Connect your feedback data from Qualtrics to coach and motivate your frontline 👉 Learn More

Data Processing Addendum

(Revision May 2021)

This Data Processing Addendum (“DPA”), forms part of the AskNicely Terms of Use Agreement (“Terms”) or other written or electronic agreement (together the “Agreement”), entered between AskNicely, and the entity that is a party to the Terms together with its Affiliates (as long as they remain Affiliates) which have executed the Terms or made online purchases or signed orders (“Customer”), for the provision of certain services defined in the Terms that requires AskNicely to process certain personal data (defined below) on behalf of Customer. This DPA shall be effective on the date both parties entered the Terms. Each of Customer and AskNicely may be referred to herein as a “Party” and together as the “Parties”.  

1. DEFINITIONS 

1.1  In this DPA, the following terms shall have the meanings set out below and cognate terms shall be construed accordingly: 

(a) “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control,” for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity; 

(b) “AskNicely” means the contracting party in the order form, which may be any of the following affiliated entities: Ask Nicely LLC, Ask Nicely, Ask Nicely B.V.;

(c) “controller” means the entity which, alone or jointly with others, determines the purposes and means of the processing of personal data;

(d) “Data Protection Law” means the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”), UK General Data Protection Regulations (UK GDPR), the UK Data Protection Act 2018 (“DPA 2018”), and the respective implementing regulations for each of the laws and regulations, and the principles and obligations under the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework;

(e) “data subject” means the identified or identifiable person to whom the personal data relates;

(f) “Customer Data” means any information provided by Customer or collected from or on behalf of Customer by AskNicely pursuant to the Agreement;

(g) “personal data” means any information relating to an identified or identifiable natural person;

(h) “personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored or otherwise processed;

(i) “process” or “processing” means any operation or set of operations which is performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

(j) “processor” means the entity which processes personal data on behalf of the controller;

(k) “Services” means all subscription services, professional services, and related support provided pursuant to the Terms and related order forms, authorized instructions, and operational customer service;   

2. DATA PROTECTION AND USE

2.1 Data Protection Commitment.  AskNicely and Customer each undertake to process the personal data pursuant to all applicable requirements under the applicable Data Protection Law, including adherence to security measures required pursuant to Article 32 of the GDPR. 

2.2 Data Processing Role.  The Parties hereby acknowledge that for the purposes of this Agreement, AskNicely is the data processor and Customer is the data controller, unless the data processing is being carried out on behalf of Customer’s business customers or business partners, whereby the respective business customer or business partner is the data controller.  Customer shall ensure that it has obtained the prior specific or general written authorization of its business customers or business partners to engage AskNicely to process the personal data. Customer shall be responsible for the accuracy, quality, and legality of personal data and the means of data acquisition   

2.3 Processing Per Instructions.  AskNicely agrees to process the personal data only as instructed by Customer for the purposes set forth in Exhibit A, which sets out the subject-matter, nature and purpose of processing undertaken by AskNicely, as well as the duration of processing and the types of personal data and categories of data subjects processed. AskNicely shall not process the personal data other than on Customer’s documented instructions unless processing is required by applicable laws to which AskNicely or their contracted processor is subject, in which case AskNicely shall to the extent permitted by applicable laws inform Customer of that legal requirement before the relevant processing of that personal data. In the event AskNicely cannot processed personal data in accordance with this DPA, AskNicely shall notify the other Party, in which case both parties shall determine whether processing can continue with an appropriate level of protection, or whether processing shall cease in no more than ten (10) days. If it is determined that processing shall cease, personal data shall no longer be processed, and all personal data previously processed, and copies thereof shall either be returned or completely destroyed. In determining whether personal data can be processed in accordance with this DPA, AskNicely shall take into account the national laws of the country in which the personal data is processed, the impact on the rights of individuals in regard to their personal data, and any government access to that personal data and whereby specific notice of the access and processing by that government authority cannot be disclosed.

2.4 Restrictions in Processing. AskNicely shall only process the personal data as instructed by Customer to fulfil its Services as set forth in the Agreement, requested through use of the Services, or applicable written instructions. Personal data shall only be further processed for the purpose of anonymizing for use by AskNicely in improving its Services, aggregate analytics, and research and statistical purposes that are unrelated to an identified individual.

2.5 Confidentiality.  AskNicely shall require its employees and contractors authorized to process the personal data to be subject to confidentiality undertakings in relation to the personal data.

