Published: December 22, 2021

Effective: January 01, 2022

1. BACKGROUND

SYSTEMS X CORPORATION AND THE CLIENT ENTERED INTO THE PROFESSIONAL SERVICES AGREEMENT ON THE COMMENCEMENT DATE (WORK ORDER) THAT MAY REQUIRE SYSTEMS X CORPORATION TO PROCESS PERSONAL DATA BY OR COLLECTED FOR THE CUSTOMER.

THIS DATA PROCESSING AGREEMENT (DPA) sets out the additional terms, requirements, and conditions on which SYSTEMS X CORPORATION will obtain, handle, process, disclose, transfer, or store Personal Data when providing services under A WORK ORDER.

2. DEFINITIONS

• Systems X refers to Systems X Corporation, a US-based legal entity registered in the state of Michigan.
• Business Day refers to a day other than a Saturday, Sunday, or public holiday in the United States.
  
  
• Services refer to the technical, implementation, or professional services and any related deliverables provided or to be provided by Systems X for Customer under a work order describing such services and these services terms. The services performed under a work order may be referred to as “Professional Services” or “Technical Services”, as applicable, based on the nature and type of such services.
• Deliverable refers to all property, reports, source code, analyses, recommendations, data, databases, specifications, software, documentation, items, videos, recordings, and other materials provided, created, developed, and delivered according to and described in a work order.
• Security Breach refers to any act or omission that materially compromises the security, confidentiality, or integrity of Personal Data or the physical, technical, administrative, or organizational safeguards put in place to protect it. The loss of or unauthorised access, disclosure, or acquisition of Personal Data is a Security Breach.
  
  
• Data Subject refers to an individual who is the subject of Personal Data.
• Personal Data refers to any information Systems X Corporation processes for the Customer that (1) identifies or relates to an individual who can be identified directly or indirectly from that data alone or in combination with other information in Systems X Corporation's possession or control or that Systems X Corporation is likely to have access to, or (2) the relevant Privacy and Data Protection Requirements otherwise define as protected personal data.
  
  
• Processing, Processes, and Process refers to any activity that involves the use of Personal Data, or as the relevant Privacy and Data Protection Requirements may otherwise define the terms processing, processes, or process. It includes obtaining, recording, holding the data, or carrying out any operation or set of operations on the data, including organizing, amending, retrieving, using, disclosing, erasing, or destroying it. Processing also includes transferring Personal Data to third parties.
  
  
• Work Order refers to a written or electronic (a) work order, (b) statement of work, (c) Proposal, or (d) other ordering documents incorporating these services terms and all exhibits or other documents attached to or incorporated by reference (“Attachments”) therein, describing the services purchased by Customer and executed by the parties or Customer alone, as applicable.

• Work Product refers to all software, authorship, or work developed for Customer in providing the services, including any deliverables produced in connection therewith, whether created solely or jointly with others.

3. PERSONAL DATA TYPES & PROCESSING PURPOSES

3.1

The Customer and the Provider acknowledge that for the purpose of applicable Privacy and Data Protection Requirements, the Customer is the data controller and the Provider is the data processor.

3.2

The Customer retains control of the Personal Data and remains responsible for its compliance obligations under the applicable Privacy and Data Protection Requirements, including providing any required notices and obtaining any required consents, and for the processing instructions it gives to the Provider.

3.3

Customer acknowledges and agrees without generality to the foregoing that it is responsible for (i) the accuracy, quality and legality of Customer Data and the means by which Customer acquired Personal Data; (ii) complying with all necessary transparency and lawfulness requirements under applicable Privacy and Data Protection Requirements for the collection and use of Personal Data, including obtaining any necessary consents and authorisations (particularly for use by Customer); ensuring Customer has the right to transfer, or provide access to, the Personal Data to Provided for Processing in accordance with the terms of the Contract including this DPA (iv) ensuring that Customers instructions to Provider regarding the Processing of Personal Data comply with all applicable laws applicable to emails, the content of the emails and its email deployment practices. Customer shall inform Provider without undue delay if it is not able to comply with its responsibilities under this clause 2.3 or applicable Privacy and Data Protection Requirements.

3.4

Annex A describes the general Personal Data categories and Data Subject types the Provider may process to fulfil the Business Purposes of the Master Agreement.

