GDPR

Data Processing Agreement and GDPR Statement

This Data Processing Agreement is made by and between Emailgistics (“We”, “Our,” “Us”) and you (“Customer”, “User,” “You”).

This Agreement is incorporated into Emailgistics Terms of Service and applies in respect of the provision of the Services to the Customer if the Processing of Customer Personal Data (as defined below) is subject to the GDPR, only to the extent the Customer is a Controller of Customer Personal Data and Emailgistics is a Processor. The Agreement is intended to satisfy the requirements of Article 28(3) of the GDPR. This Agreement shall be effective for the term of the contract between You and Us.

1. Definitions

1.1. For the purposes of this Agreement:

1.1.1. “Customer Personal Data” means the Personal Data described under Annex 1 of this Agreement, in respect of which the Customer is the Controller;

1.1.2. “Data Protection Legislation” means all applicable legislation relating to data protection and privacy including without limitation the EU Data Protection Directive 95/46/EC and Directive 2002/58/EC and all local laws and regulations which amend or replace any of them, including the GDPR, together with any national implementing laws in any Member State of the European Union or, to the extent applicable, in any other country, as amended, repealed, consolidated or replaced from time to time;

1.1.3. “GDPR” means the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data; and

1.1.4. “Personal Data”, “Data Subject”, “Personal Data Breach”, “Process”, “Processor” and “Controller” will each have the meaning given to them in the GDPR.

1.2. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement.

2. Processing of Customer Personal Data

2.1. The parties acknowledge and agree that Customer is the Controller of Customer Personal Data and Emailgistics is the Processor of that data. Emailgistics will only Process Customer Personal Data as a Processor on behalf of and in accordance with the Customer’s prior written instructions and for no other purpose. Emailgistics is hereby instructed to process Customer Personal Data to the extent necessary to enable Emailgistics to provide the Services in accordance with the Terms of Service.

2.2. If Emailgistics cannot process Customer Personal Data in accordance with Customer’s instructions due to a legal requirement under any applicable European Union or Member State law, Emailgistics will (i) promptly notify the Customer of such inability, providing a reasonable level of detail as to the instructions with which it cannot comply and the reasons why it cannot comply, to the greatest extent permitted by applicable law; and (ii) cease all Processing of the affected Customer Personal Data (other than merely storing and maintaining the security of the affected Customer Personal Data) until such time as the Customer issues new instructions with which Emailgistics is able to comply. If this provision is invoked, Emailgistics will not be liable to the Customer under the Terms of Service for failure to perform the Services until such time as the Customer issues new instructions. Emailgistics will immediately inform Customer if, in its opinion, an instruction from Customer infringes the Data Protection Legislation.

2.3 Each of the Customer and Emailgistics will comply with their respective obligations under the Data Protection Legislation. Customer shall ensure that You have informed Your data subjects and obtained (or will obtain) all rights and consents (if required by the applicable Data Protection Legislation) to allow Emailgistics to Process Customer Personal Data to provide the Services in accordance with this Agreement and the Terms of Service.

2.4. In connection with the provision of the Service, Customer authorizes Emailgistics to transfer Customer Personal Data from the European Economic Area (“EEA”) to Canada, the United States, or other geographical locations outside the EEA.

3. Confidentiality

3.1. Emailgistics will ensure that any person whom We authorize to Process Customer Personal Data on Our behalf is subject to confidentiality obligations in respect of that Customer Personal Data.

4. Security Measures

4.1. Emailgistics will implement appropriate technical and organizational measures to protect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.

4.2. Emailgistics will, at the Customer’s request and subject to the Customer paying all of Our fees at prevailing rates, and all expenses, provide the Customer with reasonable assistance as necessary for the fulfilment of the Customer’s obligation to keep Customer Personal Data secure.

5. Sub-Processing

5.1. Customer authorizes Emailgistics to appoint sub-Processors to perform specific services on Our behalf which may require such sub-Processors to Process Customer Personal Data. If Emailgistics engages a sub-Processor to Process any Customer Personal Data, it will:

• inform Customer of any intended changes concerning the addition or replacement of such sub-Processors and Customer will have an opportunity to object to such changes on reasonable grounds within thirty (30) calendar days after being notified. If the parties are unable to resolve such objection, either party may terminate the agreement by providing written notice to the other party; and
• enter into a binding written agreement with the sub-Processor that imposes on the sub-Processor the same obligations that apply to Emailgistics under this Agreement. Where any of its sub- Processors fails to fulfil its data protection obligations, Emailgistics will be liable to the Customer for the performance of its sub-Processors’ obligations.

6. Data Subject Rights

6.1. Emailgistics will, at the Customer’s request and subject to the Customer paying all of Our fees at prevailing rates, and all expenses, provide the Customer with assistance necessary for the fulfilment of the Customer’s obligation to respond to requests for the exercise of Data Subjects’ rights. Emailgistics shall not respond to such requests without Customer’s prior written consent and written instructions. Customer shall be solely responsible for responding to such requests.

7. Personal Data Breaches

7.1. Emailgistics will notify the Customer as soon as practicable after it becomes aware of any of any Personal Data Breach affecting any Customer Personal Data. At the Customer’s request and subject to the Customer paying all of Our fees at prevailing rates, and all expenses, Emailgistics will promptly provide the Customer with all reasonable assistance necessary to enable the Customer to notify relevant security breaches to the competent data protection authorities and/or affected Data Subjects, if Customer is required to do so under the GDPR. Customer is solely responsible for complying with data incident notification requirements applicable to Customer and fulfilling any third-party notification obligations related to any data incidents.

8. Data Protection Impact Assessment; Prior Consultation

8.1. Emailgistics will, at the Customer’s request and subject to the Customer paying all of Our fees at prevailing rates, and all expenses, provide the Customer with reasonable assistance to facilitate:

• conducting data protection impact assessments if the Customer is required to do so under the GDPR; and
• consulting with data protection authorities, if the Customer is required to engage in consultation under the GDPR,

in each case solely to the extent that such assistance is necessary and relates to the Processing by Emailgistics of the Customer Personal Data, taking into account the nature of the Processing and the information available to Emailgistics.

9. Deletion of Customer Personal Data

9.1. Emailgistics will return or delete, at Customer’s choice, Customer Personal Data to the Customer after the end of the provision of Services relating to the Processing, and delete existing copies unless the applicable European Union or member state law requires storage of the data.

10. Information

10.1. Emailgistics will, at Customer’s request and subject to the Customer paying all of Our fees at prevailing rates, and all expenses, provide the Customer with all information necessary to enable the Customer to demonstrate compliance with its obligations under the GDPR, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, to the extent that such information is within Emailgistics’ control and We are not precluded from disclosing it by applicable law, a duty of confidentiality, or any other obligation owed to a third party, and provided that such audits shall be carried out with reasonable notice during regular business hours not more often than once per year.

11. Liability

11.1. Each party’s liability towards the other party under or in connection with this Agreement will be limited in accordance with the provisions of the Terms of Service.

11.2. The Customer acknowledges that Emailgistics is reliant on the Customer for direction as to the extent to which We are entitled to Process Customer Personal Data on behalf of Customer in performance of the Services. Consequently Emailgistics will not be liable under the Agreement for any claim brought by a Data Subject arising from any action or omission by Emailgistics, to the extent that such action or omission resulted directly from the Customer’s instructions or from Customer’s failure to comply with its obligations under the applicable data protection law.

12. General Provisions

12.1. With regard to the subject matter of this Agreement, in the event of inconsistencies between the provisions of this Agreement and the general Terms of Service, the provisions of this Agreement shall prevail.