Privacy Policy Page

HOIST DATA PROCESSING ADDENDUM

This Data Processing Addendum (“DPA”) is included by reference to the Master Services Agreement, Digital Service Agreement or an Order between HOIST and Customer (the “Agreement”). In case of any conflict or inconsistency with the terms of the Agreement, this DPA will take precedence over the terms of the Agreement to the extent of such conflict or inconsistency. This DPA will be effective for the period HOIST provides services to Customer under the Agreement to which this DPA applies.

The term of this DPA will follow the term of the Agreement. Capitalized words not otherwise defined in this DPA will have the meaning as set forth in the Agreement.

1. DEFINITIONS

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.

“Data Protection Law” refers to all Personal Data protection and privacy laws and regulations applicable to HOIST including, but not limited to, the General Data Protection Regulation (“GDPR”), UK General Data Protection Regulation (“UK GDPR”), Swiss Federal Data Protection Act (“Swiss DPA”), Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), the California Civil Code Sec. 1798.100 et seq. (also known as the California Consumer Privacy Act) )”CCPA”), and other US state privacy laws, in each case as may be amended, superseded, or replaced.

“Data Subject” means the identified or identifiable person to whom Personal Data relates.

“EU/UK” means the European Union, the European Economic Area and/or their member states, Switzerland and the United Kingdom:

“Order” means any statement of work, agreement or order for products and/or services that references this Agreement and is executed between HOIST and the Customer.

“Personal Data” means any information relating to (i) an identified or identifiable natural person and, (ii) an identified or identifiable legal entity (where such information is protected similarly as personal data or personally identifiable information under applicable Data Protection Laws).

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed. "Personal Data Breach" will not include unsuccessful attempts or activities that do not compromise the security of Personal Information, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems

“Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.

“Processor” means the entity which processes Personal Data on behalf of the Controller including as applicable any "service provider" as that term is defined by the CCPA.

“Standard Contractual Clauses” means:

(a) for EU Personal Data, means the standard contractual clauses for Processors Annexed to the European Commission’s Decision (EU) 2021/914 of 4 June 2021, including the text from Module 2 of such clauses, not including any clauses marked as optional, and as further described in this DPA as may be amended, superseded or replaced; and

(b) for UK Personal Data, the EU SCCs with the changes set out in Part 2 (Mandatory Clauses) of the International Data Transfer Addendum issued by the Information Commissioner in accordance with the UK Data Protection Act 2018, as it is revised under Clause 18 of those Mandatory Clauses (“UK SCCs”); and

(c) in respect of Swiss Personal Data, the EU SCCs, provided that any references in the EU SCCs to the GDPR shall refer to the Swiss Federal Act on Data Protection 1992 ("FADP"); the term 'member state' must not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence in accordance with clause 18(c) of the EU SCC; and the EU SCCs shall also protect the data of legal persons until the entry into force of the revised FADP.

“Sub-Processor” means any Processor engaged by HOIST to assist in fulfilling its obligations with respect to the provision of the products or services under the Agreement and may include third parties but exclude any HOIST employee or consultant.

2. ROLE OF THE PARTIES

2.1. It is acknowledged and agreed that with regard to Processing of Personal Data under this DPA, Customer is the Controller and HOIST is the Processor (whether acting itself or through Sub-Processors pursuant to this DPA).

2.2. Both Parties shall, in their respective roles, comply with all applicable Data Protection Laws with regard to Personal Data Processed under this DPA.

2.3. The duration of the Processing, the nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects Processed under this DPA are specified in the Annex 1 of Attachment 1 hereto, as may be updated by the Parties as applicable from time to time.

2.4. Customer shall, in its use and receipt of the services provided or made available by HOIST pursuant to the Agreement (“HOIST Services”), Process Personal Data in accordance with the requirements of Data Protection Laws including any applicable requirement to provide notice to Data Subjects of the use of HOIST as Processor and/or its use of HOIST Services.

