DATA PROTECTION ADDENDUM
This Data Protection Addendum (this “Addendum”) forms part of the master services agreement (the “Agreement”) entered into between the Tracker entity named on the Order Form (“Tracker” and “Processor”) and the Customer that accepted the Agreement (“Customer” and “Controller”). All defined terms included in this Addendum shall, unless otherwise defined, have the meaning as set out in the Agreement. Where there is any inconsistency between the provisions of the Agreement and this Addendum, the terms of this Addendum shall prevail.
1.                   DEFINITIONS
1.1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â In this Addendum, the following terms have the meanings set out below and cognate terms shall be construed accordingly:
1.1.1           “Applicable Laws” means all data protection and privacy legislation in force from time to time, and as updated from time to time, applicable to the processing by of Customer Personal Data, including
a)       the European Union (“EU”) GDPR and any applicable domestic privacy laws (including those transposing EU directives or implementing or supplementing the GDPR), in respect of Customer Personal Data regarding which Customer is subject to the EU GDPR,
b)      the United Kingdom (“UK”) GDPR, Data Protection Act 2018, and Privacy and Electronic Communications Directive 2002/58/EC (updated by Directive 2009/136/EC) as implemented into English law, in respect of Customer Personal Data regarding which Customer is subject to English law, and
c)       the California Consumer Privacy Act of 2018, Cal. Civ Code sec. 1798.100 et seq., as may be replaced in force by the California Privacy Rights Act of 2020 (“CCPA”), in respect of Customer Personal Data regarding which Customer is subject to the laws of California (United States of America).
1.1.2           “Customer Personal Data” means any Personal Data Processed by Processor on behalf of Customer pursuant to or in connection with the Agreement.
1.1.3           “GDPR” means either the EU General Data Protection Regulation 2016/679 (“EU GDPR”), or the UK adoption of that Regulation following Brexit (“UK GDPR”), as applicable to the Customer in respect of the Customer Personal Data in question;
1.1.4           “Services” means the services and other activities to be supplied to or carried out by or on behalf of Tracker for Customer pursuant to the Agreement;
1.1.5           “Standard Contractual Clauses” (“SCCs”) means the standard contractual clauses designated by Applicable Laws in respect of the export of Subject Personal Data which, for greater certainty, shall be,
a)      in respect of the European Economic Area: the Annex to the Commission implementing decision on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, C(2021)3972, as revised from time to time (“EU SCCs”), and
b)      in respect of the UK: the International Data Transfer Agreement, in force 21 March 2022, as revised from time to time (“IDTA”).
1.1.6           “Subprocessor” means a person (including a third party), other than a Tracker employee or such employee’s subcontractor, appointed by or on behalf of Tracker to Process Personal Data on behalf of a Customer in connection with the Agreement;
1.2Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â The terms:
1.2.1           “Commission”, “Controller”, “Data Subject”, “Member State”, “Personal Data”, “Personal Data Breach”, “Processing” and “Supervisory Authority” shall have the same meaning as in the GDPR, and their cognate terms shall be construed accordingly;
1.2.2           “Personal Data” shall encompass “Personal Information” as defined in the CCPA;
1.2.3           “Process” and “Processing” shall encompass sale, as defined in the CCPA; and
1.2.4           “Processor” shall encompass “Service Provider” as defined in the CCPA.
1.3                The word “include” is meant without limitation. Cognate terms shall be construed accordingly.
2.                   AUTHORITY
2.1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Tracker certifies that it understands and shall comply with the contractual restrictions set out here.
3.                   PROCESSING OF CUSTOMER PERSONAL DATA
3.1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Tracker shall:
3.1.1Â Â Â Â Â Â Â Â Â Â Â comply with all Applicable Laws in the Processing of Customer Personal Data;
3.1.2           not Process Customer Personal Data other than on Customer’s documented Instructions—which include the businesss purposes of performing the Agreement and providing the Service—except Processing that is
a)       mandatory under laws to and with which Processor (i) is subject, and (ii) can comply in a manner that does not conflict with Applicable Laws to which the relevant Customer Personal Data is subject (“Processing Order”), or
b)Â Â Â Â Â Â required to fulfil rights a Data Subject has, and has exercised, in respect of the third-party Controller of their Customer Personal Data;
3.1.3           not Process Customer Personal Data subject to the GDPR outside the European Economic Area (“EEA”), UK, or such jurisdiction deemed to have an adequate level of data protection based on the then current adequacy decisions of the European Commission or government of the UK, as applicable, without:
a)Â Â Â Â Â Â Â entering into a data transfer agreement, to the extent that the formalisation of such a document represents a valid means of transferring personal data outside of the EEA or UK or other relevant jurisdiction; or
b)Â Â Â Â Â Â otherwise ensure that the transfer is subject to terms which satisfy Applicable Laws including the conditions of any applicable adequacy finding or decision.