4. PROVIDER OBLIGATION

4.1

The parties agree that the Contract (including DPA) together with the Customers use of the Services in accordance with the Contract, constitute its complete and final instructions to Provider in relation to the processing of Personal Data, and additional instructions outside the scope of the instructions shall require prior written agreement between the parties. The Provider will only process the Personal Data to the extent as is necessary for the Business Purposes in accordance with the Customer’s instructions. The Provider will not process the Personal Data for any other purpose or in a way that does not comply with this DPA or the Privacy and Data Protection Requirements. The Provider must promptly notify the Customer if, in its opinion, the Customer's instruction would not comply with the Privacy and Data Protection Requirements.

4.2

The Provider must promptly comply with any Customer lawful request or instruction requiring the Provider to amend, transfer, or delete the Personal Data, or to stop, mitigate, or remedy any unauthorised processing. Provider is not responsible for compliance of any Privacy and Data Protection Requirements applicable to Customers industry that is not generally applicable to Provider.

4.3

The Provider will maintain the confidentiality of all Personal Data and will not disclose Personal Data to third parties unless the Customer or this DPA specifically authorises the disclosure, or as required by law. If a law requires the Provider to process or disclose Personal Data, the Provider must first inform the Customer of the legal requirement and give the Customer an opportunity to object or challenge the requirement, unless the law prohibits such notice.

4.4

The Provider will reasonably assist the Customer with meeting the Customer's compliance obligations under the Privacy and Data Protection Requirements, while also considering the nature of the Provider's processing and the information available to the Provider.

4.5

The Provider must promptly notify the Customer of any changes to Privacy and Data Protection Requirements that may adversely affect the Provider's performance of the Master Agreement.

4.6

The Customer acknowledges that the Provider is under no duty to investigate the completeness, accuracy, or sufficiency of any specific Customer instructions from Authorized Persons or the Personal Data other than as required under the Privacy and Data Protection Requirements.

4.7

The Provider will only collect Personal Data for the Customer using a notice or method that the Customer specifically pre-approves in writing, which contains an approved data privacy notice informing the Data Subject of the Customer's identity and its appointed data protection representative, the purpose or purposes for which their Personal Data will be processed, and any other information that, having regard to the specific circumstances of the collection and expected processing, is required to enable fair processing. The Provider will not modify or alter the notice in any way without the Customer's prior written consent.

5. PROVIDER'S EMPLOYEES

5.1

The Provider will limit Personal Data access to: (a) those employees who require Personal Data access to meet the Provider's obligations under this Agreement; and (b) the part or parts of the Personal Data that those employees strictly require for the performance of their duties.

5.2. 

The Provider will ensure that all employees:

a) are informed of the Personal Data's confidential nature and use restrictions;

b) have undertaken training on the Privacy and Data Protection Requirements relating to handling Personal Data and how it applies to their particular duties; and

c) are aware both of the Provider's duties and their personal duties and obligations under the Privacy and Data Protection Requirements and this Agreement.

5.3

The Provider will take reasonable steps to ensure the reliability, integrity, and trustworthiness of any Provider employee with access to the Personal Data, and will conduct background checks consistent with applicable law on those employees.

6. SECURITY

6.1

The Provider must at all times implement appropriate technical and organizational measures to protect Personal Data against unauthorised or unlawful processing, access, copying, modification, storage, reproduction, display, or distribution, and against accidental loss, destruction, or damage including the security measures set out at Annex B.

6.2

The Provider will immediately notify the Customer if it becomes aware of any advance in technology and methods of working, which indicate that the parties should adjust their security measures.

6.3

The Provider must take reasonable precautions to preserve the integrity of any Personal Data it processes and to prevent any corruption or loss of the Personal Data, including but not limited to establishing effective back-up and data restoration procedures.

7. SECURITY BREACH & PERSONAL DATA LOSS

7.1

The Provider will promptly notify the Customer if any Personal Data is lost or destroyed or becomes damaged, corrupted, or unusable. The Provider will restore such Personal Data at its own expense.

7.2

Either party will within 2 Business Days notify the other party if it becomes aware of:

(a) any unauthorised or unlawful processing of the Personal Data; or

(b) any Security Breach.

7.3

Immediately following any unauthorised or unlawful Personal Data processing or Security Breach, the parties will coordinate with each other to investigate the matter. The Provider will reasonably cooperate with the Customer in the Customer's handling of the matter, including:

a) assisting with any investigation;

(b) providing the Customer with physical access to any facilities and operations affected;

(c) facilitating interviews with the Provider's employees, former employees and others involved in the matter; and

(d) making available all relevant records, logs, files, data reporting and other materials required to comply with all Privacy and Data Protection Requirements or as otherwise reasonably required by the Customer.