3. CUSTOMER OBLIGATIONS

3.1 Customer acts as, and as between Customer and HOIST will at all times remain, the Controller: (i) concerning any Personal Data Processed by HOIST or its Sub-Processors under this DPA, and (ii) as applicable, on behalf of and in the name of its Affiliates, end-customers, suppliers, contractors and/or partners in their capacity as Controllers and whose Personal Data at any time is Processed by HOIST or its Sub-Processors under this DPA.

3.2 Except as may be otherwise required under the applicable Data Protection Law, Customer shall, on behalf of any other Controller referenced above, serve as a single point of contact for HOIST in all matters under this DPA and shall be responsible for the internal coordination, review and submission of instructions or requests to HOIST as well as the onward distribution of any information, notifications and reports provided by HOIST hereunder.

3.3 In its capacity as Controller, the Customer confirms (for its own part and on behalf of each other Controller referenced above) that it is entitled to provide access to Personal Data to HOIST for the purposes hereof and, consequently, that it has a lawful basis and any necessary approvals from any relevant Data Subjects for HOIST’s performance of the services under the terms of the Agreement.

3.4 Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data. Customer represents that its use of the HOIST Services will not violate the rights of any Data Subject that has opted out from the sale of or other disclosure of Personal Data, to the extent applicable under the CCPA.

4. HOIST OBLIGATIONS

4.1Subject to as legally permitted its capacity as Processor under this DPA, HOIST shall Process Personal Data hereunder solely in accordance with the documented instructions of the Customer, for the following limited purposes:

(a) performance of the HOIST Services under the terms of the Agreement;

(b) where applicable to the HOIST Services provided, setting up, operating, and monitoring the underlying infrastructure (hardware, software, servers, environments and connectivity) required to provide the services to Customer and to meet the technical, security and organizational requirements for the Processing of the Personal Data in connection therewith;

(d) executing documented instructions of Customer provided such instructions relate to and are consistent with the services provided by HOIST;

(e) addressing service issues or technical problems; and/or

(f) meeting any express requirement under the applicable law, in which case HOIST shall, unless it is prohibited by applicable law from doing so, inform Customer of that legal requirement before Processing.

4.2 HOIST will report to Customer without undue delay any request, demand or order received by HOIST from a competent supervisory authority or a Data Subject relating to the Processing of Personal Data under this DPA.

4.3. Taking into account the nature of the Processing, HOIST will assist Customer in complying with its obligation to respond to requests of Data Subjects under Data Protection Laws (including requests for exercising Data Subjects’ rights under the applicable Data Protection Law) by appropriate technical and organizational measures, insofar as this is possible provided that HOIST will provide such assistance to the extent:

(a) the information is available to HOIST, and such information is not otherwise available to Customer or the requested assistance cannot practicably be performed by Customer;

(b) Customer acknowledges that HOIST has no responsibility to interact directly with any Data Subject or supervisory authority in respect of any request, demand or order (except as expressly provided under the applicable Data Protection Law or as otherwise agreed by the Parties in writing); and

(c) to the extent legally permitted, Customer shall be responsible for any costs arising from HOIST’s provision of such assistance.

4.4 Subject to applicable legal retention obligations, upon termination of the Agreement, HOIST will return to Customer or delete any Personal Data in accordance with the procedures and timeframes applied by HOIST from time to time, and if requested confirm such deletion to Customer in writing.

4.5 HOIST will only rely on personnel in the Processing of Personal Data who are contractually or by statutory obligation bound to maintain confidentiality, ensure that access to Personal Data Processed is limited to those personnel who require such access to perform the applicable HOIST Services, and take commercially reasonable steps to ensure the reliability of personnel engaged in the Processing of Personal Data hereunder.

4.6 HOIST will not delegate the processing of Personal Data to a Sub-processor other than pursuant to Section 7 (Sub-Processors) below.

4.7 HOIST will promptly inform Customer if, in its opinion, any instruction or request violates Data Protection Law, and HOIST disclaims any obligation or liability with regard to any such instructions or requests. The parties acknowledge that HOIST is not obligated to undertake additional work or analysis beyond the scope of the HOIST Services to determine if Customer’s instructions are compliant.

