DATA PROCESSING ADDENDUM (DPA)
This Data Processing Addendum ("DPA") supplements the Voocaly Terms of Service where Customer is a business entity acting as a Data Controller under European Data Protection Law (GDPR / UK GDPR / Swiss FADP) and processes personal data through Voocaly.
In this context, THE CRAFT SHOP acts as Data Processor.
01. Scope & Processing Instructions
The Processor shall process Customer Personal Data solely on documented instructions from Customer (including with respect to transfers of personal data to a third country or an international organization), unless required to do so by applicable law to which Processor is subject. The Terms of Service, along with Customer's configuration of features in the Voocaly workspace, constitute Customer's complete instructions.
02. Confidentiality & Personnel
Processor ensures that all persons authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
03. Security of Processing (TOMs)
Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, Processor implements and maintains appropriate technical and organizational measures (TOMs) to ensure a level of security appropriate to the risk, including encryption in transit, infrastructure-provided encryption at rest, and access controls.
04. Subprocessors & Notification
Customer grants general written authorization to Processor to engage the subprocessors listed in the public Subprocessor Register.
- Processor imposes data protection obligations on subprocessors that are no less protective than those in this DPA.
- Processor shall notify Customer at least thirty (30) days in advance of any intended changes concerning the addition of new subprocessors, providing Customer the opportunity to object on reasonable data protection grounds.
- Processor remains fully liable to Customer for the performance of each subprocessor's data protection obligations.
05. Data Subject Rights & Assistance
Taking into account the nature of the processing, Processor assists Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of Customer's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR.
06. Breach Notification & Investigation
Processor shall notify Customer without undue delay (and in any event within 48 hours) upon becoming aware of a confirmed Personal Data breach affecting Customer Personal Data. Processor shall provide reasonable cooperation and assistance to Customer in investigating and mitigating the effects of the breach.
07. DPIAs & Regulatory Consultations
Processor shall provide reasonable assistance to Customer with data protection impact assessments (DPIAs) and prior consultations with supervisory authorities where required by Articles 35 and 36 of the GDPR, taking into account the nature of processing and the information available to Processor.
08. Deletion or Return of Personal Data
At the choice of Customer, Processor shall delete or return all Customer Personal Data within Voocaly-controlled systems upon termination, subject to applicable legal retention requirements and the retention practices of subprocessors and independent controllers.
09. Audits & Inspections
Processor shall make available to Customer all information reasonably necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by Customer or another auditor mandated by Customer, subject to reasonable advance notice, scheduling during normal business hours, and reasonable confidentiality safeguards.
10. Standard Contractual Clauses & Order of Precedence
The parties incorporate by reference the European Commission's Standard Contractual Clauses (Module 2: Controller-to-Processor) and the UK International Data Transfer Addendum.
Order of Precedence: In the event of any conflict or inconsistency between the terms of this DPA, the Standard Contractual Clauses, and the Terms of Service: (1) the Standard Contractual Clauses shall prevail; (2) followed by this DPA; (3) followed by the Terms of Service.