2.6 Security.  AskNicely shall maintain appropriate technical and organizational measures for protection of the security, confidentiality, and integrity of Customer Data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored or otherwise processed. AskNicely will not materially decrease the overall security of the Services during a subscription term. Security requirements specific to AskNicely’s technology platform are detailed in Exhibit B.

2.7 Subprocessors.  Customer authorizes AskNicely to engage third-party service providers (“Subprocessors”) to process the personal data of Customer Representatives, Other Business Representatives, and Other Users, to facilitate its Services for all administrative and other business-related activities and shall provide the details of all Subprocessors upon request. AskNicely shall inform Customer in writing, including electronically, at least 30 days in advance of any intended changes that will result in the addition or replacement of a Subprocessor that processes Customer Data under the Agreement thereby giving Customer the opportunity to object to such changes on reasonable grounds prior to the engagement of the concerned Subprocessor(s). In such case Parties will cooperate in good faith to find a mutually acceptable resolution to address such objection. AskNicely agrees to carry out due diligence to confirm its Subprocessors are capable of providing the level of protection required under applicable Data Protection Law, including implementing appropriate technical and organizational measures for processing the personal data and providing protection for the rights of data subjects. If the Subprocessor does not fulfil its data protection obligations under applicable Data Protection Law that relate to its role in processing Customer Data as a Subprocessor, AskNicely shall remain fully liable to Customer as regards the fulfilment of the obligations of the Subprocessor as they relate to Services under this Agreement.   

2.8 Data Transfer to Third Countries or International Organizations.  Customer authorizes AskNicely to transfer the personal data to a third country or an international organization to process the personal data to facilitate its Services on condition that AskNicely ensures adequate protections are in place as required under applicable Data Protection Law for such transfer. Where processing involves transferring of personal data from the European Economic Area or the United Kingdom to a third country or international organization, including to the United States, the Standard Contractual Clauses in Exhibit C shall apply.

2.9 Rights of Data Subjects.  AskNicely agrees to assist Customer to meet its obligations under applicable Data Protection Law for responding to a data subject’s exercise of rights.  AskNicely shall promptly notify Customer if it receives a request from a data subject for whom AskNicely processes personal data under this Agreement in respect of the exercise of the rights of such data subject and shall ensure that it does not respond to that request except on Customer’s documented instructions, or as required by applicable Data Protection Law, in which case AskNicely shall to the extent permitted by law inform Customer of that legal requirement before responding to the request.  

2.10 Data Breach and Other Compliance Obligations. AskNicely shall inform Customer without undue delay after becoming aware of a personal data breach. AskNicely shall make reasonable efforts to identify the cause of the personal data breach and shall take those steps Customer deems necessary and reasonable to remediate the cause of such personal data breach to the extent the remediation is within AskNicely’s reasonable control. The obligations herein shall not apply to personal data breach caused by Customer or Customer’s users. AskNicely agrees to provide information to assist Customer in meeting its requirements for notification to applicable regulatory bodies and data subjects, as required under applicable Data Protection Law. 

2.11 Reasonable Assistance.  AskNicely shall provide reasonable assistance to Customer to comply with its obligations under applicable Data Protection Law, including data protection impact assessments and prior consultation with the applicable supervisory authority. AskNicely shall also provide reasonable assistance in providing information to enable Customer to fulfil its obligations and demonstrate its compliance with applicable Data Protection Law and allow for and contribute to audits and inspections, and a right to assistance in the event an audit is required by an applicable supervisory authority.

2.12 Retention of Data.  The personal data shall be retained by AskNicely for a reasonable time in accordance with its provision of Services.  Upon request, AskNicely shall provide specific information on how its retention policy applies to the personal data processed on behalf of Customer.  Upon termination of AskNicely’s Services under this Agreement by either party, and upon request of Customer within thirty days of notice of termination, AskNicely shall at the choice of Customer, delete or return all or any portion of any personal data in its possession or control, and delete existing copies, with deletion occurring as part of AskNicely’s standard deletion cycle.  The personal data will only be further retained as allowed under applicable Data Protection Law or required under regulatory provisions mandating record retention.

3. LIMITED LIABILITY

3.1 Limitation of Liability. Each party’s liability arising out of or related to this DPA, whether in contract, tort or under any other theory of liability, is subject to Section 8.3 “Limitation of Liability” of the Terms, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Terms and all DPAs together.   