4.8 Upon either party’s reasonable request at any time during the term of the Agreement and for the purpose of transfers of Personal Data under this DPA, the parties shall enter into any additional trans-border data flow agreement as may be required under the applicable Data Protection Law, and to maintain such additional trans- border data flow agreement (with any updates and amendments as may be required to reflect changes in the applicable Data Protection Law, and/or in any other transfer mechanism required under the applicable Data Protection Law) for the entire period during which Personal Data is Processed by HOIST hereunder.

4.9 In addition to any rights to charge Customer for its costs as described in this DPA, Customer accepts that any requests for information, assistance or activities beyond HOIST’s ordinary course of business, routines or practices, or what is otherwise commercially reasonable, shall be specifically agreed in writing and may be subject to additional fees and charges.

4.10 CCPA Specific Provision: HOIST is prohibited from: (a) selling the Personal Data; (b) retaining, using, disclosing, or Processing Personal Data for any purpose other than for the specific purpose of performing the HOIST Services provided under the Agreement; including retaining, using, or disclosing the Personal Data for a commercial purpose other than providing the HOIST Services provided under the Agreement; or (c) retaining, using, or disclosing the Personal Data outside of the direct business relationship between Customer and HOIST. HOIST hereby confirms that it understands the restrictions set forth in this section and will comply with them.

4.11 GDPR Specific Provision: HOIST will assist Customer in complying with its obligations as Controller under the GDPR or equivalent provisions in Data Protection Laws of EU/UK countries taking into account the nature of processing and the information available to HOIST.

5. SECURITY

5.1 HOIST will implement and maintain appropriate technical and organizational measures to protect Personal Data as described in HOIST's security policy as amended from time to time, a current copy of which is available at https://www.hoist.tech/datasecurity

(the "Security Policy"). Notwithstanding any provision to the contrary, HOIST may modify or update the Security Policy at HOIST’s discretion provided that such modification or update does not result in a material degradation in the protection offered by the Security Policy.

5.2 HOIST will inform Customer without undue delay after it becomes aware of any Personal Data Breach in connection with the Processing of Personal Data under this DPA, observing the following process:

(a) HOIST will investigate the Personal Data Breach and take reasonable measures to identify its root cause and, where such breach is caused by HOIST or a HOIST Sub- processor, take steps to prevent a recurrence;

(b) as information is collected or otherwise becomes available, to the extent legally permitted, HOIST will provide Customer with a description of the Personal Data Breach, the type of the data to which the breach relates, and other information Customer may reasonably request concerning the affected Data Subject where such information is available to HOIST; and

(c) the Parties agree to coordinate in good faith on developing the content of any related public statements or any required notices for the affected Data Subject(s) and/or the competent supervisory authorities.

To the extent that a Personal Data Breach is caused by Customer, Customer Affiliate or anyone acting for Customer, HOIST will inform the Customer of the Personal Data Breach and provide information it discovers up to the stage it identifies the breach is caused by the Customer, Customer Affiliate or anyone acting for the Customer. Further assistance to investigate such a Personal Data Breach is subject to the prior agreement of the Parties.

6. AUDITS

6.1 If required under the applicable Data Protection Law or reasonable grounds exist to suspect non-compliance of this DPA or applicable Data Protection Law on HOIST’s part, HOIST shall upon Customer’s request, make all necessary information available to demonstrate compliance hereof. If required by applicable Data Protection Law or if, in the Customer’s reasonable opinion, the scope of the audit is insufficient to demonstrate compliance with this DPA, then HOIST shall allow for audits, including inspections, to be performed by Customer (or an independent third party auditor mandated by Customer that is reasonably acceptable to HOIST and subject to signature of a confidentiality agreement with HOIST) of HOIST relevant to the Personal Data Processed under this DPA at Customer’s cost and subject to the following:

(a) Customer will primarily rely on any applicable summary audit reports, certifications or other verifications already available, if any, to confirm HOIST’s compliance and exclude unnecessary repetitive audits;

(b) any audit will be on prior arrangement, having agreed the scope and duration of the audit with HOIST in advance, and will be conducted without unreasonably interfering with HOIST’s business activities, and will conducted during regular business hours and subject to HOIST’s security policies;

(c) unless required by the applicable Data Protection Law, an audit will conducted not more than once in any twelve (12) month period;

