Data processing agreement
Last updated: September 2, 2022. To see what has changed in this DPA since it was published on March 1, 2022, click here.
This Data Processing Agreement (“DPA”) is incorporated into and forms a part of the Cloud Services Subscription and Professional Services Agreement or other applicable service or subscription agreement (“Agreement”) between WorkFusion, Inc. (“WorkFusion”) and the organization that signs an Order Form (“Customer”) with WorkFusion for Cloud Services or professional services that involve processing of Customer Personal Data, and is effective as of the effective date of the Agreement, unless this DPA is separately executed in which case it is effective on the date of the last signature (the “Effective Date”). All capitalized terms not defined herein shall have the meaning ascribed to them in the Agreement or under the relevant Data Protection Law.
This DPA sets out data protection requirements with respect to the processing of Customer Personal Data that is collected, stored, accessed, transmitted, or otherwise processed by WorkFusion for the purpose of providing the Cloud Services or professional services that involve processing of Customer Personal Data (collectively with the Cloud Services, “Services”). Customer and WorkFusion hereby agree to the following:
1. Definitions
1.1 For the purposes of this DPA:
“Customer Personal Data” means any data that is defined as ‘personal data,’ ‘personal information’ or ‘personally identifiable information’ (or analogous term) under applicable Data Protection Laws that Customer uploads into the Cloud Services or that Customer otherwise provides to WorkFusion under the Agreement.
“EEA" means the European Economic Area.
“Data Protection Authority” shall mean any governmental organization authorized to conduct regulatory enforcement of Data Protection Laws, including, without limitation, the Supervisory Authority for any applicable GDPR Member State, the applicable U.S. State Attorneys Generals, or the local country’s regulatory authority.
"Data Protection Laws” means all local country laws and regulations applicable to the respective party in its role in the processing of Customer Personal Data under the Agreement, including but not limited to: (i) the EU General Data Protection Regulation 2016/679 (“GDPR”); (ii) UK Data Protection Laws (as such term is defined under the UK IDTA); (iii) any EEA member state made under or pursuant to (i); (iv) California Consumer Privacy Act of 2018 (“CCPA”), the California Privacy Rights Act of 2020; the (v) Virginia Consumer Data Protection Act of 2021 (“CDPA”); or the (vi) Colorado Privacy Act (“CPA”); in each case as may be amended or superseded from time to time.
“Standard Contractual Clauses" means, as applicable, (i) Module Two (controller to processor) of the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 and (ii) the UK Addendum to the EU Commission Standard Contractual Clauses as set out in Exhibit B (the “UK IDTA”).
2. Applicability of DPA
2.1 Controller
In delivering the Services under the Agreement WorkFusion shall process Customer Personal Data as the “Processor”. Customer, or a Customer subsidiary as applicable, is the “Controller” of Customer Personal Data.
3. Roles and responsibilities
3.1 Parties’ Roles
Customer, as Controller or as Processor, appoints WorkFusion as a Processor to process on Customer’s behalf the types of Customer Personal Data provided under the Agreement, or with respect to internationally transferred Customer Personal Data under the Agreement. To the extent any Customer Personal Data is within the scope of the CCPA, Customer appoints WorkFusion as a “Service Provider” as that term is defined in the CCPA. WorkFusion shall not share or “sell” any personal information contained in Customer Personal Data as that term is defined in CCPA, CPRA or the applicable Data Protection Law, and that processing will be governed by the CCPA Service Provider Addendum, Exhibit C.
3.2 Purpose Limitation
WorkFusion shall process the Customer Personal Data for the purposes described the Agreement or with respect to any international transfers under the Agreement, only in accordance with the lawful, documented instructions of Customer, except where otherwise required by applicable law. The Agreement and this DPA sets out Customer's complete instructions to WorkFusion in relation to the processing of the Customer Personal Data and any additional processing outside of the scope of these instructions requires prior written agreement between the Parties.
3.3 Details of the Processing
3.3.1. Subject Matter
The subject matter of the data processing under this DPA is Customer Personal Data.
3.3.2. Duration
The duration of the data processing under this DPA is until the expiration or termination of the Agreement plus reasonable, or stipulated, post-termination wind down period in accordance with its terms of the Agreement.
3.4 Nature and Purpose
The purpose of the data processing under this DPA is the provision of the Services to Customer in accordance with the Agreement or as more specifically set forth in the SCCs with respect to transfers of Customer Personal Data transferred into, or out of, the EU/EEA or Switzerland from outside the EU/EEA or Switzerland, or under the UK SCC with respect to transfers of Customer Personal Data into, or out of, the UK, from outside the UK.
3.4.1. Types of Customer Personal Data
The types of Customer Personal Data processed under this DPA include any Customer Personal Data uploaded to the Cloud Services by Customer.
