Data Processing Agreement

This Data Processing Agreement sets out the rights and obligations that apply to the Data Processor’s handling of personal data on behalf of the Data Controller.

This DPA has been designed to ensure the Parties’ compliance with Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), which sets out specific requirements for the content of data processing agreements.

The Data Processor’s processing of personal data takes place for the purpose of providing the services described in the Platform Agreement.

This DPA forms part of, and is incorporated by reference into, the Platform Agreement.

In case of conflict between this DPA and the Platform Agreement, this DPA shall prevail solely in relation to the processing of Personal Data.

The Data Processing Agreement and its Appendix shall be retained in writing as well as electronically by both Parties.

This Data Processing Agreement shall not exempt the Data Processor from obligations to which the Data Processor is subject pursuant to the General Data Protection Regulation or other legislation.

The Data Processor may publish a revised version of this DPA at www.fundframe.io/legal. A revised version applies in accordance with Section 14.3 of the Platform Agreement.

In this DPA, “GDPR” means Regulation (EU) 2016/679, the General Data Protection Regulation. Terms defined in the GDPR, such as “personal data”, “processing” and “personal data breach”, have the same meaning in this DPA, whether or not they are capitalised. Other capitalised terms that are not defined in this DPA, such as “Service”, “Order Form”, “Authorized User” and “Exit Period”, have the meanings given in the Platform Agreement.

The Data Controller shall be responsible to the outside world (including the data subject) for ensuring that the processing of personal data takes place within the framework of the GDPR and the national data protection law that applies to the Data Controller.

The Data Controller shall therefore have both the right and obligation to make decisions about the purposes and means of the processing of personal data.

The Data Controller shall be responsible for ensuring that the processing that the Data Processor is instructed to perform is authorised in law.

The Data Controller shall limit the personal data it provides to the Data Processor to what is necessary for its use of the Service, and shall not include personal data other than contact details in support requests.

The Data Processor shall solely be permitted to process personal data on documented instructions from the Data Controller unless processing is required under EU or Member State law to which the Data Processor is subject; in this case, the Data Processor shall inform the Data Controller of this legal requirement prior to processing unless that law prohibits such information on important grounds of public interest, cf. Article 28(3)(a) of the GDPR.

The Data Processor shall immediately inform the Data Controller if instructions in the opinion of the Data Processor contravene the General Data Protection Regulation or data protection provisions contained in other EU or Member State law.

The Data Controller’s documented instructions at the time this DPA takes effect are this DPA, the Platform Agreement and the Order Form, together with the Data Controller’s use and configuration of the Service. The Data Controller may give further instructions in writing. Where an instruction goes beyond the Service as agreed, the Parties will agree on its implementation, and the Data Controller pays the Data Processor’s reasonable additional costs.

The Data Processor shall ensure that only those persons who are currently authorised to do so are able to access the personal data being processed on behalf of the Data Controller. Access to the data shall therefore without delay be denied if such authorisation is removed or expires.

Only persons who require access to the personal data in order to fulfil the obligations of the Data Processor to the Data Controller shall be provided with authorisation.

The Data Processor shall ensure that persons authorised to process personal data on behalf of the Data Controller have undertaken to observe confidentiality or are subject to suitable statutory obligation of confidentiality.

The Data Processor shall at the request of the Data Controller be able to demonstrate that the employees concerned are subject to the above confidentiality.

The Data Processor shall take all the measures required pursuant to Article 32 of the General Data Protection Regulation which stipulates that with consideration for the current level, implementation costs and the nature, scope, context and purposes of processing and the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Data Controller and Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

The above obligation means that the Data Processor shall perform a risk assessment and thereafter implement measures to counter the identified risk. Depending on their relevance, the measures may include the following:

1. (a) Pseudonymisation and encryption of personal data.
2. (b) The ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services.
3. (c) The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.
4. (d) A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

The Data Processor maintains an information security management system certified to ISO 27001, and implements the technical and organisational measures that this standard and Article 32 of the GDPR require. The measures are described at www.fundframe.io/resources/security and in the trust center (fundframe.eu.trust.site). The Data Processor may update its measures, provided that the overall level of security is not reduced.

