Data Subjects. The Data Subjects could include Customer’s employees, customers, or suppliers.
  • Customer retains control of Customer Data and remains responsible for Customer’s compliance obligations under the applicable Privacy and Data Protection Requirements, including providing any required notices and obtaining any required consents, and for the processing instructions it gives to phData.

2. phData’s Obligations

  • phData will only process Customer Data to the extent, and in such a manner, as is necessary for the Business Purpose in accordance with Customer’s written instructions. phData will not process Customer Data for any other purpose. phData must promptly notify Customer if, in its opinion, Customer’s instruction would not comply with the Privacy and Data Protection Requirements.
  • phData must promptly comply with any Customer request or instruction requiring phData to amend, transfer, or delete Customer Data, or to stop, mitigate, or remedy any unauthorized processing.
  • phData will maintain the confidentiality of all Customer Data, will not sell it to anyone, and will not disclose it to third parties unless Customer or this DPA specifically authorizes the disclosure, or as required by law. If a law requires phData to process or disclose Customer Data, phData must first inform Customer of the legal requirement and give Customer an opportunity to object or challenge the requirement, unless the law prohibits such notice.
  • phData will reasonably assist Customer with meeting Customer’s compliance obligations under the Privacy and Data Protection Requirements, taking into account the nature of phData’s processing and the information available to phData.
  • phData must promptly notify Customer of any changes to Privacy and Data Protection Requirements that may adversely affect phData’s performance of this DPA or the Agreement.
  • Customer acknowledges that phData is under no duty to investigate the completeness, accuracy, or sufficiency of any specific Customer instructions or Customer Data other than as required under the Privacy and Data Protection Requirements.
  • phData will only collect Customer Data for Customer using a notice or method that Customer specifically pre-approves in writing, which contains an approved data privacy notice informing the Data Subject of Customer’s identity and its appointed data protection representative, if applicable, the purpose or purposes for which their Customer Data will be processed, and any other information that is required by applicable Privacy and Data Protection Requirements. phData will not modify or alter the notice in any way without Customer’s prior written consent.

3. Provider’s Employees

  • phData will limit Customer Data access to:
    • those employees who require Customer Data access to meet phData’s obligations under this PIPA and the Master Agreement; and
    • the part or parts of Customer Data that those employees strictly require for the performance of their duties.
  • phData will ensure that all employees:
    • are informed of Customer Data’s confidential nature and use restrictions;
    • have undertaken training on the Privacy and Data Protection Requirements relating to handling Customer Data and how it applies to their particular duties; and
    • are aware of their personal duties and obligations under the Privacy and Data Protection Requirements and this DPA.
  • phData will take reasonable steps to ensure the reliability, integrity, and trustworthiness of, and conduct background checks consistent with applicable law on, all of phData’s employees with access to Customer Data.

4. Security

  • phData must at all times implement appropriate technical and organizational measures designed to safeguard Customer Data against unauthorized or unlawful processing, access, copying, modification, storage, reproduction, display, or distribution, and against accidental loss, destruction, or damage. phData must document those measures in writing and periodically review them, at least annually, to ensure they remain current and complete. phData has implemented and will maintain the technical and organizational measures for the Services as described in Appendix B (phData Data Security Standards).
  • phData will immediately notify Customer if it becomes aware of any advance in technology and methods of working, which indicate that the parties should adjust their security measures.
  • phData must take reasonable precautions to preserve the integrity of any Customer Data it processes and to prevent any corruption or loss of Customer Data, including but not limited to establishing effective back-up and data restoration procedures.