3.4.2. Categories of Data Subjects
The data subjects may include Customer’s customers, employees, suppliers, and end users, or any other individual whose personal data Customer uploads to the Cloud Services or otherwise provides to WorkFusion for the Services.
3.4.3. Processing Operations
The objective of the processing of Customer Personal Data by WorkFusion is the provision of Cloud Services or professional services, as the case may be, to the Customer in accordance with the Agreement.
3.5 Compliance
Customer, as controller, represents and warrants that in relation to the Customer Personal Data:
- it has complied, and will continue to comply, with all applicable Data Protection Laws; and
- it has provided and obtained all necessary and relevant notices and consents required to ensure the lawful right to transfer, provide access to or otherwise disclose the Customer Personal Data to WorkFusion for processing in accordance with the terms of the Agreement and this DPA. Customer has sole responsibility for the accuracy, quality, and legality of Customer Personal Data and the means by which Customer acquired the Customer Personal Data and the appropriateness of the use of that Customer Personal Data.
4. Security
4.1 Security
WorkFusion shall implement appropriate technical and organizational measures in accordance with Applicable Law designed to protect the security (including protection from accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to, Customer Personal Data), confidentiality and integrity of Customer Personal Data.
4.2 Confidentiality of processing
WorkFusion shall ensure that any person that it authorizes to process the Customer Personal Data is subject to a duty of confidentiality (whether a contractual or a statutory duty).
4.3 Security Incident Response
Upon becoming aware of a Security Incident, WorkFusion shall notify Customer without undue delay and in any evet within 48 hours, and shall provide such timely information as Customer may reasonably require, including a description of the Security Incident, an overview of affected Customer Personal Data, a description of the measures taken to limit material damages and any other information necessary to enable Customer to fulfil any data breach reporting obligations under Data Protection Laws. WorkFusion shall promptly take appropriate and commercially reasonable steps to mitigate the effects of such a Security Incident on the Customer Personal Data processed under the Agreement.
5. Sub-processing
5.1 Sub-processors
Customer agrees that WorkFusion may engage WorkFusion affiliates and third-party sub-processors (collectively, "Sub-processors") to process the Customer Personal Data on WorkFusion's behalf. The list of Sub-processors currently used by WorkFusion for processing of Customer Personal Data for the provision of Cloud Services is listed here. Sub-processors in connection with Professional Services will be set out in the Order Form or SOW signed by Workfusion and Customer. Additional or replacement Sub-processors for the provision of Cloud Services may be engaged by WorkFusion at Customer’s direction or in accordance with Section 5.2. WorkFusion shall ensure its Sub-processors maintain data protection policies and procedures that protect the Customer Personal Data in accordance with applicable Data Protection Law and this DPA. WorkFusion will be liable to Customer for the performance of the Sub-processors' obligations to the extent required by Data Protection Law.
5.2 Changes to Sub-processors for Cloud Services
WorkFusion shall add or replace a Sub-processor on the Sub-processor Page prior to WorkFusion’s engaging such additional or replacement Sub-processor to process Customer Personal on WorkFusion’s behalf under this DPA. WorkFusion will notify Customer of the addition or replacement of a Sub-processor on the Sub-processor Page promptly following its publication. If the Customer objects to the appointment of an additional or replacement Sub-processor within 10 days of WorkFusion’s notice on reasonable grounds relating to the protection of Customer Personal Data, then WorkFusion may, in its own discretion not use the Sub-processor to provide Cloud Services to Customer and the parties will work in good faith to find an alternative solution unless the Sub-processor is engaged on a temporary basis strictly to maintain critical business functions.
6. International Transfers
To the extent that WorkFusion processes (or causes to be processed) any Customer Personal Data originating from the EEA or the UK in a country that has not been designated by the European Commission (or in the case of the UK, the competent UK authority) as providing an adequate level of protection for personal data, and the transfer is not otherwise in compliance with the GDPR or UK Data Protection Laws, the Standard Contractual Clauses shall apply between Customer (as data exporter) and WorkFusion (as data importer). Customer authorizes any transfers of Customer Personal Data to, or access to Customer Personal Data from, such destinations outside the EEA or the UK subject to the terms of this section.
7. Cooperation
7.1 Cooperation and data subjects' rights
WorkFusion shall, taking into account the nature of the processing, assist Customer with appropriate technical and organizational measures, insofar as this is possible, to enable Customer to fulfil its obligation to respond to requests from a data subject seeking to exercise their rights under Data Protection Laws in relation to Customer Personal Data. If such request is made directly to WorkFusion, WorkFusion shall promptly notify Customer of the same so that Customer can take appropriate action.