(d) to the extent legally permitted, Customer will provide HOIST with a copy of the audit report. Customer agrees to use the report only for the purposes of meeting its regulatory audit requirements and/or confirming compliance with the requirements of this DPA. The audit reports shall be kept strictly confidential by the Parties;

(e) if Customer’s request for information or access relates to a Sub-Processor, and HOIST cannot provide reasonably responsive information itself, then HOIST shall promptly submit a request for additional information to the relevant Sub-Processor; and

(f) HOIST or its Sub-processor will not be required in regards of any information request or audit, to provide access to any price or other commercial information or trade or business secrets.

Customer acknowledges and agrees that audits under the Standard Contractual Clauses will be carried out in accordance with this Section of this DPA.

7. SUBPROCESSORS

7.1 Customer agrees that HOIST may engage Sub-Processors to Process Personal Information on its behalf. HOIST has currently appointed, as Sub-Processors, the third parties listed in Annex III to this DPA. HOIST will notify Customer if HOIST adds or replaces any Sub-Processors listed in Annex III at least ten (10) days prior to any such changes.

7.2 HOIST will give Customer the opportunity to object to the engagement of new Sub-Processors on reasonable grounds relating to the protection of Personal Information within ten (10) days of notifying Customer. If Customer does notify HOIST of such an objection, the Parties will discuss Customer’s concerns in good faith with a view to achieving a commercially reasonable resolution. If no such resolution can be reached, HOIST will, at HOIST’s sole discretion, either not appoint the new Sub-Processor, or permit Customer to suspend or terminate the affected Services in accordance with the termination provisions of the Agreement without liability to either Party (but without prejudice to any fees incurred by Customer prior to suspension or termination). The Parties agree that by complying with this Section, HOIST fulfils its obligations under Clause 9 of the Standard Contractual Clauses.

7.3 Where HOIST engages Sub-Processors, HOIST will impose data protection terms on the Sub-Processors that provide at least the same level of protection for Personal Information as those in this DPA (including, where appropriate, the Standard Contractual Clauses), to the extent applicable to the nature of the services provided by such Sub-Processors. HOIST will remain responsible for each Sub-Processor’s compliance with the obligations of this DPA and for any acts or omissions of such Sub-Processor that cause HOIST to breach any of its obligations under this DPA.

8. DATA TRANSFERS

8.1 Customer acknowledges and agrees that HOIST may access and Process Personal Information on a global basis as necessary to provide the Services in accordance with the Agreement, and in particular that Personal Information may be transferred to and Processed by HOIST in Canada, the United States, the European Union, Sri Lanka, Lebanon, Colombia and Brazil and other jurisdictions where HOIST and its Sub-Processors have operations. Wherever Personal Information is transferred outside its country of origin, each party will ensure such transfers are made in compliance with the requirements of Data Protection Laws.

8.2. EU/UK Specific Terms:

(a) HOIST shall not transfer EU/UK Personal Data to any country or recipient not recognized as providing an adequate level of protection for Personal Data (within the meaning of applicable EU/UK Data Protection Laws), unless it first takes all such measures as are necessary to ensure the transfer is in compliance with applicable EU/UK Data Protection Laws. Such measures may include transferring such data to a recipient: (i) that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Information; (ii) that has achieved binding corporate rules authorization in accordance with European Data Protection Laws; (iii) or that has executed appropriate standard contractual clauses in each case as adopted or approved in accordance with applicable European Data Protection Laws, including without limitation any HOIST Group intra-company arrangement requiring all transfers of personal data to be made in compliance with the Standard Contractual Clauses.

(b) The parties agree that for the purposes of the Standard Contractual Clauses: (i) HOIST will be the "data importer" and Customer will be the "data exporter"; (ii) the Exhibits of the Standard Contractual Clauses shall be populated with the relevant information set out in Annexes I, 2 and 3 of this DPA; (iii) Clause 17 Option 1 (governing law) shall apply and shall be governed by the laws of the Netherlands; (iv) Clause 18 (choice of forum and jurisdiction) the courts of the Netherlands shall have jurisdiction and (v) if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA, the Standard Contractual Clauses will prevail to the extent of such conflict.