5. Security Breaches and Customer Data Loss

  • phData will promptly notify Customer if any Customer Data is lost or destroyed.
  • phData will immediately notify Customer if it becomes aware of:
    • any unauthorized or unlawful processing of Customer Data; or
    • any Security Breach.
  • Immediately following any unauthorized or unlawful Customer Data processing or Security Breach, the parties will co-ordinate with each other to investigate the matter. phData will reasonably co-operate with Customer in Customer’s handling of the matter, including:
    • assisting with any investigation;
    • providing Customer with physical access to any facilities and operations affected;
    • facilitating interviews with phData’s employees, former employees, and others involved in the matter; and
    • making available all relevant records, logs, files, data reporting, and other materials required to comply with all Privacy and Data Protection Requirements or as otherwise reasonably required by Customer.
  • phData will not inform any third party of a Security Breach without first obtaining Customer’s prior written consent, except when law or regulation requires it.
  • phData agrees that Customer has the sole right to determine:
    • whether to provide notice of the Security Breach to any Data Subjects, regulators, law enforcement agencies, or others, as required by law or regulation or in Customer’s discretion, including the contents and delivery method of the notice; and
    • whether to offer any type of remedy to affected Data Subjects, including the nature and extent of such remedy.
  • phData will cover all reasonable expenses associated with the performance of the obligations under 5.2 and 5.3, unless the matter arose from Customer’s specific instructions, negligence, willful default, or breach of this DPA or the Agreement, in which case Customer will cover all reasonable expenses.
  • phData will also reimburse Customer for actual reasonable expenses Customer incurs when responding to and mitigating damages, to the extent that phData caused a Security Breach, including all costs of notice and any remedy as set out in 5.5.
  • phData will promptly notify Customer if any Customer Data is lost or destroyed.
  • phData will immediately notify Customer if it becomes aware of:
    • any unauthorized or unlawful processing of Customer Data; or
    • any Security Breach.
  • Immediately following any unauthorized or unlawful Customer Data processing or Security Breach, the parties will co-ordinate with each other to investigate the matter. phData will reasonably co-operate with Customer in Customer’s handling of the matter, including:
    • assisting with any investigation;
    • providing Customer with physical access to any facilities and operations affected;
    • facilitating interviews with phData’s employees, former employees, and others involved in the matter; and
    • making available all relevant records, logs, files, data reporting, and other materials required to comply with all Privacy and Data Protection Requirements or as otherwise reasonably required by Customer.
  • phData will not inform any third party of a Security Breach without first obtaining Customer’s prior written consent, except when law or regulation requires it.
  • phData agrees that Customer has the sole right to determine:
    • whether to provide notice of the Security Breach to any Data Subjects, regulators, law enforcement agencies, or others, as required by law or regulation or in Customer’s discretion, including the contents and delivery method of the notice; and
    • whether to offer any type of remedy to affected Data Subjects, including the nature and extent of such remedy.
  • phData will cover all reasonable expenses associated with the performance of the obligations under 5.2 and 5.3, unless the matter arose from Customer’s specific instructions, negligence, willful default, or breach of this DPA or the Agreement, in which case Customer will cover all reasonable expenses.
  • phData will also reimburse Customer for actual reasonable expenses Customer incurs when responding to and mitigating damages, to the extent that phData caused a Security Breach, including all costs of notice and any remedy as set out in 5.5.

6. Cross-Border Transfers of Customer Data

  • If the Privacy and Data Protection Requirements restrict cross-border Customer Data transfers, Customer will only transfer that Customer Data to phData under the following conditions:
    • phData, either through its location or participation in a valid cross-border transfer mechanism under the Privacy and Data Protection Requirements may legally receive that Customer Data, however, phData must immediately notify Customer of any change to that status; or
  • Customer obtained valid Data Subject consent to the transfer under the Privacy and Data Protection Requirements.
  • If any Customer Data transfer between phData and Customer requires execution of Standard Contractual Clauses in order to comply with the Privacy and Data Protection Requirements, the parties will complete all relevant details in, and execute, the Standard Contractual Clauses contained in Appendix A, and take all other actions required to legitimize the transfer, including, if necessary:
    • co-operating to register the Standard Contractual Clauses with any supervisory authority in any European Economic Area country;
    • procuring approval from any such supervisory authority; or
    • providing additional information about the transfer to such supervisory authority.
  • phData will not transfer any Customer Data to another country unless the transfer complies with the Privacy and Data Protection Requirements

