Definitions and interpretation: The following definitions and rules of interpretation apply in this DPA. Definitions:

Affiliate: any entity controlling, controlled by, or under common control with a party, where “control” is defined as: (a) the ownership of at least fifty percent (50%) of the equity or beneficial interests of the entity; (b) the right to vote for or appoint a majority of the board of directors or other governing body of the entity; or (c) the power to exercise a controlling influence over the management or policies of the entity.

Alternative Transfer Solution: a solution, other than the Model Contract Clauses, that enables the lawful transfer of personal data to a third country in accordance with Article 45 or 46 of the GDPR (for example, the EU-U.S. Privacy Shield).

Authorised Persons: the persons or categories of persons that User authorises to give the Ecomlad personal data processing instructions either nominated by User or with ostensible or actual authority.

Business Purposes: the Services described in the Ecomlad Terms and Conditions.

Data Protection Legislation: all applicable privacy and data protection laws including the General Data Protection Regulation ((EU) 2016/679) and, to the extent applicable, the data protection or privacy laws of any other country.

Data Subject: an individual who is the subject of Personal Data.

Model Contract Clauses: the standard data protection clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, as described in Article 46 of the GDPR.

Personal Data: means any information relating to an identified or identifiable natural person that is processed by the Ecomlad as a result of, or in connection with, the provision of the services under the Ecomlad Terms and Conditions; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing, processes and process: either any activity that involves the use of Personal Data or as the Data Protection Legislation may otherwise define processing, processes or process. It includes any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Processing also includes transferring Personal Data to third parties.

Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.

This DPA is subject to the terms of the Ecomlad Terms and Conditions and is incorporated into the Ecomlad Terms and Conditions. Interpretations and defined terms set forth in the Ecomlad Terms and Conditions apply to the interpretation of this DPA.

The Annexes form part of this DPA and will have effect as if set out in full in the body of this DPA. Any reference to this DPA includes the Annexes.

A reference to writing or written includes email.

In the case of conflict or ambiguity between any provision contained in the body of this DPA and any provision contained in the Annexes, the provision in the body of this DPA will prevail.

Duration of DPA
This DPA will take effect as stipulated in the recitals above and shall remain in effect until, and expire in accordance with clause 12.

Personal data types and processing purposes

The User retains control of the Personal Data and remains responsible for its compliance obligations under the applicable Data Protection Legislation, including providing any required notices and obtaining any required consents, and for the processing instructions it gives to the Ecomlad.

Annex 1 describes the subject matter, duration, nature and purpose of processing and the Personal Data categories and Data Subject types in respect of which the Ecomlad may process to fulfil the Business Purposes of the Ecomlad Terms and Conditions.

Processing of Data

Ecomlad and User Responsibilities. If the Data Protection Legislation applies to the processing of User Personal Data, the parties acknowledge and agree that:

1. The subject matter and details of the processing are described in Annex 1;
2. Ecomlad is a processor of that User Personal Data under the Data Protection Legislation;
3. User is a controller or processor, as applicable, of that User Personal Data under the Data Protection Legislation; and
4. User instructs Ecomlad (and authorises processor and each processor affiliate to instruct each subprocessor) to in particular, transfer User Personal Data to any country or territory, as reasonably necessary for the provision of the Services and consistent with Ecomlad Terms and Conditions; and
5. each party will comply with the obligations applicable to it under the Data Protection Legislation with respect to the processing of that User Personal Data.

If the Data Protection Legislation applies to the processing of User Personal Data and User is a processor, User warrants to Ecomlad that User’s instructions and actions with respect to that User Personal Data, including its appointment of Ecomlad as another processor, have been authorized by the relevant controller.

Ecomlad will take into account the nature of the processing, assists the User by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Data Protection Legislation.

Ecomlad will assist the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of GDPR taking into account the nature of processing and the information available to the processor.