4. GENERAL 

4.1 Precedence. The provisions of this DPA are supplemental to the provisions of the Terms. In the event of inconsistencies between the provisions of this DPA and the provisions of the Terms, the provisions of this DPA shall prevail with respect to the subject matter of this DPA. Where and to the extent that Standard Contractual Clauses in Exhibit C apply, if there is any conflict between this DPA and Standard Contractual Clauses, Standard Contractual Clauses will prevail.

4.2 Severability. The parties agree that, if any section or sub-section of this DPA is held by any court or competent authority to be unlawful or unenforceable, it shall not invalidate or render unenforceable any other section of this DPA.

4.3 Duration. The DPA shall apply for the duration of the provision of Services under the Terms. For the duration of the provision of Services under the Terms, this DPA cannot be terminated unless the parties have executed an agreement governing the processing of personal data in connection with the provision of the Services under the Terms.

4.6 Governing Law; Venue. Except as otherwise provided herein, this DPA will be governed by and construed in accordance with the laws of the state of Oregon, without regard to its conflict of laws rules. Any legal action or proceeding arising under this Agreement DPA brought by Customer will be brought exclusively in the federal or state courts located in Multnomah County, Oregon and the parties hereby irrevocably consent to the personal jurisdiction and venue therein. 

EXHIBIT A

SCOPE OF PROCESSING

This Exhibit A details the scope of the processing of personal data.

Duration of the Processing: 

AskNicely will process the personal data for the duration of the Agreement, unless otherwise instructed by Customer in writing.   

Subject-Matter of the Processing

The subject matter of the processing is fulfilling of the Services under the Agreement, customer feedback surveys, data analytics and reporting through AskNicely technology platform, technological support services, and related administrative, sales and marketing activities relevant to the business relationship.  

Nature and Purpose of the Processing

The nature and purpose of the processing is to fulfill the Agreement and perform services on behalf of Customer to measure customer experience by gathering customer feedback and providing valuable data for business use to improve workforce performance and drive market growth. Other data processing through de-identified, aggregate analysis is for the purpose of improving the AskNicely technology platform and website and for research and statistical purposes. 

Categories of Data Subjects

Each category listed includes current, past and prospective data subjects.

  • Customer Representatives
  • Survey Recipients and Respondents 
  • Other Users
  • Other Business Representatives

Categories of Data

  • Contact information e.g. name, email, social media information
  • Business contact information e.g. name, job title, work email, work phone
  • Technical information e.g. navigation, device ID, IP address, browser type
  • Survey responses e.g. customer feedback, experience ratings, and related information
  • Other information specific to the AskNicely platform and related Services

Special Categories of Data 

The parties do not anticipate sharing personal data that concern any of the following special categories of data:  information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life or any other similar categories of data provided special protections under applicable data protection laws and regulations.  

Processing Operations

The personal data will be subject to the basic processing activities listed below:

  • Receiving data, including collection, accessing, retrieval, recording, and data entry
  • Holding data, including storage, organization and structuring
  • Using data, including analyzing, consultation, testing, automated decision making and profiling
  • Updating data, including correcting, adaptation, alteration, alignment and combination
  • Protecting data, including restricting, encrypting, and security testing
  • Sharing data, including disclosure, dissemination, allowing access or otherwise making available 
  • Returning data to the data exporter or data subject
  • Erasing data, including destruction and deletion
  • Anonymizing or de-identifying data for aggregate use

EXHIBIT B

DATA SECURITY REQUIREMENTS

This Exhibit B details the technical and organizational security measures implemented by AskNicely that shall apply to the processing of personal data under this Agreement. 

AskNicely also publishes a security policy that can be accessed at: Security | AskNicely NPS Software

Technical and Organizational Security Measures Implemented by AskNicely

  • Protect web and database servers using firewalls;
  • Require passwords for account registration requiring minimum password strength attributes;
  • Track user access;
  • Apply role-based security to system access;
  • Use data encryption for personal data appropriate to the type of personal data being processed; 
  • Use third-party vendors maintaining compliance with industry standards to process personal data requiring a higher level of protection than available in AskNicely’s systems;
  • Review and test vendor-supplied patches for compatibility before installation;
  • Perform regular system backups;
  • Perform regular maintenance on systems; 
  • Perform security monitoring on systems;  
  • Contractually require third-party vendors that process personal data to implement technical and organizational security measures appropriate to the risk of the nature, scope, context and purposes of the processing; 
  • Contractually obligate employees to maintain the confidentiality of personal data accessible through their employment; and
  • Require all employees to attend regular security and awareness training. 