Approved Sub-processors

The Data Controller gives the Data Processor a general authorisation to engage other processors (“Sub-processors”) to assist in providing the Service, provided that the Data Processor meets the requirements of Article 28(2) and 28(4) of the GDPR. An up-to-date list of the Data Processor’s Sub-processors is available in its trust center at fundframe.eu.trust.site/subprocessors. The list states, for each Sub-processor, the part of the Service it is used for. A Sub-processor that is used only for a particular module or feature processes personal data only where the Data Controller uses that module or feature.

Obligations for Sub-processors

The Data Processor shall ensure that each Sub-processor is bound by a written agreement imposing data protection obligations that are at least equivalent to those set out in this DPA, particularly with respect to providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of GDPR. The Data Processor remains liable to the Data Controller for the performance of each Sub-processor as for its own, as required by Article 28(4) of the GDPR.

Changes to Sub-processors

The Data Processor shall give the Data Controller at least thirty (30) days’ notice of any intended addition or replacement of a Sub-processor, by updating the list in its trust center and notifying the Data Controller under Section 13 (Notices) of the Platform Agreement. The Data Controller may object in writing within that period on reasonable grounds relating to data protection, and the Parties shall then discuss in good faith to find a solution. If no solution is found within thirty (30) days after the objection, either Party may terminate the affected Service by written notice, and the Data Processor shall refund fees paid in advance for that Service for the period after termination takes effect.

The Data Processor shall solely be permitted to process personal data on documented instructions from the Data Controller, including as regards transfer (assignment, disclosure and internal use) of personal data to third countries or international organisations, unless processing is required under EU or Member State law to which the Data Processor is subject; in such a case, the Data Processor shall inform the Data Controller of that legal requirement prior to processing unless that law prohibits such information on important grounds of public interest, cf. Article 28(3)(a) of the GDPR.

Without the instructions or approval of the Data Controller, the Data Processor therefore cannot – within the framework of this Data Processing Agreement:

1. (a) disclose personal data to a data controller in a third country or in an international organisation
2. (b) assign the processing of personal data to a Sub-processor in a third country
3. (c) have the data processed in another of the Data Processor’s divisions which is located in a third country

By entering into this Data Processing Agreement, the Data Controller approves the transfer of personal data to a third country by the Sub-processors listed in the trust center, and by new Sub-processors to which it does not object under Clause 6.3, provided that each transfer is based on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework, for certified recipients) or on the European Commission’s standard contractual clauses. The Data Controller can find information about each Sub-processor, including its country of processing, in the trust center. Where the trust center does not show the information the Data Controller needs, including the transfer basis for a Sub-processor, the Data Processor provides it on request.

The Data Processor, taking into account the nature of the processing, shall, as far as possible, assist the Data Controller with appropriate technical and organisational measures, in the fulfilment of the Data Controller’s obligations to respond to requests for the exercise of the data subjects’ rights pursuant to Chapter 3 of the General Data Protection Regulation.

This entails that the Data Processor should as far as possible assist the Data Controller in the Data Controller’s compliance with:

1. (a) notification obligation when collecting personal data from the data subject
2. (b) notification obligation if personal data have not been obtained from the data subject
3. (c) right of access by the data subject
4. (d) the right to rectification
5. (e) the right to erasure (‘the right to be forgotten’)
6. (f) the right to restrict processing
7. (g) notification obligation regarding rectification or erasure of personal data or restriction of processing
8. (h) the right to data portability
9. (i) the right to object
10. (j) the right to object to the result of automated individual decision-making, including profiling

The Data Processor shall assist the Data Controller in ensuring compliance with the Data Controller’s obligations pursuant to Articles 32-36 of the General Data Protection Regulation taking into account the nature of the processing and the data made available to the Data Processor, cf. Article 28(3)(f) of the GDPR.

This entails that the Data Processor should, taking into account the nature of the processing, as far as possible assist the Data Controller in the Data Controller’s compliance with:

1. (a) the obligation to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk associated with the processing
2. (b) the obligation to report personal data breaches to the supervisory authority without undue delay and, if possible, within 72 hours of the Data Controller discovering such breach unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons
3. (c) the obligation – without undue delay – to communicate the personal data breach to the data subject when such breach is likely to result in a high risk to the rights and freedoms of natural persons
4. (d) the obligation to carry out a data protection impact assessment if a type of processing is likely to result in a high risk to the rights and freedoms of natural persons
5. (e) the obligation to consult with the supervisory authority prior to processing if a data protection impact assessment shows that the processing will lead to high risk in the lack of measures taken by the Data Controller to limit risk

The Data Controller shall reimburse the Data Processor’s reasonable, documented costs of assistance under Clauses 8.1 and 8.2. No costs are charged for assistance that concerns a personal data breach, or that is needed because the Data Processor has breached this DPA.

