Data Processing Agreement
Last modified: 06 November 2018
This Data Processing Agreement (this “DPA”) is incorporated into and shall become a part of the Agreement (as defined below), pursuant to which Customer purchased the right to use the Software and/or Services. Pursuant to the Agreement, Denodo may provide Services as agreed in detail between Denodo and Customer from time to time. Denodo's Services may include the processing of personal data, including personal data relating to Customer and Users on behalf of Customer. To the extent applicable, the data processing terms in this DPA shall apply to any such processing.
For purposes of these terms, “Agreement” shall be as defined in the applicable software license and/or services agreement, purchase order, order form or any other agreement between the parties.
Capitalized terms used but not defined herein shall have the meanings set forth in the Agreement
II Description of processing
The processing to be carried out by Denodo is as follows:
(a) the subject matter of the processing is the provision of Services to Customer;
(b) the duration of the processing will be throughout the period within which Denodo performs the relevant Services under the Agreement;
(c) the nature of the processing is as described in the applicable Order;
(d) the purpose of the processing is to enable Denodo to perform the relevant Services under the Agreement;
(e) categories of data are those relating to individuals provided to Denodo by the Customer and the categories of data subjects include Customer's staff, Users or suppliers are as described in clause I above.
III Compliance with the Applicable Data Protection Laws
Both Customer and Denodo will comply with (and shall ensure that its staff and/or subcontractors comply) with Applicable Data Protection Laws.
IV Responsible individuals and enquiries
Customer and Denodo will each notify the other of the individual within its organisation authorised to respond from time to time to enquiries regarding the personal data and the processing which is the subject of the Agreement. Customer and Denodo shall each deal promptly and reasonably with all such enquiries.
V Processing of personal data by Denodo
In relation to the processing of personal data under the Agreement, Denodo shall:
(a) process the personal data (including when making an international transfer of the personal data) only to the extent necessary in order to provide the Services and then only in accordance with:
i. the terms of this Agreement;
ii. Customer's written instructions from time to time which shall be those instructions set out in the Order;
unless otherwise required by law. Where Denodo is required by law to process the personal data otherwise than as provided by the Agreement, it will notify Customer before carrying out the processing concerned (unless the law also prevents Denodo from doing so for reasons of important public interest);
(b) implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks that are presented by the processing, in particular protection against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed under the Agreement;
(c) take all reasonable steps to ensure that only authorised personnel have access to the personal data and that any persons whom it authorises to have access to the personal data will respect and maintain all due confidentiality in relation to the personal data (including by means of an appropriate contractual duty of confidentiality where the persons concerned are not already under such a duty under the law);
(d) not engage any sub-processors in the performance of the Services without the general written authorization of Customer;
(e) not do, or omit to do, anything, which would cause Customer to be in breach of its obligations under the Applicable Data Protection Laws;
(f) immediately notify Customer if, in Denodo's opinion, any instruction given to Denodo infringes Applicable Data Protection Laws;
(g) where applicable in respect of any personal data processed under the Agreement, co-operate with and assist Customer in ensuring compliance with:
i. Customer's obligations to respond to requests from any data subject(s) seeking to exercise their rights under Applicable Data Protection Laws, including by notifying Customer of any written subject access requests Denodo receives relating to Customer's obligations under Applicable Data Protection Laws; and
ii. the Customer's obligations under Applicable Data Protection Laws to:
A. ensure the security of the processing;
B. notify the relevant supervisory authority, and any data subject(s), where relevant, of any personal data breaches;
C. carry out any data protection impact assessments (each a "DPIA") of the impact of the processing on the protection of personal data; and
D. consult the relevant supervisory authority prior to any processing where a DPIA indicates that the processing would result in a high risk in the absence of measures taken by Controller to mitigate the risk.