Technical and Organizational Security Measures applicable to Amazon Web Services

Technical and Organizational Measures applicable to Amazon Web Services are available at: https://aws.amazon.com/security/?nc=sn&loc=0 (last accessed April 16, 2021), and include:

  • AWS investigates all reported vulnerabilities in any aspect of its cloud services.
  • Data encryption in transit interconnecting datacenters and regions is automatically encrypted at the physical layer before it leaves secured facilities.
  • Encryption for all VPC cross-region peering traffic, and customer or service-to-service TLS connections.
  • Tools managed to encrypt data in transit and at rest to ensure only authorize users can access data.
  • Use of keys managed by AWS Key Management Systems or managed using encryption keys with Cloud HSM using FIPS 140-2 Level 3 validated HSMs.
  • AWS supports more security standards and compliance certifications than any other offering, including PCI-DSS, HIPAA/HITECH, FedRAMP, GDPR, FIPS 140-2, and NIST 800-171, helping satisfy compliance requirements for virtually every regulatory agency around the globe.

EXHIBIT C

STANDARD DATA PROTECTION CLAUSES FOR TRANSFER TO THIRD COUNTRY

Standard Contractual Clauses (processors)

For the purposes of Article 26(2) of Directive 95/46/EC for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection. 

Customer 
(the data exporter)

And

Ask Nicely Holdings Inc., (“AskNicely” or “Service Provider”)
1615 SE 3rd Avenue, Floor 3
Portland, Oregon 97214 
United States of America 
(the data importer)

each a “party”; together “the parties”,

HAVE AGREED on the following Contractual Clauses (the Clauses) in order to adduce adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for the transfer by the data exporter to the data importer of the personal data specified in Appendix 1.

Background

The data exporter has entered into an Agreement with the data importer. Pursuant to the terms of the Agreement it is contemplated that services provided by the data importer will involve the transfer of personal data to data importer. Data importer is located in a country not ensuring an adequate level of data protection. To ensure compliance with Directive 95/46/EC and applicable data protection law, the controller agrees to the provision of such services, including the processing of personal data incidental thereto, subject to the data importer’s execution of, and compliance with, the terms of these Clauses. 

Clause 1: Definitions

For the purposes of the Clauses:

(a) 'personal data', 'special categories of data', 'process/processing', 'controller', 'processor', 'data subject' and 'supervisory authority' shall have the same meaning as in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data; except that, if these Clauses govern a transfer of data relating to identified or identifiable corporate (as well as natural) persons, the definition of "personal data" is expanded to include those data;

(b) 'the data exporter' means the controller who transfers the personal data;

(c) 'the data importer' means the processor who agrees to receive from the data exporter personal data intended for processing on his behalf after the transfer in accordance with his instructions and the terms of the Clauses;

(d) 'the subprocessor' means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;

(e) 'the applicable data protection law' means the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”), UK General Data Protection Regulations (UK GDPR), the UK Data Protection Act 2018 (“DPA 2018”), and the respective implementing regulations for each of the laws and regulations, and the principles and obligations under the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework, and any other legislation protecting the fundamental rights and freedoms of individuals and, in particular, their right to privacy with respect to the processing of personal data applicable to a data controller in the Member State or jurisdiction in which the data exporter is established;

(f) 'technical and organizational security measures' means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

Clause 2: Details of the transfer

The details of the transfer and in particular the special categories of personal data where applicable are specified in Appendix 1 which forms an integral part of the Clauses.