Scope of Processing

User’s Instructions. By entering into this DPA, User instructs Ecomlad to process User Personal Data only in accordance with applicable law: (a) to provide the Services and related technical support; (b) as documented in the form of the Ecomlad Terms and Conditions, including this DPA; and (d) as further documented in any other written instructions given by User and acknowledged by Ecomlad as constituting instructions for purposes of this DPA.

Ecomlad’s Compliance with Instructions. Ecomlad will comply with the instructions described in Section 5.1 (User’s Instructions) (including with regard to data transfers) unless EU or EU Member State law to which Ecomlad is subject requires other processing of User Personal Data by Ecomlad, in which case Ecomlad will inform User (unless that law prohibits Ecomlad from doing so on important grounds of public interest) via the User email address.

Ecomlad employees

Ecomlad will ensure that all employees:

1. Are informed of the confidential nature of the Personal Data and are bound by confidentiality obligations and use restrictions in respect of the Personal Data;
2. Have undertaken training on the Data Protection Legislation relating to handling Personal Data and how it applies to their particular duties; and
3. Are aware both of the Ecomlad’s duties and their personal duties and obligations under the Data Protection Legislation and this DPA.

Security

Ecomlad must at all times implement appropriate technical and organisational measures against unauthorised or unlawful processing, access, disclosure, copying, modification, storage, reproduction, display or distribution of Personal Data, and against accidental or unlawful loss, destruction, alteration, disclosure or damage of Personal Data. Technical and organisational measure are specified in the Annex 2.

Ecomlad must implement such measures to ensure a level of security appropriate to the risk involved, including as appropriate:

1. The pseudonymisation and encryption of personal data;
2. The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
3. The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and
4. Process for regularly testing, assessing and evaluating the effectiveness of security measures.

Personal Data Breach

Ecomlad will promptly and without undue delay notify User if any Personal Data is lost or destroyed or becomes damaged, corrupted, or unusable. The Ecomlad will restore such Personal Data at its own expense.

Ecomlad will immediately and without undue delay notify User if it becomes aware of:

1. Any accidental, unauthorised or unlawful processing of the Personal Data; or
2. Any Personal Data Breach.

Where Ecomlad becomes aware of (a) and/or (b) above, it shall, without undue delay, also provide User with the following information:

1. Description of the nature of (a) and/or (b), including the categories and approximate number of both Data Subjects and Personal Data records concerned;
2. The likely consequences; and
3. Description of the measures taken, or proposed to be taken to address (a) and/or (b), including measures to mitigate its possible adverse effects.

Immediately following any unauthorised or unlawful Personal Data processing or Personal Data Breach, the parties will co-ordinate with each other to investigate the matter. Ecomlad will reasonably co-operate with User in User’s handling of the matter in accordacne with Data Protection Legislation.

Ecomlad will not inform any third party of any Personal Data Breach without first obtaining User’s prior written consent, except when required to do so by law.

Ecomlad agrees that User has the sole right to determine:

1. Whether to provide notice of the Personal Data Breach to any Data Subjects, supervisory authorities, regulators, law enforcement agencies or others, as required by law or regulation or in User’s discretion, including the contents and delivery method of the notice; and
2. Whether to offer any type of remedy to affected Data Subjects, including the nature and extent of such remedy.

Cross-border transfers of personal data

Data storage and processing facilities. User agrees that Ecomlad may, subject to Section 9.2 (Transfers of Data out of the EEA), store and process User Data in the United States of America and any other country in which Ecomlad or any of its subprocessors maintains facilities.

Transfers of Data out of the EEA.