On discovery of personal data breach at the Data Processor’s facilities or a Sub-processor’s facilities, the Data Processor shall without undue delay notify the Data Controller.

The Data Processor’s notification to the Data Controller shall, if possible, take place within 24 hours after the Data Processor has discovered the breach to enable the Data Controller to comply with its obligation, if applicable, to report the breach to the supervisory authority within 72 hours.

According to Clause 8.2(b) of this Data Processing Agreement, the Data Processor shall – taking into account the nature of the processing and the data available – assist the Data Controller in the reporting of the breach to the supervisory authority.

This may mean that the Data Processor is required to assist in obtaining the information listed below which, pursuant to Article 33(3) of the General Data Protection Regulation, shall be stated in the Data Controller’s report to the supervisory authority:

1. (a) The nature of the personal data breach, including, if possible, the categories and the approximate number of affected data subjects and the categories and the approximate number of affected personal data records
2. (b) Probable consequences of a personal data breach
3. (c) Measures which have been taken or are proposed to manage the personal data breach, including, if applicable, measures to limit its possible damage

On termination of the processing services, the Data Processor shall be under obligation, at the Data Controller’s discretion, to erase or return all the personal data to the Data Controller and to erase existing copies unless EU law or Member State law requires storage of the personal data. The Data Controller retrieves its data by export during the Exit Period, and erasure follows the timelines in Section 3.7 (Exit Period) of the Platform Agreement.

Upon termination of the processing services, if the Data Controller requests the return of personal data, the Data Processor shall provide the data in a commonly used electronic format, such as CSV or JSON.

The Data Processor shall make available to the Data Controller all information necessary to demonstrate compliance with Article 28 of the General Data Protection Regulation and this Data Processing Agreement, and allow for and contribute to audits, including inspections performed by the Data Controller or another auditor mandated by the Data Controller.

The Data Controller may verify the Data Processor’s compliance: (a) by requesting the Data Processor’s ISO 27001 certificate and the related audit report through the trust center; (b) by sending written questions, which the Data Processor shall answer within a reasonable time; and (c) where (a) and (b) are not sufficient, or where a supervisory authority requires it, by an inspection carried out by the Data Controller or by an independent auditor bound by confidentiality. An inspection requires at least thirty (30) days’ notice, takes place during normal business hours, and may take place no more than once in any twelve (12) month period, unless a Personal Data Breach or a supervisory authority requires otherwise. The Data Controller bears the costs of an inspection, including the Data Processor’s reasonable costs of supporting it, unless the inspection shows that the Data Processor has materially breached this DPA. An inspection does not give access to information about the Data Processor’s other customers.

The Data Controller’s inspection of Sub-processors, if applicable, shall as a rule be performed through the Data Processor. The Data Processor assesses each Sub-processor’s security before engaging it, and monitors it as part of its ISO 27001-certified supplier management. On request, the Data Processor gives the Data Controller information about the assessment.

The Data Processor shall be required to provide the supervisory authorities, which pursuant to applicable legislation have access to the Data Controller’s and Data Processor’s facilities, or representatives acting on behalf of such supervisory authorities, with access to the Data Processor’s physical facilities on presentation of appropriate identification.

This DPA takes effect when an Order Form referencing the Platform Agreement is signed. It remains in force for as long as the Data Processor processes personal data on behalf of the Data Controller, including during the Exit Period and until the personal data has been erased by the Data Processor and its Sub-processors. It cannot be terminated separately from the Platform Agreement.

Either Party may ask for this DPA to be renegotiated if changes in the law require it. Revised versions published by the Data Processor apply under Section 14.3 of the Platform Agreement.

Section 10 (Limitation of Liability) and Section 12 (Governing Law & Jurisdiction) of the Platform Agreement apply to this DPA. This does not limit either Party’s liability to data subjects under Article 82 of the GDPR.