Data Processing Agreement

1. Definitions

For the purposes of this Data Processing Agreement, the following terms shall have the meaning provided below:

• Data Controller, Data Processor, Data Protection Officer, Data Subject, Personal Data, Personal Data Breach, Processing and Supervisory Authority shall have the same meaning as found in the GDPR.
• Data Protection Legislation shall mean the GDPR, and any other applicable national implementing law as amended from time to time, as well as any other applicable law concerning the processing of personal data and privacy.
• Data Subject Request shall mean a request by, or on behalf of, a Data Subject in accordance with rights granted pursuant to the Data Protection Legislation regarding their Personal Data.
• GDPR shall mean the General Data Protection Regulation (Regulation (EU) 2016/679).
• Protective Measures shall mean appropriate technical and organisational measures to ensure a level of security appropriate to the risk, which may include, but are not limited to, the pseudonymisation and encrypting of Personal Data, ensuring the ongoing confidentiality, integrity, availability and resilience of systems and services, ensuring that availability of and access to Personal Data can be restored in a timely manner in the event of an incident and regularly testing, assessing and evaluating the effectiveness of the measures adopted.
• Sub-processor shall mean any vendor appointed to process Personal Data on behalf of FalconDive related to this Agreement.

All other capitalised terms shall have the same meaning provided in the Agreement.

2. Processing of Personal Data

The Parties acknowledge that, for the purposes of the Data Protection Legislation, the Client is the Data Controller and FalconDive is the Data Processor. The processing of Personal Data that FalconDive is authorised to perform is exhaustively listed in Schedule A and may not be determined or amended by FalconDive at any time. FalconDive may only process the Personal Data, including in respect of international transfers, in line with the written instructions of the Client and may not use the Personal Data for its own purposes unless FalconDive is required to do otherwise by Law.

Provided that if so required and permissible at law, FalconDive shall notify the Client, without delay, prior to processing such data.

The Client agrees to share the personal data detailed in Schedule A with FalconDive in order for the agreed processing to take place, as required for the provision of the services as detailed in the Main Agreement.

FalconDive shall comply with all applicable Data Protection Legislation in the processing of the Client's Personal Data.

FalconDive shall notify the Client immediately if it considers that any of the instructions infringe Data Protection Legislation.

The Client shall be responsible for notifying Data Subjects of a data breach or for a request from the Data Subject themselves or from a corresponding provision of an otherwise applicable national data protection law.

The Client agrees and warrants that it shall comply fully with the terms of the GDPR and shall ensure that the Personal Data that it supplies or discloses to FalconDive has been obtained fairly and lawfully and in accordance with the provisions of the Data Protection Legislation.

3. Protective Measures

FalconDive shall ensure that Protective Measures, which are in line with the requirements of Article 32 of the GDPR and detailed in Schedule C are in place to appropriately protect against a Personal Data Breach, having taken into account the:

• nature of the data to be protected;
• harm that might result from a Personal Data Breach;
• state of technological development; and
• cost of implementing any measures.

In determining the appropriate level of Protective Measures, FalconDive shall take into account the risks that are presented by the Processing taking place and in particular from a Personal Data Breach.

4. FalconDive Personnel

FalconDive shall ensure that FalconDive personnel do not process Personal Data except in accordance with this Agreement and that all reasonable steps are taken to ensure the reliability and integrity of any FalconDive personnel who have access to the Personal Data, particularly that they:

• are aware of and comply with FalconDive's duties under this Agreement;
• are subject to appropriate confidentiality undertakings, or professional or statutory obligations of confidentiality with FalconDive;
• are informed of the confidential nature of the Personal Data and do not publish, disclose or divulge any of the Personal Data to any third Party unless directed in writing to do so by the Client or as otherwise permitted by this Agreement; and
• have undergone adequate training in the use, care, protection and handling of Personal Data.

FalconDive shall limit access to the Client's Personal Data to those employees that need to know or access the Personal Data as is strictly necessary for the purposes of the main Agreement between the Parties.

5. International Data Transfers

FalconDive shall not transfer Personal Data outside of the EEA unless the prior written consent of the Client has been obtained and the following conditions are fulfilled:

• FalconDive complies with the general conditions laid down in relation to such transfers (in accordance with GDPR Article 44);
• FalconDive complies with its obligation to provide appropriate safeguards, which safeguards shall ensure the availability of enforceable Data Subject rights and of effective legal remedies (in accordance with GDPR Article 46);
• All transfers take place with appropriate security measures in place to protect the personal data; and
• FalconDive complies with any reasonable instructions notified to it in advance by the Client with respect to the transfer of the Personal Data.