1. Ecomlad’s Transfer Obligations. If the storage and/or processing of User Personal Data (as set out in Section 9.1 (Data storage and processing facilities)) involves transfers of User Personal Data out of the EEA and the Data Protection Legislation applies to the transfers of such data (“Transferred Personal Data”), Ecomlad will:
   1. If requested to do so by User, ensure that Ecomlad as the data importer of the Transferred Personal Data enters into Model Contract Clauses with User as the data exporter of such data, and that the transfers are made in accordance with such Model Contract Clauses; and/or
   2. Offer an Alternative Transfer Solution, ensure that the transfers are made in accordance with such Alternative Transfer Solution, and make information available to User about such Alternative Transfer Solution.
2. User’s Transfer Obligations. In respect of Transferred Personal Data, User agrees that:
   1. If under the Data Protection Legislation Ecomlad reasonably requires User to enter into Model Contract Clauses in respect of such transfers, User will do so; and
   2. If under the Data Protection Legislation Ecomlad reasonably requires User to use an Alternative Transfer Solution offered by Ecomlad, and reasonably requests that User take any action (which may include execution of documents) strictly required to give full effect to such solution, User will do so.

Disclosure of Confidential Information containing Personal Data. If User has entered into Model Contract Clauses as described in Section 9.2 (Transfers of Data out of the EEA), Ecomlad will, notwithstanding any term to the contrary in the applicable agreement, ensure that any disclosure of User’s Confidential Information containing personal data, and any notifications relating to any such disclosures, will be made in accordance with such Model Contract Clauses.

Subprocessors

Consent to subprocessor engagement. User specifically authorizes the engagement of Ecomlad’s Affiliates as subprocessors. In addition, Ecomlad generally authorizes the engagement of any other third parties as subprocessors (“Third Party Subprocessors”). If User has entered into Model Contract Clauses as described in Section 10.2 (Transfers of Data out of the EEA), the above authorizations will constitute User’s prior written consent to the subcontracting by Ecomlad of the processing of User Data if such consent is required under the Model Contract Clauses.

Information about subprocessors. Information about subprocessors is available in Annex 1 (as may be updated by Ecomlad from time to time in accordance with this DPA).

Requirements for subprocessor engagement. When engaging any subprocessor, Ecomlad will:

1. Ensure via a written contract that:
   1. The subprocessor only accesses and uses User Data to the extent required to perform the obligations subcontracted to it, and does so in accordance with the applicable agreement (including this DPA) and any Model Contract Clauses entered into or Alternative Transfer Solution adopted by Ecomlad as described in Section 9.2 (Transfers of Data out of the EEA); and
   2. If the Data Protection Legislation applies to the processing of User Personal Data, the data protection obligations set out in Article 28(3) of the GDPR, as described in this DPA, are imposed on the subprocessor; and
2. Remain fully liable for all obligations subcontracted to, and all acts and omissions of, the subprocessor.

Opportunity to object to subprocessor changes:

1. When any new Third Party Subprocessor is engaged during the applicable term, Ecomlad will, at least 30 days before the new Third Party Subprocessor processes any User Data, inform User of the engagement (including the name and location of the relevant subprocessor and the activities it will perform) by sending an email to the email address.
2. User may object to any new Third Party Subprocessor by terminating the applicable agreement immediately upon written notice to Ecomlad, on condition that User provides such notice within 90 days of being informed of the engagement of the subprocessor as described in Section 10.4(a). This termination right is User’s sole and exclusive remedy if User objects to any new Third Party Subprocessor.

Complaints, data subject requests and third party rights

Ecomlad shall take such technical and organisational measures as may be appropriate, and promptly provide such information to User as User may reasonably require, to enable User to comply with:

1. The rights of Data Subjects under the Data Protection Legislation, including subject access rights, the rights to rectify and erase personal data, object to the processing and automated processing of personal data, and restrict the processing of personal data; and
2. Information or assessment notices served on User by any supervisory authority under the Data Protection Legislation.

Ecomlad shall notify User immediately if it receives any complaint, notice or communication that relates directly or indirectly to the processing of the Personal Data or to either party’s compliance with the Data Protection Legislation.

Ecomlad must notify User within 24 hours if it receives a request from a Data Subject for access to their Personal Data or to exercise any of their related rights under the Data Protection Legislation.