3.2                Customer instructs Tracker (and authorises Tracker to instruct each Subprocessor)  to process Customer Personal Data, as far as necessary for the proper performance of this Addendum as reasonably  necessary for the provision of the Services and consistent with the Agreement.
3.3                Where Customer Personal Data subject to the GDPR is exported from, as applicable, the EEA, UK, or a jurisdiction then deemed adequate by either of them, to a jurisdiction the authority designated by Applicable Laws has not recognised as having adequate protections, such that the personal data exported is not otherwise subject to an alternate regime recognised by such authority as providing sufficient safeguards—Tracker agrees to, and to require Subprocessor to, incorporate into this Addendum and be bound by the terms of the Standard Contractual Clauses in respect, always subject to the instructions of the Data Subject.
4.                   TRACKER PERSONNEL
4.1                Tracker shall ensure employees, agents, or contractors of Processor who access Subject Personal Information (“Personnel with Access”) do so only if required to perform the Agreement, provide the Services, or comply with legal requirements or the Data Subject’s instructions (“Authorized Personnel”). To that end, Tracker  shall maintain reasonable measures as to the reliability of Personnel with Access, such as background checks and appropriate training.
5.                   SECURITY
5.1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Tracker shall in relation to the Customer Personal Data implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR and otherwise in accordance with Applicable Laws.
5.2Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â In assessing the appropriate level of security, Tracker shall take account of the risks that are presented by Processing, in particular from a Personal Data Breach.
6.                   SUBPROCESSING
6.1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Customer hereby approves the engagement of Subprocessors by Tracker. A current list of Subprocessors commissioned by Tracker is available on request.
6.2                Tracker may remove or add new Subprocessors at any time. If required by Applicable Law, Tracker will obtain Customer’s approval to engage new Subprocessors in accordance with the following process: (i) Tracker shall notify Customer with at least 30 days’ prior notice before authorizing any new Subprocessor to access Customer’s Personal Data; (ii) if Customer raises no reasonable objections that include an explanation of the grounds for non-approval in writing within this 30 day period, then this shall be taken as an approval of the new Subprocessor; (iii) if Customer raises reasonable objections, Tracker will – before authorizing the Subprocessor to access Personal Data – use reasonable efforts to (a) recommend a change to Customer’s configuration or use of the Services to avoid Processing of Personal Data by the objected-to new Subprocessor or (b) propose other measures that address the concerns raised in Customer’s objection; (iv) if the proposed changes or measures cannot eliminate the grounds for non-approval, Customer may terminate the affected Services without penalty with 14 days’ written notice following Tracker response to Customer’s objection. If Customer does not terminate the affected Services within the 14-day period, this shall be taken as an approval of the Subprocessor by Customer.
6.3                In case of any commissioning of Subprocessors, Tracker shall enter into an agreement with such Subprocessor imposing appropriate contractual obligations on the Subprocessor that are no less protective than the obligations in this DPT. Tracker remains responsible for any acts or omissions of our Subprocessors in the same manner as for Tracker’ own acts and omissions hereunder.
7.                   DATA SUBJECT RIGHTS
7.1                Taking into account the nature of the Processing, Tracker shall assist Customer by implementing appropriate feasible technical and organisational measures to fulfil Customer’s obligations, as reasonably understood by Customer, to faciliate Data Subjects’ exercise of rights under Applicable Laws.
7.2Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Tracker shall:
7.2.1Â Â Â Â Â Â Â Â Â Â Â notify Customer without undue delay, but no later than within 72 hours, if Processor receives a request from a Data Subject under any Applicable Law in respect of Customer Personal Data; and
7.2.2Â Â Â Â Â Â Â Â Â Â Â require Processor not to respond to that request except to notify the Data Subject of receipt, on the documented instructions of Customer, or as required by Applicable Laws to which Processor is subject. In the latter case, Tracker shall to the extent permitted by Applicable Laws inform Customer of that legal requirement before Processor responds to the request.
8.                   PERSONAL DATA BREACH
8.1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Tracker shall notify Customer without undue delay, but no later than within 72 hours, upon Tracker or any Subprocessor becoming aware of a Personal Data Breach affecting Customer Personal Data, providing Customer with sufficient information to allow Customer to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Applicable Laws.
8.2Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Tracker shall co-operate with Customer, and use commercially reasonable efforts, to assist in investiging, mitigating and remediating each such Personal Data Breach.