7. Subcontractors

  • phData may only authorize a third party (subcontractor) to process Customer Data if:
    • Customer is given an opportunity to object within ten (10) days after phData supplies Customer with full details regarding such subcontractor; and
    • phData enters into a written contract with the subcontractor that contains terms substantially the same as those set out in this DPA, upon Customer’s written request, provides Customer with copies of such contracts.
  • phData utilizes the approved subcontractors in Appendix C.
  • Where the subcontractor fails to fulfill its obligations under such written agreement, phData remains fully liable to Customer for the subcontractor’s performance of its obligations in this DPA.
  • The Parties consider phData to control any Customer Data controlled by or in the possession of its subcontractors.
  • Upon Customer’s written request, phData will audit a subcontractor’s compliance with its obligations regarding Customer’s Customer Data and provide Customer with the audit results.

8. Complaints, Data Subject Requests, and Third Party Rights

  • phData must notify Customer immediately if it receives any complaint, notice, or communication that directly or indirectly relates to Customer Data processing or to either party’s compliance with the Privacy and Data Protection Requirements.
  • phData must notify Customer within five (5) working days if it receives a request from a Data Subject for access to or deletion of their Customer Data.
  • phData will give Customer its full co-operation and assistance in responding to any complaint, notice, communication, or Data Subject request.
  • phData must not disclose Customer Data to any Data Subject or to a third party unless the disclosure is either at Customer’s request or instruction, permitted by this DPA, or is otherwise required by law

9. Term and Termination

  • This DPA will remain in full force and effect so long as:
    • the Agreement remains in effect; or
    • phData retains any Customer Data related to the Agreement in its possession or control (the “Term”).
  • Any provision of this DPA that expressly or by implication should come into or continue in force on or after termination of the Agreement in order to protect Customer Data will remain in full force and effect.
  • phData’s failure to comply with the terms of this DPA is a material breach of the Agreement. In such event, Customer may terminate any part of the Agreement authorizing the processing of Customer Data effective immediately upon written notice to phData.
  • If a change in any Privacy and Data Protection Requirement prevents either party from fulfilling all or part of its Agreement obligations, the parties will suspend the processing of Customer Data until that processing complies with the new requirements. If the parties are unable to bring Customer Data processing into compliance with the Privacy and Data Protection Requirement within a reasonable amount of time in accordance with applicable law, they may terminate the Agreement upon written notice to the other party.

10. Data Return and Destruction

  • At Customer’s request, phData will give Customer a copy of or access to all or part of Customer’s Customer Data in its possession or control in the format and on the media reasonably specified by Customer.
  • On termination of the Agreement for any reason or expiration of its term, phData will securely destroy or, if directed in writing by Customer, return and not retain, all or any Customer Data related to this DPA in its possession or control, except for one copy that it may retain and use for three (3) years for audit purposes only.
  • phData will certify in writing that it has destroyed Customer Data within five (5) working days after it completes the destruction.

11. Records

  • phData will keep detailed, accurate, and up-to-date records regarding any processing of Customer Data it carries out for Customer, including but not limited to, the access, control, and security of Customer Data, approved subcontractors and affiliates, the processing purposes, and any other records required by the applicable Privacy and Data Protection Requirements (the “Records”).
  • phData will ensure that the Records are sufficient to enable Customer to verify phData’s compliance with its obligations under this DPA.

12. Audit

  • At least once per year, phData will conduct audits of its Customer Data processing practices and the information technology and information security controls for all facilities and systems used in complying with its obligations under this DPA, including, but not limited to, obtaining a network-level vulnerability assessment performed by a recognized third-party audit firm based on recognized industry best practices.
  • Upon Customer’s written request, phData will make all of the relevant audit reports available to Customer for review, including as applicable: phData’s latest Payment Card Industry (PCI) Compliance Report, WebTrust, Systrust, Statement on Standards for Attestation Engagements (SSAE) No. 18 audit reports for Reporting on Controls at a Service Organization, reports relating to its ISO/IEC 27001 certification.
  • phData will promptly address any issues, concerns, or exceptions noted in the audit reports with the development and implementation of a corrective action plan by phData’s management.