Ecomlad will give User its full co-operation and assistance in responding to any complaint, notice, communication or Data Subject request.

Ecomlad must not disclose the Personal Data to any Data Subject or to a third party other than at User’s request or instruction, as provided for in this Agreement or as required by law.

Term and termination

This DPA will remain in full force and effect so long as:

1. Ecomlad Terms and Conditions remains in effect, or
2. Ecomlad retains any Personal Data related to the Ecomlad Terms and Conditions in its possession or control (Term).

Any provision of this DPA that expressly or by implication should come into or continue in force on or after termination of the Ecomlad Terms and Conditions  in order to protect Personal Data will remain in full force and effect.

Ecomlad’s failure to comply with the terms of this DPA is a material breach of the Ecomlad Terms and Conditions. In such event, User may terminate the Ecomlad Terms and Conditions effective immediately on written notice to the Ecomlad without further liability or obligation.

If a change in any Data Protection Legislation prevents either party from fulfilling all or part of its Ecomlad Terms and Conditions obligations, the parties will suspend the processing of Personal Data until that processing complies with the new requirements. If the parties are unable to bring the Personal Data processing into compliance with the Data Protection Legislation, they may terminate relations with Ecomlad Terms and Conditions on written notice to Ecomlad.

Data return and destruction

Where it is applicable under legislation at User’s request, the Ecomlad will give User a copy of or access to all or part of User’s Personal Data in its possession or control in the format and on the media reasonably specified by User.

On termination of relations with Ecomlad for any reason Ecomlad will securely delete or destroy or, if directed in writing by User, return and not retain, all or any Personal Data related to this DPA in its possession or control.

If any law, regulation, or government or regulatory body requires the Ecomlad to retain any documents or materials that the Ecomlad would otherwise be required to return or destroy, it will notify User in writing of that retention requirement, giving details of the documents or materials that it must retain, the legal basis for retention, and establishing a specific timeline for destruction once the retention requirement ends.

Ecomlad will certify in writing that it has destroyed the Personal Data within no more than 90 (ninety) days after it completes the destruction, unless Data Protection Legislation requires storage.

Records

Where it is applicable under legislation Ecomlad will keep detailed, accurate and up-to-date written records regarding any processing of Personal Data it carries out for User in accordance with Data Protection Legislation, including but not limited to, the access, control and security of the Personal Data, the processing purposes, categories of processing, any transfers of personal data to a third country and related safeguards, and a general description of the technical and organisational security measures (Records).

Ecomlad will ensure that the Records are sufficient to enable User to verify the Ecomlad’s compliance with its obligations under this DPA and the Ecomlad will provide User with copies of the Records upon request.

Audit

User may, prior to the commencement of processing, and at regular intervals thereafter, audit the technical and organizational measures taken by Ecomlad. For such purpose, User may:

1. Obtain information from Ecomlad,
2. Request Ecomlad to submit to User an existing attestation or certificate by an independent professional expert.

Ecomlad shall, upon User’s written request and within a reasonable period of time, provide User with all information necessary for such audit, to the extent that such information is within User’s control and User is not precluded from disclosing it by applicable law, a duty of confidentiality, or any other obligation owed to a third party.

Ecomlad may object in writing to an auditor appointed by User to conduct any audit under this clause if the auditor is, in Ecomlad’s reasonable opinion, not suitably qualified or independent, a competitor of Ecomlad, or otherwise manifestly unsuitable. Any such objection by Ecomlad will require User to appoint another auditor or conduct the audit itself.

Warranties

The User warrants and represents that the Ecomlad’s expected use of the Personal Data for the Business Purposes and as specifically instructed by User will comply with the Data Protection Legislation.

Notice

Any notice or other communication given to a party under or in connection with this DPA must be in writing and delivered to: [email protected]

Clause 17.1 does not apply to the service of any proceedings or other documents in any legal action or, where applicable, any arbitration or other method of dispute resolution.