Data Processing Agreement

Version: 1.0

Last updated: 10 May 2023

Effective date: 10 May 2023

I. Definition

1. 1.1. In addition to the terms defined elsewhere in this Agreement and the Main Agreement, for all the purposes of the subject matter hereof, the terms included in Annex 1 (the “Definitions”) herein shall have the meanings set forth therein.
2. 1.2. The Parties mutually agree and understand that for the purposes of this Agreement, all the definitions of the European Data Protection Laws are adopted.

II. Responsibilities of You

1. 2.1. In line with the provisions of this DPA and Main Agreement, You are responsible to comply as Data Controller with all requirements applicable to your operations under applicable Data Protection Laws, for the Processing of Personal Data.
2. 2.2. You agree and acknowledge that without prejudice to the generality of the below; you are responsible for:
   1. (i) The accuracy, quality, and legality of the Personal Data provided by You to the Company for the purposes of the Services as well as the means and methods of acquiring that;
   2. (ii) Compliance with all necessary transparency and lawfulness requirements under applicable Data Protection Laws, including European Data Protection Laws;
   3. (iii) For the collection and use of the Personal Data, including obtaining any necessary consents and authorizations, particularly for use by the User for marketing purposes;
   4. (iv) Ensuring that You have the right to transfer or provide access to the Personal Data to us for Processing in accordance with the terms of this DPA and Main Agreement;
   5. (v) Ensuring that You comply with any laws applicable to You, including but not limited to Data Protection Laws, for any emails or other content created, sent, or otherwise managed through our Services.
3. 2.3. You hereby confirm and agree to inform the Company promptly and without any undue delay, if You are not able to comply with your obligations herein, and specifically under the applicable Data Protection Laws.
4. 2.4. You hereby acknowledge and understand that the provisions herein and any relevant provisions of the Main Agreement and any additional written request under Your capacity as a Data Subject; shall constitute the complete and final Instructions of You as Data Controller for the purposes of this DPA for and in relation to the Processing of Your Personal Data.
5. 2.5.You hereby acknowledge, understand, and agree that any additional Instructions outside the scope herein shall require Your prior written request.

III. Responsibilities of the Company

1. 3.1. The Company shall only Process Personal Data for the purpose described in this DPA and in line with Annex 2 herein (the “Details of Processing”) or as otherwise agreed within the scope of your lawful Instructions, except where and to the extent otherwise required by the Data Protection Laws, including but not limited to European Data Protection Laws and other applicable laws and regulations relevant to the Parties.
2. 3.2. The Company shall not be held responsible and liable for compliance with applicable Data Protection Laws which apply solely to You and/or Your industry and are not legally applicable to PinChat’s operations.
3. 3.3. The Company shall notify You immediately and without any undue delay, to the extent permitted by law; where it is deemed the latter is unable to Process Personal Data in accordance with the provisions of this DPA and due to legal requirements of applicable laws and/or regulations.

IV. Data Subject Requests

1. 4.1. You hereby acknowledge, agree, and accept that the Company shall provide You with controls in the Software via which You can retrieve, correct, delete or restrict Personal Data in order to assist You in connection with the requirements of Data Protection Laws.
2. 4.2. The Company may, subject to a written request by You, provide reasonable assistance for responding to any Data Subject Requests or requests from Data Protection Authorities relating to the Processing of Personal Data under this DPA, subject to any reimbursement deemed necessary.
3. 4.3. You undertake the whole, exclusive, and sole responsibility to respond to Data Subject Request(s) or other communication regarding the Processing of Personal Data from the individual(s) who is/are identified as Your client and may be addressed to the Company, subject to prompt notification of such a request from us to You.

V. Sub-Processors

1. 5.1. You hereby acknowledge, agree, accept and authorize the appointment of the Sub-Processors for the Process of Personal Data pursuant to this DPA and Main Agreement included in Annex 4 herein, the Sub-Processors’ List.
2. 5.2. The Company hereby ensures that where a Sub-Processor is appointed, the relevant legal agreement to be concluded between those shall include appropriate data protection terms subject to appropriate Data Protection Laws and impose at least the same level of protection for Personal Data, as the provisions of this DPA and where deemed necessary, including the last version of Standard Contractual Clauses, as issued by the European Commission.
3. 5.3. The Company shall remain responsible for each Sub-processor’s compliance with the obligations of this DPA and for any acts or omissions of such Sub-Processor that cause us to breach any of its obligations under this DPA.