7.4

The Provider will not inform any third party of any Security Breach without first obtaining the Customer's prior written consent, except when law or regulation requires it.

7.5

The Provider agrees that the Customer has the sole right to determine:

a) whether to provide notice of the Security Breach to any Data Subjects, regulators, law enforcement agencies, or others, as required by law or regulation or in the Customer's discretion, including the contents and delivery method of the notice; and

b) whether to offer any type of remedy to affected Data Subjects, including the nature and extent of such remedy.

7.6

The Provider will cover all reasonable expenses associated with the performance of the obligations under 7.2 and 7.3, unless the Security Breach arose from the Customer's instructions, negligence, wilful default, or breach of this DPA, in which case the Customer will cover all reasonable expenses.

7.7

The Provider will also reimburse the Customer for actual reasonable expenses the Customer incurs when responding to and mitigating damages, to the extent that the Provider caused a Security Breach, including all costs of notice and any remedy as set out in 7.5.

8. TRANSFER OF PERSONAL DATA

8.1

Customer acknowledges and agrees that Provider may access and Process Personal Data on a global basis necessary to provide the Services in accordance with the Contract and in particular where Sub-Processors have operations. Provider will ensure such transfers are made in compliance with the Privacy and Data Protection Requirements.

8.2

If any Personal Data transfer between the Provider and the Customer requires execution of Standard Contractual Clauses in order to comply with the Privacy and Data Protection Requirements, the parties will complete all relevant details in, and execute, the Standard Contractual Clauses, and take all other actions required to legitimise the transfer, including, if necessary:

(a) co-operating to register the Standard Contractual Clauses with any supervisory authority in any member state of the European Economic Area; or

(b) procuring approval from any such supervisory authority; or (c) providing additional information about the transfer to such supervisory authority.

9. SUB-PROCESSORS

9.1

The Customer agrees that the Provider may engage Sub-Processors to process the Personal Data on its behalf. The Provider has currently appointed the Sub-Processors set out in Annex A.

9.2

Where Provider engages Sub-Processors, the Provider will enter into a written contract with the subcontractor that contains terms substantially the same as those set out in this DPA (including where appropriate Standard Contractual Clauses). Provider remains responsible for each Sub-Processors performance of its obligations and for any acts of omissions of such Sub-processor that cause Provider to breach any of its obligations under this DPA.

9.3

The Parties consider the Provider to control any Personal Data controlled by or in the possession of its subcontractors.

9.4

Upon the Customer's written request, the Provider will audit a subcontractor's compliance with its obligations regarding the Customer's Personal Data and provide the Customer with the audit results.

10. COMPLAINTS & DATA SUBJECT RIGHTS REQUESTS

10.1

The Provider must notify the Customer immediately if it receives any complaint, notice, or communication that relates directly or indirectly to the processing of the Personal Data or to either party's compliance with the Privacy and Data Protection Requirements

10.2

The Provider must notify the Customer within 3 Business Days if it receives a request from a Data Subject for access to their Personal Data.

10.3

The Provider will give the Customer its full cooperation and assistance in responding to any complaint, notice, communication, or Data Subject request.

10.4

The Provider must not disclose the Personal Data to any Data Subject or to a third party other than at the Customer's request or instruction, as provided for in this DPA or as required by law.

11. TERM & TERMINATION

11.1

This DPA will remain in full force and effect so long as (a) the Master Agreement remains in effect, or (b) the Provider retains any Personal Data related to the Master Agreement in its possession or control (Term).

11.2

Any provision of this DPA that expressly or by implication should come into or continue in force on or after termination of the Master Agreement in order to protect Personal Data will remain in full force and effect.

11.3

The Provider's failure to materially comply with the terms of this DPA is a material breach of the Master Agreement. In such event, the Customer may terminate any part of the Master Agreement authorising the processing of Personal Data effective immediately upon written notice to the Provider without further liability or obligation.

11.4

If a change in any Privacy and Data Protection Requirement prevents either party from fulfilling all or part of its Master Agreement obligations, the parties will suspend the processing of Personal Data until that processing complies with the new requirements. If the parties are unable to bring the Personal Data processing into compliance with the Privacy and Data Protection Requirement within 20 Business Days, they may terminate the Master Agreement upon written notice to the other party.