6. Sub-Processing

The sub-processors which FalconDive uses for the processing of Personal Data in accordance with this Agreement are listed in Schedule B of this Agreement, as may be amended or updated from time to time upon notification to the Client.

Pursuant to Article 28 (2) of the GDPR, the Client grants to FalconDive a general authorization to use Sub-processors to provide processing activities on Client's data in accordance with this chapter 6. FalconDive website shall list the Sub-Processors used by FalconDive. At least 15 days before engaging with a Sub-processor, FalconDive shall update its website and notify the Client via email. The Client can object to such Sub-processor by (i) ceasing to use the Services for which FalconDive has appointed the respective Sub-processor or (ii) request to have the data stored in a data center/server which is not provided by the respective Sub-processor.

Prior to FalconDive engaging a Sub-processor to process any Personal Data related to this Agreement, FalconDive must:

• carry out adequate due diligence to ensure that the Sub-processor is capable of providing the level of protection for Personal Data required by the Data Protection Legislation;
• notify the Client of the intended Sub-processor, processing and any international data transfers, in accordance with this chapter 6;
• enter into a written agreement with the Sub-processor, applying the same data protection obligations set out in this Agreement, in particular providing sufficient guarantees to meet the security requirements of Article 32 of the GDPR;
• incorporate the European Commission Standard Contractual Clauses into any agreement with a sub-processor when an international transfer is taking place to a country not providing adequate safeguards; and
• provide the Client with such information, regarding the Sub-processor, as it may reasonably require.

FalconDive shall remain fully liable for all acts or omissions of any Sub-processor.

7. Notification

FalconDive shall notify the Client without delay if it:

• becomes aware of a Personal Data Breach;
• receives a Data Subject Request;
• receives any other request, complaint or communication relating to the Parties' obligations under Data Protection Legislation;
• receives any communication from any Supervisory Authority or any other regulatory authority in connection with Personal Data processed under this Agreement; or
• receives a request from any third party for the disclosure of Personal Data.

Provided that the obligation to notify shall include the prompt provision of further information to the Client, upon the Client's request.

FalconDive shall not respond to any such requests, except on the documented instructions of the Client, unless FalconDive is obliged to respond by law, in which case FalconDive shall notify the Client of that obligation before responding to the request.

8. Assistance

FalconDive shall, taking into account the nature of the processing, provide the Client with reasonable assistance in relation to the Client's obligations under Data Protection Legislation to respond to requests for exercising Data Subject rights and to security, breach notifications, and consultations with supervisory authorities, insofar as possible and as may reasonably be required by the Client and applicable Data Protection Legislation, including by promptly providing:

• the Client with full details and copies of the complaint, communication or request;
• such assistance as is reasonably requested by the Client to comply with any request made by a Data Subject exercising their rights within the relevant timescales set out in the Data Protection Legislation, including but not limited to access, rectification, or deletion of data;
• the Client, at its request, any Personal Data it holds in relation to a Data Subject;
• full assistance to the Client in ensuring compliance with Articles 32-36 of the GDPR regarding security of personal data and data breaches; and
• assistance as requested by the Client with respect to any request from any Supervisory Authority, or any consultation between the Client and any Data Protection Supervisory Authority.

FalconDive shall, in accordance with its legal obligations as Data Processor and at no additional charge, expense or fee to the Client, provide all reasonable assistance to the Client in the preparation of any privacy impact assessment prior to the commencement of any processing activities. Such assistance may, at the Client's discretion, include but may not be limited to:

• a systematic description of the envisaged processing operations and the purpose of the processing;
• an assessment of the necessity and proportionality of the processing operations in relation to the services;
• an assessment of the risks posed to the rights and freedoms of the Data Subjects; and
• the measures envisaged to address the risks and ensure the protection of Personal Data, including safeguards, security measures and mechanisms.

9. Record Keeping

In line with their legal obligations as a Data Processor, FalconDive shall maintain complete and accurate records and information to meet the requirements of Article 30(2) of the GDPR and as evidence of meeting the requirements of Article 28 of the GDPR. FalconDive shall also provide these records to the Client upon request.

10. Audits

FalconDive shall allow for and contribute to audits of its Processing activity by the Client or the Client's designated auditor.

The Client shall give FalconDive reasonable notice of any audit and shall reasonably avoid causing any disruption to FalconDive's operations, equipment, premises, and personnel while the audit is being carried out.