13. Warranties

  • phData warrants and represents that:
    • its employees, subcontractors, agents, and any other person or persons accessing Customer Data on its behalf are reliable and trustworthy and have received the required training on the Privacy and Data Protection Requirements relating to Customer Data; and
    • it and anyone operating on its behalf will process Customer Data in compliance with both the terms of this DPA and all applicable Privacy and Data Protection Requirements; and
    • it has no reason to believe that any Privacy and Data Protection Requirements prevent it from providing any of the Agreement’s Services; and
    • considering the current technology environment and implementation costs, it will take appropriate technical and organizational measures to prevent the unauthorized or unlawful processing of Customer Data and the accidental loss or destruction of, or damage to, Customer Data, and ensure a level of security appropriate to:
      • the harm that might result from such unauthorized or unlawful processing or accidental loss, destruction, or damage; and
      • the nature of Customer Data protected; and
      • comply with all applicable Privacy and Data Protection Requirement and its information and security policies.
  • Customer warrants and represents that phData’s expected use of Customer Data for the Business Purpose and as specifically instructed by Customer will comply with all Privacy and Data Protection Requirements

14. Indemnification

  • phData agrees to indemnify, keep indemnified, and defend at its own expense Customer against all costs, claims, damages, or expenses incurred by Customer or for which Customer may become liable due to any material breach of this DPA by phData or its employees, subcontractors, or agents to comply with any of its obligations under this DPA or applicable Privacy and Data Protection Requirements.
  • Any limitation of liability set forth in the Agreement between you and phData will apply to this DPA’s indemnity or reimbursement obligations.

15. Notice

  • Any notice or other communication given to phData under or in connection with this DPA must be in writing and delivered to phData at: 400 South Fourth Street, Suite 401, Minneapolis, MN 55415, United States of America, Attention: Privacy.
  • 15.1 does not apply to the service of any proceedings or other documents in any legal action or, where applicable, any arbitration or other method of dispute resolution.

16. Definitions and Interpretation

  • Unless otherwise defined in this Agreement, all capitalized terms used in this DPA will have the meanings given to them below:

“Data Subject” means an individual who is the subject of Customer Data.

“Customer Data” means the “personal data” (as defined in GDPR) that enters phData’s Network.

“GDPR”means Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

“phData Contracting Party Subject” means the applicable phData entity providing Services to Customer.

“phData Network” means phData’s host software systems that are within phData’s control and are used to provide the Services.

“Processing“ has the meaning given to it in the GDPR.

“Processor” has the meaning given to it in the GDPR.

“Privacy and Data Protection Requirements” means all applicable federal, state, and foreign laws and regulations relating to the processing, protection, or privacy of Customer Data, including where applicable, the guidance and codes of practice issued by regulatory bodies in any relevant jurisdiction.

“Security Breach” means a breach of phData’s Network leading to the accidental or unlawful destruction, loss, unauthorized disclosure of, or access to, Customer Data.

“Services” means the professional services or products provided by the phData Contracting Party to Customer.

“Standard Contractual Clauses (SCC)”means the European Commission’s standard contractual clauses for the transfer of personal data from the European Union to third countries (Module One, Two, Three, and Four), as set out in the Annex to Commission Decision (EU) 2021/914, a completed copy of which comprises Appendix A.

  • The Appendices form part of this DPA and will have effect as if set out in full in the body of this DPA. Any reference to this DPA includes the Appendices.
  • A reference to writing or written includes email.
    • In the case of conflict or ambiguity between:
    • any provision contained in the body of this DPA and any provision contained in the Appendices, the provision in the body of this DPA will prevail;
    • the terms of any accompanying invoice or other documents annexed to this DPA and any provision contained in the Appendices, the provision contained in the Appendices will prevail;
    • any of the provisions of this DPA and the provisions of the Agreement, the provisions of this DPA will prevail; and
    • any of the provisions of this DPA and any executed Standard Contractual Clauses, the provisions of the executed Standard Contractual Clauses will prevail.