12. DATA RETURN & DESTRUCTION

12.1

At the Customer's request, the Provider will give the Customer a copy of, or access to, the Customer's Personal Data in its possession or control, in the format and on the media reasonably specified by the Customer.

12.2

On termination of the Master Agreement for any reason or expiry of its term, the Provider will securely destroy or, if directed in writing by the Customer, return and not retain, the Personal Data related to this DPA in its possession or control, except for one copy that it may retain and use for 36 months for audit purposes only.

12.3

If any law, regulation, or government, or regulatory body requires the Provider to retain any documents or materials that the Provider would otherwise be required to return or destroy, it will notify the Customer in writing of that retention requirement, giving details of the documents or materials that it must retain, the legal basis for retention, and establishing a specific timeline for destruction once the retention requirement ends.

12.4

Where requested by the Customer, the Provider will certify in writing that it has destroyed the Personal Data within 20 Business Days after it completes the destruction.

13. RECORDS

13.1

The Provider will keep detailed, accurate, and up-to-date records regarding any processing of Personal Data it carries out for the Customer, including but not limited to, the access, control, and security of the Personal Data, approved subcontractors and affiliates, and the processing purposes (Records).

13.2

The Provider will ensure that the Records are sufficient to enable the Customer to verify the Provider's compliance with its obligations under this DPA.

14. AUDIT

14.1

At least once per year, the Provider will conduct site audits of its Personal Data processing practices and the information technology and information security controls for all facilities and systems used in complying with its obligations under this DPA, including, but not limited to, obtaining a network-level vulnerability assessment performed by a recognised third-party audit firm based on recognised industry best practices.

14.2

Upon the Customer's written request, the Provider will make all of the relevant audit reports available to the Customer for review. The Customer will treat such audit information as the Provider's confidential information under this Agreement.

14.3

The Provider will promptly address any exceptions noted in the audit information with the development and implementation of a corrective action plan by the Provider's management.

15. WARRANTIES

15.1

The Provider warrants and represents that:

A) its employees, subcontractors, agents and any other person or persons accessing Personal Data on its behalf are reliable and trustworthy and have received the required training on the Privacy and Data Protection Requirements relating to the Personal Data; and

B) it and anyone operating on its behalf will process the Personal Data in compliance with all applicable Privacy and Data Protection Requirements and other laws, enactments, regulations, orders, standards, and other similar instruments; and

C) it has no reason to believe that any Privacy and Data Protection Requirements prevent it from providing any of the Master Agreement's Services; and

D) considering the current technology environment and implementation costs, it will take appropriate technical and organizational measures to prevent the unauthorised or unlawful processing of Personal Data and the accidental loss or destruction of, or damage to, Personal Data, and ensure a level of security appropriate to:

(i) the harm that might result from such unauthorised or unlawful processing or accidental loss, destruction, or damage; and

(ii) the nature of the Personal Data protected; and

(iii) comply with all applicable Privacy and Data Protection Requirement and its information and security policies, including the security measures required in 6.

15.2

The Customer warrants and represents that the Provider's expected use of the Personal Data for the Business Purpose and as specifically instructed by the Customer will comply with all Privacy and Data Protection Requirements.

16. INDEMNIFICATION

16.1

The Provider agrees to indemnify, keep indemnified, and defend at its own expense the Customer against all reasonable costs, claims, damages, or expenses incurred by the Customer or for which the Customer may become liable due to any failure by the Provider or its employees, subcontractors, or agents to comply with any of its obligations under this DPA or applicable Privacy and Data Protection Requirements.

16.2

During the Term, the Provider must, at its own cost and expense, obtain and maintain insurance, in full force and effect, sufficient to cover the Provider's potential indemnity or reimbursement obligations. The Provider will produce the policy and premium payment receipt to the Customer on request. The Provider will give the Customer thirty (30) days' advance written notice if the policy materially changes or is cancelled.

17. NOTICE

17.1

Any notice or other communication given to a party under or in connection with this DPA must be in writing and delivered to: For the Customer: The Customer Account Manager or data privacy officer set out in any Order under the MSA. For the Provider: dpo@systems-x.com.

17.2

Clause 17.1 does not apply to the service of any proceedings or other documents in any legal action or, where applicable, any arbitration or other method of dispute resolution.