Denodo will ensure that any sub-processor it engages to provide any services on its behalf in connection with the Agreement does so only on the basis of a written contract which imposes on such sub-processor terms equivalent to those imposed on Denodo in this schedule or such other alternative terms as may be agreed with Customer (the "Relevant Terms"). Processor shall procure the performance by the sub-processor of the Relevant Terms and shall be directly liable to Customer for:
(a) any breach by the sub-processor of any of the Relevant Terms;
(b) any act or omission of the sub-processor which causes:
i. Denodo to be in breach of this Agreement; or
ii. Customer or Denodo to be in breach of Applicable Data Protection Laws. Customer consents to Denodo's engagement of sub-processors provided such engagement is subject to the terms above. Customer shall have the opportunity to object, and must object within 10 days of the appointment of the sub-processor. Where Customer objects within this time period, Customer shall suggest an alternative sub-processor but shall be responsible for any increased cost as a result of engaging an alternative sub-processor. Where Customer objects to a sub-processor engaged by Denodo, and does not pay for any increased cost associated with an alternative sub-processor suggested by Customer, Denodo shall have the right to terminate the agreement with the alternative sub-processor suggested by Customer.
VII Monitoring of Denodo's performance
Upon prior written notice Customer is entitled to monitor and audit Denodo's compliance with Applicable Data Protection Laws and its obligations in relation to data processing under the Agreement at any time during normal business hours but limited to once a year. Denodo agrees to provide Customer promptly with all access, assistance and information that is reasonably necessary to enable the monitoring and audits concerned. If the Customer believes that an on-site audit is necessary, Denodo agrees to give Customer reasonable access to its premises (subject to any reasonable confidentiality and security measures), and to any stored personal data and data processing programs it has on-site. Customer is entitled to have the audit carried out by an independent third party. Customer shall pay the actual and reasonable costs of such audit.
VIII Transfers outside the EEA and to third parties
Customer acknowledges that Denodo will transfer personal data:
(a) outside the European Economic Area; or
(b) to any third party (which shall include any affiliates of processor) where such third party is located outside the European Economic Area;
and in ensuring that the measures necessary for compliance with the Applicable Data Protection Laws around transfers outside the EEA agree that the Standard Contractual Clauses in Schedule I hereto shall apply to such transfers.
IX Completion of Services
Upon completion of the Services, Denodo will at Customer's discretion:
(a) delete; or
(b) return to the Customer (as directed by Customer);
all personal data (including copies) processed under the Agreement, except to the extent that Denodo is required by law to retain any copies of the personal data.
Where personal data is transferred out of the European Economic Area and to third parties, the Standard Contractual Clauses (2018/87/EU) as prescribed by the European Commission shall apply incorporated by reference herein (please click here for a link to the relevant clauses).
to the Standard Contractual Clauses
This Appendix forms part of the Clauses and must be completed and signed by the parties
The Member States may complete or specify, according to their national procedures, any additional necessary information to be contained in this Appendix
The data exporter shall be the Customer (the Controller) who is purchasing items as set out in the Service Order pursuant to the Agreement.
The data importer shall be Denodo who is providing the items set out under the Service Order pursuant to the Agreement and is the processor.
The personal data transferred concern the following categories of data subjects:
Personal data relating to Customer or staff of Customer or other individuals with whom the Customer deals in the course of its business.
Categories of data
The personal data transferred concern the following categories of data:
This may include: name; contact details; contact/ links within the organization; relevant employment information such as type of client; company name; role within the business; log data, as required for the provision of Services; and certain online activity information.
Special Categories of personal data (if appropriate)
The personal data transferred may concern the following special categories of personal data:
The personal data transferred will be subject to the following basic processing activities:
This will be subject to the processing activities which the Services being purchased are depending upon, as set out in the completed Order and the Terms and Conditions of the Agreement.
to the Standard Contractual Clauses
This Appendix forms part of the Clauses and must be completed and signed by the parties.
Description of the technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached):
Denodo currently observes the security practices described in this Appendix.