VI. Data Transfers

1. 6.1. You hereby acknowledge, consent, and authorize the Company, subject to provisions herein; to perform necessary Data Transfers for internal and external business operations to third parties identified as Sub-Processors herein which may be located outside the EU and/or the EEA.
2. 6.2. Pursuant to clause 6.1. above, both Parties hereby confirm and agree that any Data Transfers will be performed solely for the purpose of the Main Agreement, this DPA, and any additional written Instructions communicated from You to the Company, only for the subject matter.
3. 6.3. The Parties hereby mutually agree that pursuant to clause 6 herein, the Company shall perform any and all Data Transfers subject to the provisions of Chapter 5 (Article 44-50) of the GDPR and always in compliance with the requirements of applicable Data Protection Laws for the duration of this DPA and the Main Agreement.
4. 6.4. Pursuant to clause 6.3 above, the Company shall not perform any Data Transfer of European Data to any country or recipient not recognized as providing an adequate level of protection for Personal Data, in accordance with the provisions of the European Data Protection Laws; unless such measures are first taken to ensure the transfer is in compliance with applicable European Data Protection Laws.

VII. Standard Contractual Clauses for the Parties

1. 7.1. The Parties hereby agree that where they should conclude Standard Contractual Clauses for pursuant to the Main Agreement for the provision of Services and as part of this DPA, the provisions of Annex 5 herein shall apply as may be automatically amended to reflect any changes to the European Data Protection Laws.
2. 7.2. Pursuant to Clause 7.1. the Parties hereby mutually understand and agree that the Company undertakes the rights and obligations of the Data Importer and You the rights and obligations of the Data Exporter, as defined in the Standard Contractual Clauses and those shall come into effect on the later of either Party becoming a party to them and the commencement of the relevant data transfer.
3. 7.3. The Parties hereby mutually agree that where the Standard Contractual Clauses are applicable and there is a conflict with any provision of this DPA, the Standard Contractual Clauses will prevail to the extent of such conflict for the subject matter.

VIII. Additional Provisions

IX. Parties to the DPA

1. When You sign-up and accept the PinChat.me Terms & Conditions for the PinChat.me Software Solution, You as a User of the System enter into this DPA on behalf of Yourself and where applicable and to the extent permitted by law and applicable Data Protection Laws, in the name and on behalf of Your Permitted Affiliates, establishing a separate DPA between us and each such Permitted Affiliate subject to the Agreement and provisions herein.
2. 9.2. You hereby agree and acknowledge that each Permitted Affiliate agrees to be bound by the obligations of this DPA and as applicable to the Main Agreement.
3. 9.3. You hereby agree and acknowledge that to the extent permitted by law, for the purposes of this DPA and except as otherwise provided herein, “User”, “You” and “Your” will include You and such Permitted Affiliates.
4. 9.4. The legal entity agreeing to this DPA as User represents that it is authorized to agree to and enter into this DPA for and on behalf of itself and, as applicable, each of its Permitted Affiliates.

X. General Provisions

1. 10.1. This DPA will remain in force from the Effective Date and until the Data Controller or Data Processor terminates the Main Agreement, in line with applicable provisions.
2. 10.2. This DPA may be terminated by either party with a 30 (thirty) days written notice, pursuant to the provisions of the Main Agreement and by canceling the system in system settings.
3. 10.3. Notwithstanding anything else to the contrary in this DPA and Main Agreement, PinChat.me reserves the right to make any updates and amendments to this DPA subject to any additional terms herein.
4. 10.4. If any individual provisions of this DPA are determined to be invalid or unenforceable, the validity and enforceability of the other provisions of this DPA will not be affected.
5. 10.5. Neither party may, without the prior written consent of the other party assign, transfer, charge, license or otherwise deal in or dispose of any contractual rights or obligations under this Agreement.
6. 10.6. The Parties and Permitted Affiliates' liability arising out of or related to this DPA in whole whether in contract, tort, or under any other theory of liability, will be subject to the limitations and exclusions of liability set out in the Main Agreement.
7. 10.7. The Parties hereby agree and accept the choice of the jurisdiction indicated in the Main Agreement in respect of this DPA.