9.                   DATA PROTECTION IMPACT ASSESSMENT AND PRIOR CONSULTATION
9.1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Tracker shall provide reasonable assistance to Customer with any data protection impact assessments, and prior consultations with Supervising Authorities or other competent data privacy authorities, which Customer reasonably considers to be required by Applicable Law, in each case solely in relation to Processing of Customer Personal Data by, and taking into account the nature of the Processing and information available to, Processor.
10.                DELETION OR RETURN OF CUSTOMER PERSONAL DATA
10.1             Subject to section 10.2 and to the Data Subject’s documented instructions, Tracker shall promptly and, in any event, within 30 days of Customer’s written request (the “Request Date”) and of the date of cessation of any Services involving the Processing of Customer Personal Data (the “Cessation Date”),
10.1.1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â delete and procure the deletion of all copies of those Customer Personal Data, including those Processed by a Conracted Processor,
10.1.2Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â return, if requested, a complete copy of all Customer Personal Data to Customer by secure file transfer in such format as is reasonably notified by Customer to Tracker,
10.1.3Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â provide, if requested, written certification of the foregoing.
10.2             Processor may retain Customer Personal Data to the extent required by Applicable Laws and only to the extent and for such period as required by Applicable Laws, always provided that Tracker shall ensure that such Customer Personal Data remains confidential and is Processed only as necessary for the purposes specified in any Applicable Laws requiring its storage, subject always to the Data Subject’s instructions.
11.                AUDIT RIGHTS
11.1             Provided that an audit right is required by Applicable Law, Customer shall have the right to audit, by appropriate means – in accordance with Sections 11.2 to 11.3 below – Tracker’s and its Subprocessors’ compliance with the data protection obligations hereunder annually, unless additional audits are necessary under Applicable Laws. Such audits shall be limited to information and data processing systems that are relevant for the provision of the Services provided to Customer.
11.2             Tracker and its Subprocessors may use (internal or external) auditors to perform audits to verify compliance with the data protection obligations hereunder. Each audit will result in the generation of an audit report (“Audit Report”). Upon Customer´s request, Tracker shall provide such relevant Audit Reports for the Services concerned. Customer agrees that these Audit Reports shall first be used to address Customer’s audit rights under this Addendum.
11.3Â Â Â Â Â Â Â Â Â Â Â Â Â If required under Applicable Law, Tracker will allow for additional audits, including onsite audits at Trackerfacilities and premises by Customer or an independent, accredited third party audit firm, during regular business hours, with reasonable advance notice to Tracker.
12.                GENERAL TERMS
Governing law and jurisdiction
12.1Â Â Â Â Â Â Â Â Â Â Â Â Â This Addendum, and all non-contractual or other obligations relating to it, are governed by the laws of the jurisdiction stipulated for this purpose in the Agreement except, in respect of Subject Personal Data exported from:
12.1.1Â Â Â Â Â Â Â Â the EEA, those of the jurisdiction in which the data exporter is established; and
12.1.2Â Â Â Â Â Â Â Â the UK, those of England and Wales, which shall be the primary place for legal claims to be made by the parties
12.2Â Â Â Â Â Â Â Â Â Â Â Â Â Except as set out in the previous section, the parties to this Addendum hereby submit to the choice of jurisdiction stipulated in the Agreement with respect to any disputes or claims howsoever arising under this Addendum, including disputes regarding its existence, validity or termination or the consequences of its nullity, except that neither party may terminate this Addendum or applicable Standard Contractual Clauses prior to termination of all Services.
Order of precedence
12.3             Nothing in this Addendum reduces Tracker’s obligations under the Agreement in relation to the protection of Personal Data or permits Tracker to Process (or permit the Processing of) Personal Data in a manner which is prohibited by the Agreement.
12.4Â Â Â Â Â Â Â Â Â Â Â Â Â In the event of inconsistencies or ambiguities between the provisions of this Addendum and any other agreements between the parties, including the Agreement and including (except where explicitly agreed otherwise in writing, signed on behalf of the parties) agreements entered into or purported to be entered into after the date of this Addendum,
12.4.1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â the provisions of this Addendum shall prevail, and
12.4.2Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â with respect to this Addendum, the Standard Contractual Clauses shall prevail.
Severance
12.5             Should any provision of this Addendum be invalid or unenforceable, then the remainder of this Addendum shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, while preserving the parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.
This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.
Strictly Necessary Cookie should be enabled at all times so that we can save your preferences for cookie settings.
If you disable this cookie, we will not be able to save your preferences. This means that every time you visit this website you will need to enable or disable cookies again.
