This Data-Processing Addendum (\u201cDPA\u201d) governs the provision of any services rendered to Eventzilla Corporation and its affiliates (collectively \u201cEventzilla\u201d) by you (\u201cVendor\u201d) in your capacity as a Processor or Sub-Processor (the \u201cServices\u201d). By commencing or continuing the Services after the date of publication, Vendor acknowledges that it is bound by the terms of this DPA. If Vendor has executed a separate written agreement with Eventzilla that specifically references data-processing obligations, the terms of that agreement will prevail to the extent of any direct conflict with this DPA.<\/p>\n
Capitalised terms not defined in this document have the meanings given in the \u201cUK GDPR\u201d or \u201cEU GDPR\u201d (as applicable). Controller means the natural or legal person who determines the purposes and means of processing Personal Data. Processor means a person who processes Personal Data on behalf of the Controller. Sub-Processor means any party engaged by a Processor to process Personal Data. \u201cPersonal Data\u201d and \u201cProcessing\u201d take the meanings set out in Article 4 of the GDPR.\u00a0<\/p>\n
For the limited and purely administrative Personal Data that Vendor will process in order to deliver the Services to Eventzilla, Eventzilla is the Controller, and Vendor acts as Processor (or, when Vendor engages further suppliers, as the entity responsible for its own Sub-Processors). Vendor shall process Personal Data strictly in accordance with documented instructions supplied by Eventzilla, including those contained in this DPA, any ordering document and the relevant Statement of Work. Vendor will not process Personal Data for its own purposes or for any other purpose except where required to comply with a legal obligation, in which case Vendor will give advance notice to Eventzilla unless the law prohibits such notice.<\/p>\n
Vendor shall (a) process Personal Data solely for the purpose of performing the Services; (b) implement and maintain appropriate technical and organisational measures designed to safeguard Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access; (c) ensure that any person acting under Vendor\u2019s authority who has access to Personal Data is bound by enforceable confidentiality commitments; (d) not engage another Sub-Processor without meeting the requirements of Section 4 below; (e) cooperate with Eventzilla in responding to any Data-Subject request Eventzilla receives and in carrying out any data-protection impact assessment that Eventzilla is legally required to conduct; and (f) promptly inform Eventzilla if, in Vendor\u2019s opinion, an instruction violates Data-Protection Laws.<\/p>\n
Vendor may engage Sub-Processors only with prior written authorisation from Eventzilla. Where authorisation is granted, Vendor shall enter into a written contract with the Sub-Processor that imposes data-protection obligations no less stringent than those set out in this DPA. If the Sub-Processor fails to fulfil its data-protection obligations, Vendor remains fully liable to Eventzilla for the performance of that Sub-Processor\u2019s duties.<\/p>\n
Vendor will implement controls that include, at a minimum, logical access management, encryption (where appropriate to the sensitivity of the Personal Data), system monitoring, vulnerability-management procedures, and business-continuity arrangements that reflect industry standards for the type of Services Vendor provides. Vendor will make available to Eventzilla\u2014upon reasonable request\u2014summaries of third-party audit reports or certifications (for example ISO 27001 or SOC 2) that demonstrate Vendor\u2019s compliance with these obligations.<\/p>\n
In the event Vendor becomes aware of a Personal-Data Breach affecting Eventzilla\u2019s Personal Data, Vendor will notify Eventzilla without undue delay and will furnish sufficient information for Eventzilla to meet any breach-notification obligations owed to regulators or individuals. Vendor shall take reasonable steps to contain, investigate and mitigate the effects of the breach and will keep Eventzilla informed of progress.<\/p>\n
If Vendor processes, or permits any Sub-Processor to process, Personal Data outside the European Economic Area, Switzerland or the United Kingdom, Vendor will ensure that such transfer complies with an approved transfer mechanism such as the Standard Contractual Clauses (Module 3, Processor\u2192Sub-Processor) or the UK International Data-Transfer Addendum. Vendor shall, upon request, provide Eventzilla with evidence of the transfer mechanism employed.<\/p>\n
Vendor shall, taking into account the nature of the Processing, provide reasonable assistance to Eventzilla to enable Eventzilla to respond to any request from a Data Subject to exercise rights under Data-Protection Laws (including rights of access, rectification, restriction, erasure, data portability and objection). Vendor shall not respond directly to such a request unless authorised to do so in writing by Eventzilla.<\/p>\n
Upon termination or expiry of the Services, Vendor shall, at Eventzilla\u2019s choice, either return to Eventzilla or securely delete all Personal Data (including copies) processed on Eventzilla\u2019s behalf, unless retention is required by applicable law. Vendor will confirm in writing when deletion has been completed.<\/p>\n
Vendor will make available all information reasonably necessary to demonstrate compliance with the obligations set out in this DPA and will allow for and contribute to audits conducted by Eventzilla or a third-party auditor mandated by Eventzilla, provided that such audits are (a) conducted during normal business hours, (b) subject to reasonable notice, and (c) bound by appropriate confidentiality undertakings.<\/p>\n
Vendor shall indemnify and hold harmless Eventzilla from and against all reasonable costs and damages arising from a breach of this DPA or violation of Data-Protection Laws attributable to Vendor. The aggregate liability of either party under this DPA is limited to the amount set out in the governing service agreement or, if no such amount is specified, the fees paid by Eventzilla to Vendor in the twelve (12) months preceding the event giving rise to the liability.\u00a0<\/p>\n