ANNEX 1: DEFINITIONS

• “Data Controller”: means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
• “Data Protection Laws”: means all applicable worldwide legislation relating to data protection and privacy which applies to the respective Party in the role of Processing Personal Data in question under the Agreement, including without limitation:
  • (1) the European Data Protection Laws;
  • (2) the California Consumer Privacy Act of 2018 (“CCPA”);
  • (3) the data protection and privacy laws of Australia and Singapore;
  • (4) and other; in each case as amended, repealed, consolidated, or replaced from time to time.
• “Data Subject”: means the individual to whom Personal Data relates.
• “Data Processor”: means a natural or legal person, public authority, agency, or other body which Processes Personal Data on behalf of the Data Controller.
• "Europe": means the European Union, the European Economic Area, and/or their member states.
• “European Data”: means Personal Data that is subject to the protection of European Data Protection Laws, defined below.
• "European Data Protection Laws": means data protection laws applicable in Europe, including:
  • (1) Regulation 2016/679 - the EU General Data Protection Regulation ("GDPR");
  • (2) Directive 2002/58/EC - the Directive on Privacy and Electronic Communications;
  • (3) Applicable national implementations of 1 and 2 points above;
  • (4) Any applicable national legislation that replaces or converts in domestic law the GDPR or any other law relating to data and privacy as a consequence of the United Kingdom leaving the European Union; in each case, as may be amended, superseded, or replaced.
• “EU-US Privacy Shield”: the self-certification program operated by the U.S. Department of Commerce and approved by the European Commission, as may be amended, superseded, or replaced.
• “Instructions”: any written, documented instructions issued by the Data Controller to the Data Processor, and directing the same to perform a specific or general action with regard to Personal Data, including, but not limited to, depersonalizing, blocking, deletion, making available.
• "Permitted Affiliates": shall include any of Your Affiliates that are permitted to obtain the Services on your behalf, pursuant to the Main Agreement, but have not signed their own separate agreement with us and are not users and qualify as a Controller of Personal Data Processed by us, and can be subject to European Data Protection Laws.
• “Personal Data”: means any information relating to an identified or identifiable individual where such information is contained within the Account (as defined in the Main Agreement) and is protected as other personal information or personally identifiable information under applicable Data Protection Laws.
• “Personal Data Breach”: shall mean a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed by us and/or our Sub-Processors in connection with the provision of the Services but does not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.
• “Processing”: shall mean any operation or set of operations which is performed on Personal Data, encompassing the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or erasure of Personal Data and the terms “Process”, “Processes” and “Processed” will be construed accordingly.
• “Services”: shall have the same meaning as in the Main Agreement.
• “Standard Contractual Clauses”: means the standard contractual clauses for Data Processors approved pursuant to the European Commission’s relevant decision and as included in Annex 5 herein which forms part of the Agreement and may be amended, superseded, or replaced.
• “Sub-Processor”: means any Data Processor engaged by us to assist in fulfilling our obligations with respect to the provision of the Services under the Main Agreement and may include third parties, excluding any employee or consultant of PinChat.me

ANNEX 2: DETAILS OF PROCESSING

This Annex 2: Details of Processing forms part of the DPA.

• Nature and Purposes of the Process: the Company will Process Personal Data as required for the purposes of providing the Services, pursuant to the Main Agreement and as may further be specified in additional documentation which forms part of the Main Agreement and DPA.
• Duration of the Processing: subject to any provisions contained herein specifying otherwise, Processing of Personal Data shall occur for the duration of the Main Agreement, unless otherwise agreed in writing.
• Categories of Data Subjects: pursuant to the provisions of the Main Agreement, Data Subjects shall include any type of User’s clients and therefore may vary by the system usage from the Data Controller.
• Categories of Personal Data: pursuant to the provisions of the Main Agreement, categories of Personal Data may vary in accordance with the usage of the System and my cover the below:
  • name and surname
  • email address
  • phone numbers
  • information that is requested by the Data Controller through the usage of additional fields
  • chat logs between the Data Controller and the individual
  • usage from the Data Controller and is not absolute.
• Processing Operations: include the standardized internal processes in which system users’ data are continuously or systematically collected, stored, and used for the provision of the Services, in line with the Main Agreement. The Data Processor will Process Personal Data on behalf of the Data Controller for the purpose of using the Appointment Scheduling System and accepting appointments, sending reminders, processing payments, selling products, making promotions, and other related activities allowed by our custom features.

ANNEX 3: SECURITY MEASURES

• This Annex 3 Security measure forms part of the DPA and all capitalized terms, not otherwise defined herein, shall have the same meaning set forth in the Main Agreement.
• The measures herein form part of the ISMS which shall be maintained in accordance with best practices and standards.

ANNEX 4: SECURITY MEASURES

Read this Annex 4 in conjunction with Clause 5 and other applicable provisions of the DPA.

ANNEX 5: STANDARD CONTRACTUAL CLAUSES

• The latest version of the Standard Contractual Clauses available on the official website of the European Commission here is implemented and followed for the subject matter.
• The SCC is part of this Agreement, to the extent applicable to the Parties in accordance with the European Data Protection Laws.
• For the purposes of this Agreement and the contractual relationship of the Parties, Module Two: Transfer between Controller to Processor is adopted.