Clause 3: Third-party beneficiary clause

1. The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary. 

2. The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. 

3. The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses. 

4. The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law. 

Clause 4: Obligations of the data exporter

The data exporter agrees and warrants: 

(a) that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State or jurisdiction where the data exporter is established) and does not violate the relevant provisions of that State or jurisdiction;

(b) that it has instructed and throughout the duration of the personal data processing services will instruct the data importer to process the personal data transferred only on the data exporter's behalf and in accordance with the applicable data protection law and the Clauses;

(c) that the data importer will provide sufficient guarantees in respect of the technical and organizational security measures specified in Appendix 2 to this contract;

(d) that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;

(e) that it will ensure compliance with the security measures;

(f) that, if the transfer involves special categories of data, the data subject has been informed or will be informed before, or as soon as possible after, the transfer that its data could be transmitted to a third country not providing adequate protection;

(g) to forward any notification received from the data importer or any subprocessor pursuant to Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter decides to continue the transfer or to lift the suspension;

(h) to make available to the data subjects upon request a copy of the Clauses, with the exception of Appendix 2, and a summary description of the security measures, as well as a copy of any contract for subprocessing services which has to be made in accordance with the Clauses, unless the Clauses or the contract contain commercial information, in which case it may remove such commercial information;

(i) that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and

(j) that it will ensure compliance with Clause 4(a) to (i).

Clause 5: Obligations of the data importer

The data importer agrees and warrants:

(a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;

(b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;

(c) that it has implemented the technical and organizational security measures specified in Appendix 2 before processing the personal data transferred;

(d) that it will promptly notify the data exporter about:

(i) any legally binding request for disclosure of the personal data by a law enforcement authority unless otherwise prohibited, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation,

(ii) any accidental or unauthorized access, and

(iii) any request received directly from the data subjects without responding to that request, unless it has been otherwise authorized to do so;

(e) to deal promptly and properly with all inquiries from the data exporter relating to its processing of the personal data subject to the transfer and to abide by the advice of the supervisory authority with regard to the processing of the data transferred;

(f) at the request of the data exporter to submit its data processing facilities for audit of the processing activities covered by the Clauses which shall be carried out by the data exporter or an inspection body composed of independent members and in possession of the required professional qualifications bound by a duty of confidentiality, selected by the data exporter, where applicable, in agreement with the supervisory authority;

(g) to make available to the data subject upon request a copy of the Clauses, or any existing contract for subprocessing, unless the Clauses or contract contain commercial information, in which case it may remove such commercial information, with the exception of Appendix 2 which shall be replaced by a summary description of the security measures in those cases where the data subject is unable to obtain a copy from the data exporter;

(h) that, in the event of subprocessing, it has previously informed the data exporter and obtained its prior written consent;

(i) that the processing services by the subprocessor will be carried out in accordance with Clause 11;

(j) to send promptly a copy of any subprocessor agreement it concludes under the Clauses to the data exporter.

Clause 6: Liability

1. The parties agree that any data subject, who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or subprocessor is entitled to receive compensation from the data exporter for the damage suffered.

2. If a data subject is not able to bring a claim for compensation in accordance with paragraph 1 against the data exporter, arising out of a breach by the data importer or his subprocessor of any of their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data subject may issue a claim against the data importer as if it were the data exporter, unless any successor entity has assumed the entire legal obligations of the data exporter by contract of by operation of law, in which case the data subject can enforce its rights against such entity.

The data importer may not rely on a breach by a subprocessor of its obligations in order to avoid its own liabilities.

3. If a data subject is not able to bring a claim against the data exporter or the data importer referred to in paragraphs 1 and 2, arising out of a breach by the subprocessor of any of their obligations referred to in Clause 3 or in Clause 11 because both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, the subprocessor agrees that the data subject may issue a claim against the data subprocessor with regard to its own processing operations under the Clauses as if it were the data exporter or the data importer, unless any successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law, in which case the data subject can enforce its rights against such entity. The liability of the subprocessor shall be limited to its own processing operations under the Clauses.

Clause 7: Mediation and jurisdiction

1. The data importer agrees that if the data subject invokes against it third-party beneficiary rights and/or claims compensation for damages under the Clauses, the data importer will accept the decision of the data subject:

(a) to refer the dispute to mediation, by an independent person or, where applicable, by the supervisory authority;

(b) to refer the dispute to the courts in the Member State or jurisdiction in which the data exporter is established.

2. The parties agree that the choice made by the data subject will not prejudice its substantive or procedural rights to seek remedies in accordance with other provisions of national or international law.

Clause 8: Cooperation with supervisory authorities

1. The data exporter agrees to deposit a copy of this contract with the supervisory authority if it so requests or if such deposit is required under the applicable data protection law.

2. The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.

3. The data importer shall promptly inform the data exporter about the existence of legislation applicable to it or any subprocessor preventing the conduct of an audit of the data importer, or any subprocessor, pursuant to paragraph 2. In such a case the data exporter shall be entitled to take the measures foreseen in Clause 5 (b).