FalconDive need not give access to its premises for the carrying out of such an audit:

• Outside normal business hours at those premises, unless the audit needs to be conducted on an emergency basis and the Client has given notice to FalconDive that this is the case prior to the commencement of the audit outside normal business hours;
• For the purposes of more than one audit, in respect of FalconDive, in any calendar year, except for any additional audits which:
  • the Client reasonably considers necessary because of genuine concerns as to FalconDive's compliance with this Agreement; or
  • the Client is required or requested to carry out by Data Protection Legislation, a Supervisory Authority or any similar regulatory authority responsible for the enforcement of Data Protection Legislation in any country or territory; or
  • the Client has identified its concerns or the relevant requirement or request in its notice to FalconDive of the audit.

11. Deletion and Return of Data

Within ten (10) days of the termination date of this Agreement the Client may, in its absolute discretion and by written notice, request FalconDive to:

• return a complete copy of all Client Personal Data to the Client by secure file transfer in such format as is reasonably notified by the Client; and/or
• delete and procure the deletion of all other copies of Personal Data processed by FalconDive and any other contracted Sub-processor.

If the Client does not request the return or retention of their data within thirty (30) days of the termination date of this Agreement, FalconDive will, without further notice, delete the Client's data and provide a certificate of destruction to confirm the deletion. Silence or failure to act within this period will be considered acceptance of data deletion. FalconDive is also required to ensure that any Sub-processor that is engaged deletes or returns Personal Data.

FalconDive and each contracted Sub-processor may nonetheless retain Personal Data to the extent required by Data Protection Legislation and any other applicable law to the extent and for such period as required by virtue of such laws and always ensuring the confidentiality of such data. FalconDive will notify the Client if this clause applies on receipt of a written notice as detailed under 11.1.

12. Agreement

This Agreement expressly replaces and supersedes any and all other agreements, oral or written, between the Parties hereto with respect to the subject matter hereof.

13. Amendments

The Client may, at any time, with no less than thirty (30) working days' notice, revise this addendum by replacing the terms with applicable controller to processor standard clauses or similar terms forming part of an applicable certification scheme or those set by a relevant Supervisory Authority.

14. Data Protection Officer

FalconDive shall, where required, appoint a Data Protection Officer (DPO) and provide the Client the contact details of such person. The transmission of any communication between the Parties related to the Personal Data should be performed by e-mail.

If FalconDive is not required to appoint a Data Protection Officer, FalconDive will still provide details for a contact person for data protection issues.

The Client must appoint a DPO and forward contact details to FalconDive.

FalconDive has appointed a DPO/responsible person for Data Protection matters — Rakesh Manne, who may be contacted on rakesh.manne@lognormal.io.

15. Term and Termination

This Agreement shall enter into force concurrently with the Agreement and shall thereafter remain in force as long as the Agreement remains in force. This Agreement shall terminate, without notice, concurrently with the Agreement, regardless of the reason, save for those clauses which have been expressly stipulated to survive termination.

16. Liability

The Parties liability for damages as a result of breaches of this Agreement is, unless otherwise expressly stated, subject to the same limitations of liability as set forth in the Agreement. In case of multiple claims for damages under this Agreement and the Service Agreement, such liability shall be cumulative in relation to the maximum liability.

Nothing contained within this Agreement relieves FalconDive of their own direct responsibilities and liabilities as a Data Processor under Data Protection Legislation.

17. Costs

Each Party is responsible for its own costs in relation to the preparation and performance of this Agreement, including but not limited to fees and costs for its own representatives, advisors, brokers and other intermediaries and authorities.

Any additional performance or speed enhancements beyond what has been agreed upon in this Agreement or its Schedules will be provided by FalconDive only at an additional cost. Such costs will be communicated and agreed upon with the Client prior to implementation.

18. Severability

If any provision, in whole or in part, of this Agreement shall be held by a court of competent jurisdiction to be illegal, invalid or unenforceable, then the provision in question shall be deemed null and void whilst remaining provisions shall continue in full force and effect.

19. Disputes and Governing Law

The parties to this Agreement hereby submit to the choice of law and jurisdiction stipulated in the Agreement with respect to any disputes or claims arising under this Agreement.

Miscellaneous

In the event of any conflict between the terms of this DPA and any provision of the Services Agreement and any other agreement between the Parties, this DPA shall prevail solely with respect to any data protection matters.

Amendments to this agreement shall be made exclusively in writing. This shall also apply to this requirement of written form.

Should any provision of this agreement be invalid or ineffective, it shall, to the extent permitted by law, be replaced by that provision which comes closest in economic terms to the invalid or ineffective provision.

Contact us

For questions regarding this Data Processing Agreement, contact us at:

• Email — info@falcondive.io
• Phone — (+91) 4048960174