Notwithstanding any provision to the contrary otherwise agreed to by data exporter, Denodo may modify or update these practices at its discretion provided that such modification and update does not result in a material degradation in the protection offered by these practices.
a) Access Control
Outsourced processing: Denodo hosts services with outsourced cloud infrastructure providers. Additionally, Denodo maintains contractual relationships with vendors in order to provide the Service in accordance with our Data Processing Agreement. Denodo relies on contractual agreements, privacy policies, and vendor compliance programs in order to protect data processed or stored by these vendors.
Physical and environmental security: Denodo hosts its product infrastructure with multi-tenant, outsourced infrastructure providers. The physical and environmental security controls are audited for SOC 2 Type II and ISO 27001 compliance, among other certifications.
Access controls: Network access control mechanisms are designed to prevent network traffic using unauthorized protocols: Virtual Private Cloud (VPC) implementations, security group assignment, firewall rules.
Physical controls: Denodo implements measures to prevent unauthorized persons from gaining access to the data processing equipment where the personal data is processed or used in Denodo facilities: establishing security areas; procuring 24-hour security service; requiring all doors to be locked before and after entry; restricting and protecting access paths; securing the data processing equipment; establishing access authorizations for staff and third parties, including the respective documentation; restricting issuance of card-keys; regulating card-keys once issued; and logging, monitoring and tracking all access to systems.
Authentication: Denodo implemented a uniform password policy. Users who interact with Denodo applications via the user interface must authenticate before accessing non-public customer data. User IDs are individual and cannot be reassigned to another person.
Authorization: The authorization model in each of Denodo’s services is designed to ensure that only the appropriately assigned individuals can access to only that data relevant to the scope of each individual’s role or responsibility. Authorization to data sets is performed through validating the user’s permissions against the attributes associated with each data set.
b) Transmission Control
In-transit: Denodo uses firewall and encryption technologies to protect the gateways and pipelines through which personal data travels. Denodo makes encryption (also referred to as SSL or TLS) available on every one of its login interfaces and for free on every customer site hosted on the Denodo products. Denodo’s encryption implementation uses industry standard algorithms and certificates.
At-rest: Denodo stores user passwords following policies that follow industry standard practices for security. Denodo has implemented technologies to ensure that stored data is encrypted at rest.
Denodo uses commercially reasonable efforts to log, monitor and track data transmissions to prevent unauthorized persons from reading, copying, altering or deleting data.
c) Input Control
Detection: Denodo designed its services to log extensive information about the system behaviour, traffic received, system authentication, and other application requests. Internal systems aggregated log data and alert appropriate employees of anomalous activities. Denodo personnel, including security, operations, and support personnel, are responsive to known incidents.
Response and tracking: Denodo maintains a record of known security incidents that includes description, dates and times of relevant activities, and incident disposition. Suspected and confirmed security incidents are investigated by security, operations, or support personnel; and appropriate resolution steps are identified and documented. For any confirmed incidents, Denodo will take appropriate steps to minimize product and Customer damage or unauthorized disclosure.
Communication: If Denodo becomes aware of unlawful access to Customer data stored within its applications, Denodo will: 1) notify the affected Customers of the incident; 2) provide a description of the steps Denodo is taking to resolve the incident; and 3) provide status updates to the Customer contact, as Denodo deems necessary. Notification(s) of incidents, if any, will be delivered to one or more of the Customer’s contacts.
d) Availability Control
Infrastructure availability: Denodo and Denodo providers use commercially reasonable efforts to ensure Denodo services are available all time. This is implemented through infrastructure redundancies. The services are also architected to assist Denodo operations in maintaining and updating applications and backend while limiting downtime.
Fault tolerance: Backup and replication strategies are designed to ensure redundancy and fail-over protections during a significant processing failure. Data is backed up to multiple durable data stores and replicated across multiple availability zones. All databases are backed up and maintained using industry standard methods and ensuring they are readily available for restoration in case of failure of storage infrastructure or database services.