Clause 9: Governing Law

The Clauses shall be governed by the law of the Member State or jurisdiction in which the data exporter is established.

Clause 10: Variation of the contract

The parties undertake not to vary or modify the Clauses. This does not preclude the parties from adding clauses on business related issues where required as long as they do not contradict the Clause.

Clause 11: Subprocessing

1. The data importer shall not subcontract any of its processing operations performed on behalf of the data exporter under the Clauses without the prior written consent of the data exporter. Where the data importer subcontracts its obligations under the Clauses, with the consent of the data exporter, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on the data importer under the Clauses. Where the subprocessor fails to fulfil its data protection obligations under such written agreement the data importer shall remain fully liable to the data exporter for the performance of the subprocessor's obligations under such agreement. 

2. The prior written contract between the data importer and the subprocessor shall also provide for a third-party beneficiary clause as laid down in Clause 3 for cases where the data subject is not able to bring the claim for compensation referred to in paragraph 1 of Clause 6 against the data exporter or the data importer because they have factually disappeared or have ceased to exist in law or have become insolvent and no successor entity has assumed the entire legal obligations of the data exporter or data importer by contract or by operation of law. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.

3. The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State or jurisdiction in which the data exporter is established.

4. The data exporter shall keep a list of subprocessing agreements concluded under the Clauses and notified by the data importer pursuant to Clause 5 (j), which shall be updated at least once a year. The list shall be available to the data exporter's data protection supervisory authority. 

Clause 12: Obligation after the termination of personal data processing services

1. The parties agree that on the termination of the provision of data processing services, the data importer and the subprocessor shall, at the choice of the data exporter, return all the personal data transferred and the copies thereof to the data exporter or shall destroy all the personal data and certify to the data exporter that it has done so, unless legislation imposed upon the data importer prevents it from returning or destroying all or part of the personal data transferred. In that case, the data importer warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.

2. The data importer and the subprocessor warrant that upon request of the data exporter and/or of the supervisory authority, it will submit its data processing facilities for an audit of the measures referred to in paragraph 1.

On behalf of the data exporter: 

See signatory to the Terms for Customer

On behalf of the data importer:

See signatory to the Terms for AskNicely

APPENDIX 1 TO THE STANDARD CONTRACTUAL CLAUSES

This Appendix forms part of the Clauses and must be completed and signed by the parties.

The jurisdiction may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix.

Data exporter

The data exporter is the Customer and engages with AskNicely for specific services that include AskNicely’s proprietary customer feedback software, whereby personal data is transferred for processing and storage through the technology platform, related customer support, and administrative functions.  

Data importer

The data importer is AskNicely, the operator of customer feedback software. AskNicely operates data centers in various locations, including USA, Germany, and Australia, for purposes of processing personal data central to its software involving customer feedback and related data analytics and reporting under the Agreement. Account services and customer support services are performed by AskNicely staff in office locations, including in the Netherlands, United States, and New Zealand, where staff access data in the designated data center to perform the tasks relevant to their job roles. The main administrative offices of AskNicely are in Oregon in the United States, from where staff perform administrative functions, involving processing of data in the United States related to the personal data of representatives of AskNicely Customers. The purposes of processing personal data are set out in Exhibit A of the DPA.

Data subjects

The personal data transferred concern the categories of data subjects set out in Exhibit A of the DPA.

Categories of data

The personal data transferred concern the categories of data set out in Exhibit A of the DPA.

Special categories of data (if appropriate)

The parties do not anticipate the transfer of special categories of data. If special categories of data are included in processing under the Standard Contractual Clauses, the details of these special categories are set out in Exhibit A of the DPA.

Processing operations

The personal data transferred will be subject to the basic processing activities set out in Exhibit A of the DPA.

DATA EXPORTER: 

See signatory to the Terms for Customer

DATA IMPORTER: 

See signatory to the Terms for AskNicely

APPENDIX 2 TO THE STANDARD CONTRACTUAL CLAUSES

This Appendix forms part of the Clauses.

Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c):

Data importer shall implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored or otherwise processed. 

The technical and organizational security measures implemented by the data importer are set out in Exhibit B of the DPA. 

DATA EXPORTER: 

See signatory to the Terms for Customer

DATA IMPORTER: 

See signatory to the Terms for AskNicely

Time to start leading from the frontline?

businessman checking phone and smiling