APPENDIX A

Standard Contractual Clauses

The Standard Contractual Clauses, available at: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en, as may be amended from time to time. 

APPENDIX B

phData Security Standards 

phData implements and maintains appropriate technical and organizational measures to protect against unlawful destruction, loss, alteration, disclosure of, or access to, Customer Data. These measures comply with the requirements set forth in ISO/IEC 27001, ISO/IEC 27701, and SOC 2 Type 2.

  1. Permitted Use.  phData will use and disclose Customer Data only for the Business Purpose, or purposes for which Customer provides the Customer Data. No Information is transmitted through, stored, or otherwise processed by phData’s systems in the provision of Services.
    2.  
  2. Connectivity & Transmission. Customer is responsible for granting appropriate access to phData as necessary to enable phData to provide the Services. To the extent phData may transmit any Customer Data, phData uses industry-recognized encryption technologies that provide reasonable assurance it will protect the encrypted information from unauthorized access and is adequate to protect the confidentiality and privacy of the encrypted information.
    3.  
  3. Authorized Disclosure. phData will not disclose Customer Data to any person other than phData’s employees, contractors, agents, and auditors who have a need to know or otherwise access Customer Data to enable phData to perform the Services ( “Authorized Personnel” ) without Customer’s prior written consent unless required by applicable law, in which case, phData will use reasonable efforts to the extent permitted by applicable law to notify Customer before such disclosure or as soon as reasonably practicable thereafter.
    4.  
  4. Security Incidents.  phData maintains an Incident Response Plan in accordance with generally recognized industry standards and will implement the procedures required under such plan on the occurrence of any Security Breach. phData will notify Customer of a Security Breach as soon as reasonably practicable after phData becomes aware of it.
    5.  
  5. Independent Audit.  Annually, phData obtains an audit performed by an independent third party based on generally recognized industry standards. Upon Customer’s written request, phData will make all relevant audit reports available to Customer for review.
    6.  
  6. Return or Disposal of Information. Upon Customer’s written request, phData will promptly return to Customer or securely dispose of all Customer Data in its possession but may retain copies contained in archived computer system backups in accordance with security or disaster recovery procedures or to the extent required by law, regulation, or internal compliance procedures. Customer is responsible for terminating phData’s access after completion of Services.

APPENDIX C

phData Subprocessors

Controller consents to the use of the following sub-processors:

Subprocessor Address/County Description of Services Provided by Subprocessors
Amazon Web Services, Inc Worldwide Infrastructure-as-a-Service
Atlassian Corporation Plc Worldwide Software-as-a-Service
Okta, Inc. Worldwide Software-as-a-Service
Salesforce Worldwide Software-as-a-Service
Docebo Worldwide Software-as-a-Service
Calendly Worldwide Software-as-a-Service
data-process-table

Have additional questions?

reach out
Linkedin-in Youtube X-twitter

Join our team

Partners

Resources

Software

Subscribe to our newsletter

Data Coach is our premium analytics training program with one-on-one coaching from renowned experts.

Accelerate and automate your data projects with the phData Toolkit

Industries

Solutions

Company

Technology Partners

Dataiku
Snowflake Logo White
Tableau logo white

Other Technology Partners

Check out our latest insights

Data Engineering

Consulting, Migrations, Data Pipelines, DataOps

Change Management, Enablement & Learning

COE, Coaching, PMO

Data Science and Machine Learning Services

MLOps Enablement, Prototyping, Model Development and Deployment

Strategy Services

Data, Analytics, and AI Strategy, Architecture and Assessments

Reporting, Analytics, and Visualization Services

Self-Service, Integrated Analytics, Dashboards, Automation

Elastic Operations

Data Platforms, Data Pipelines, and Machine Learning