7.2 Data Subject Requests
Solely to the extent WorkFusion is legally permitted to do so, and subject to WorkFusion’s reasonable verification, WorkFusion will provide commercially reasonable assistance to Customer in responding to the data subject request. Customer will be responsible for any costs arising from WorkFusion’s assistance in accordance with this section to the extent the assistance is not required under applicable Data Protection Laws.
7.3 Data Protection Impact Assessments
WorkFusion shall, to the extent required by the GDPR or the UK Data Protection Laws, provide Customer with commercially reasonable assistance with data protection impact assessments or prior consultations with data protection authorities that Customer is required to carry out under the GDPR or the UK Data Protection Laws in connection with its processing of Customer Personal Data.
7.4 Cooperation with Regulators
WorkFusion shall also assist Customer upon Customer’s request in the event of an audit or other legal request by a Data Protection Authority to the extent that such request or audit relates to WorkFusion’s processing of Customer Personal Data. Customer acknowledges that WorkFusion may disclose the privacy provisions of this DPA and the Agreement in any such request or audit. If WorkFusion receives a valid and binding legal order (“Request”) from any governmental body (“Requesting Party”) for disclosure of Customer Personal Data, WorkFusion will use commercially reasonable efforts to redirect the Requesting Party to seek that Customer Personal Data directly from Customer.
7.5 Required Disclosure
If, despite our efforts, we are compelled to disclose Customer Personal Data to a Requesting Party, we will:
- if legally permitted, promptly notify Customer of the Request to allow Customer to seek a protective order or other appropriate remedy. If we are prohibited from notifying Customer, we will use commercially reasonable efforts to obtain a waiver of that prohibition.
- challenge any over-broad or inappropriate Request (including Requests that conflict with the law of the European Union); and
- disclose only the minimum amount of Customer Personal Data necessary to satisfy the Request.
8. Security reports and audits
8.1 Summary Report.
Upon Customer’s written request, WorkFusion shall provide copies of its most recent external security certifications or internal security audit reports necessary to verify WorkFusion compliance with this DPA, which are WorkFusion Confidential Information and Customer will treat them accordingly pursuant to the confidentiality provisions of the Agreement. Nothing herein shall be construed to require WorkFusion to provide: (i) trade secrets or any proprietary information; (ii) any information that would violate WorkFusion’s confidentiality obligations, contractual obligations, or applicable law; or (iii) any information, the disclosure of which could threaten, compromise, or otherwise put at risk the security, confidentiality, or integrity of WorkFusion’s infrastructure, networks, systems, or data.
8.2 Audit
In the event the documentation under section 8.1 requires additional verification of compliance with this DPA, where required by law, WorkFusion shall permit the Customer (or its appointed third-party auditors) to carry out an audit of WorkFusion processing of Customer Personal Data under the Agreement once per year, directly following a reported personal data breach suffered by WorkFusion, or upon the instruction of a data protection authority, at Customer’s cost. Customer must provide WorkFusion not less than 48 hours prior notice of the audit, conduct its audit during normal business hours, and take all reasonable measures to prevent unnecessary disruption to WorkFusion's operations. Any such audit shall be at Customer’s expense and is subject to WorkFusion's security and confidentiality terms and guidelines. Customer will promptly notify WorkFusion with information regarding any non-compliance discovered during an audit, and WorkFusion will use commercially reasonable efforts to address any confirmed non-compliance.
9. Deletion / Return of Customer Personal Data
WorkFusion shall retain Customer Personal Data for only so long as necessary to perform its obligations under the Agreement, unless otherwise required under applicable law. Upon termination or expiry of the Agreement, WorkFusion shall delete, or at Customer's election, return to Customer the Customer Personal Data in WorkFusion's possession, save to the extent that WorkFusion is required by any applicable law to retain some or all of the Customer Personal Data. WorkFusion will provide a certification of such deletion upon Customer’s written request.
10. CCPA Obligations
WorkFusion is a “service provider” as defined in the CCPA, subject to the CCPA Service Provider Addendum Exhibit C. You represent to WorkFusion that you have provided notice to your end users that you share Customer Personal Data with your service providers. We will not retain, use, or disclose Customer Personal Data for any purpose other than providing the Services, and will not sell Customer Personal Data (as the term “sell” is described in the CCPA) or share Customer Personal Data (as the term “share” is used in CPRA).
11. Miscellaneous
11.1
If there is a conflict between the Agreement, the body of this DPA or the Standard Contractual Clauses, the terms of the Standard Contractual Clauses shall take precedence, followed by the body of this DPA, followed by the Agreement.
11.2
Any claims brought under this DPA (including under the Standard Contractual Clauses) shall be subject to the terms and conditions, including but not limited to, the exclusions and limitations set forth in the Agreement.