(c) To the extent that and for so long as the Standard Contractual Clauses as implemented in accordance with this DPA cannot be relied on by the parties to lawfully transfer Personal Data in compliance with the UK GDPR, the applicable standard data protection clauses issued, adopted or permitted under the UK GDPR shall be incorporated by reference, and the Annexes, appendices or tables of such clauses shall be deemed populated with the relevant information set out in Annexes I, II and III of this DPA.

(d) If for any reason HOIST cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses, and Customer intends to suspend the transfer of EU/UK Personal Data to HOIST or terminate the Standard Contractual Clauses, Customer agrees to provide HOIST with reasonable notice to enable HOIST to cure such non-compliance and reasonably cooperate with HOIST to identify what additional safeguards, if any, may be implemented to remedy such non-compliance. If HOIST has not or cannot cure the non-compliance, Customer may suspend or terminate the affected part of the Services in accordance with the Agreement without liability to either party (but without prejudice to any fees Customer has incurred prior to such suspension or termination).

9. LIMITATION OF LIABILITY

Each Party’s liability, taken in aggregate, arising out of or related to this DPA (and any other DPAs between the Parties) and the Standard Contractual Clauses (where applicable), whether in contract, tort or under any other theory of liability, will be subject to the limitations and exclusions of liability set out in the 'Limitation of Liability' section of the Agreement and any reference in such section to the liability of a Party means aggregate liability of that Party (including under this DPA). In no event shall either party's liability be limited with respect to any individual's data protection rights under this DPA (including the Standard Contractual Clauses) or otherwise.

ANNEX 1

A. LIST OF PARTIES

Data exporter is “Customer” as defined in the Agreement between the data exporter and the data importer. The Customer is the controller. Customer’s particulars and contact information are as set out in the Order made under the Agreement.

Data importer is HOIST. HOIST is the processor. HOIST’s particulars and contact information are as set out in the Order made under the Agreement.

B. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred:

Users of the data importer’s products and/or services

Categories of personal data transferred:

Base Data – Details regarding the nature of a customer or prospect including customer type, status, nature of customer business where applicable
Contract Data – Customer contract information including names, addresses, phone numbers and email addresses
Employee Base Data – Personal information relating to the HOIST customer or prospect employee’s employment including information relating to the data subject’s job and position within the organization
Operations Data – Details of services provided by the customer or prospect to their customers or relating to operations performed by the customer internally, including any information required to deliver customer services
Performance Data – All types of feedback to the customer by their customers, suppliers, prospects including customer surveys, customer opinions and correspondence

Sensitive Data (if applicable):

The data exporter will not submit sensitive data to the data importer under the terms of the Agreement without the prior written consent of HOIST.

The frequency of the transfer:

Continuous

Nature of the processing:

The performance of the HOIST Services which may include the following:

Project Implementation including configuration, development, migration, deployment, testing, consultancy and training
Support services including support, maintenance, data entry, correction and consolidation, record keeping and service request management. When providing support investigation of certain product issues may require the involvement of HOIST global support services personnel who, being a global organization, provide services from service locations in Sri Lanka, Lebanon and Colombia.
Upgrade projects including configuration, development, migration, deployment, testing, consultancy and training
Where the services consist of HOIST Digital Application Services, Cloud Services or other Software-as-a-Service Customer Data is stored and hosted in data centres as stated or referred to in the Order for such services. The services are provided from service locations in other countries as may be stated or referred to in the Agreement for such services.

Purpose of Processing:

The purposes of the data transfer and further processing is as set forth in section 4.1 of the DPA.

The period for which the personal data will be retained:

Data will be retained in accordance with section 4.4 of the DPA.

For Sub-Processors, please see Annex III.

C. COMPETENT SUPERVISORY AUTHORITY

Unless where otherwise required by law, the competent supervisory authority will be the Data Protection Commission of Ireland.

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL

MEASURES TO ENSURE THE SECURITY OF THE DATA

Please see the Security Policy: https://www.hoist.tech/datasecurity

ANNEX III

LIST OF SUB-PROCESSORS