Data processing agreement

Annex to the Terms of Use (Customers)

Preliminary remark

This Annex – Data Processing Agreement (hereinafter “DPA”) governs the data protection relationship between the Provider and the Customer with regard to the provision and use of the boring.legal platform.

1. Definitions

All terms defined elsewhere in the Terms of Use apply accordingly to this DPA. In addition, the following definitions apply:

“Processing for internal business purposes” means those personal data processing activities for which the Customer and the Provider agree that the Provider may process them for its own internal business purposes.

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; for the purposes of this DPA.

“Data Protection Law” means the legal provisions applicable in various jurisdictions worldwide that relate to (i) the protection of the fundamental rights and freedoms of individuals and their right to privacy with regard to the processing of personal data under the Usage Contract or (ii) the protection, security, processing, transfer, storage or prevention of unauthorised access to personal data. Insofar as it concerns the relationship between the Parties regarding the processing of personal data by the Provider, Data Protection Law includes the GDPR as a minimum standard, irrespective of whether or not the personal data are subject to the GDPR.

“Data subject” means an identified or identifiable natural person within the meaning of Data Protection Law.

“EEA” means the European Economic Area, i.e. the member states of the European Union as well as Iceland, Liechtenstein and Norway.

“EU” means the European Union.

“GDPR” means the EU General Data Protection Regulation 2016/679.

“Personal data” means any information relating to a natural person that is subject to Data Protection Law. For the purposes of this DPA, it only includes personal data that (i) are entered into the boring.legal platform by the Customer or derived from its use; or (ii) are made available to or accessed by the Provider and/or its sub-processors in order to provide additional services under the Usage Contract.

“Personal data breach” means a proven (i) accidental or unlawful deletion, suppression, alteration, unauthorised disclosure of or unauthorised access by third parties to personal data; or (ii) a similar incident affecting personal data, where in each case the Customer is obliged under Data Protection Law to inform the competent data protection authorities and/or the data subjects.

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of its customer, whether directly as a processor of a customer or indirectly as a sub-processor of the processor which processes personal data on behalf of the customer.

“Sub-processor” means the companies engaged by the Provider in connection with the Usage Contract as processors of the Provider and which process personal data in accordance with this DPA.

2. General

The Provider processes personal data as a processor on behalf of the Customer as controller, unless the Provider processes personal data within the scope of Internal Processing; in that case the Provider acts as controller (this concerns the processing of Service-Generated Data in accordance with the Terms of Use).

The Parties agree that it is each Party’s responsibility to review and adopt the requirements imposed by the GDPR on controllers and processors with regard to the processing of personal data.

Annexes 1 to 3 to this DPA form part of it. They specify the agreed subject matter, the nature and purpose of the processing, the type of personal data, the categories of data subjects, the applicable technical and organisational measures and the sub-processors.

2. Security of processing

Appropriate technical and organisational measures: The Provider has implemented the technical and organisational measures required to provide the boring.legal platform and will apply them throughout the term of the Usage Contract.

Changes: The Provider may change the implemented technical and organisational measures at any time without prior notice, provided that it maintains a comparable or better level of security. Individual measures may be replaced by new measures serving the same purpose without reducing the level of security for the protection of personal data. At the Customer’s request, the Provider will provide the Customer with an up-to-date list of the technical and organisational measures in place.

3. Obligations of the Provider

Customer’s instructions: The Provider will only process personal data in accordance with the Customer’s documented instructions. The Usage Contract (including this DPA) constitutes such a documented initial instruction, and every use of the boring.legal platform by the Customer constitutes a further instruction. The Provider will follow all further instructions of the Customer insofar as they are required under data protection law, technically feasible and do not require changes to the boring.legal platform, with the exception of standard configurations. If one of the aforementioned exceptions applies, or if the Provider cannot comply with an instruction for other reasons, or if it considers that an instruction infringes Data Protection Law, the Provider will inform the Customer without undue delay (email is sufficient).

Processing based on legal requirements: The Provider may also process personal data if this is required under applicable EU law or the law of a member state. In such a case, the Provider will inform the Customer of this legal requirement before processing, unless the legal requirements prohibit such information on important grounds of public interest.

Personnel: For the processing of personal data, the Provider and its sub-processors only grant access to personal data to authorised personnel who have committed themselves to confidentiality. The Provider and its sub-processors regularly train personnel with access to personal data in the applicable data security and data protection measures.

Cooperation: At the Customer’s request, the Provider will cooperate with the Customer in a reasonable manner in handling requests from data subjects or supervisory authorities regarding the processing of personal data by the Provider or a personal data breach. The Provider will notify the Customer as quickly as possible, and in any event no later than required under applicable Data Protection Law, of any request it has received from a data subject regarding the processing of personal data, without itself responding to such a request without further instructions from the Customer, where applicable. The Provider provides functions that enable the Customer to correct or remove personal data from the boring.legal platform, to block access to them or to restrict their processing in accordance with Data Protection Law. If such functionality is not provided, the Provider will correct or remove personal data, block access to them or restrict their processing in accordance with the Customer’s instructions and Data Protection Law; apart from this, the Customer can access its personal data at any time during the term of the Usage Contract. By mutual agreement of the Parties, the Provider may provide further information and reasonable assistance beyond sentence 1 of this section, insofar as necessary. (4) of this DPA or for the purpose of responding to requests from data subjects or to fulfil other obligations under applicable Data Protection Law.

Notification of personal data breaches: The Provider will notify the Customer without undue delay after becoming aware of a personal data breach, insofar as required under Data Protection Law, and will provide the appropriate information in its possession about the personal data breach in order to assist the Customer in reporting a personal data breach, insofar as the Provider is obliged to do so under Data Protection Law. The Provider may provide this information in stages as it becomes available. Such notification shall not be construed or interpreted as an admission of fault or liability on the part of the Provider. Unless required by Data Protection Law, the Provider will not inform third parties of a personal data breach without first obtaining the Customer’s consent, at least in text form.

Data protection impact assessment: If the Customer is obliged under Data Protection Law to carry out a data protection impact assessment or a prior consultation with a supervisory authority, the Provider will, at the Customer’s request, provide the documents generally available for the boring.legal platform (e.g. this DPA, the Usage Contract, the Terms of Use, audit reports or certifications). Any further support will be agreed separately between the Parties.

3. Retrieval and deletion of personal data

Retrieval by the Customer: During the term and subject to the Usage Contract, the Customer can access the processed personal data at any time. The Customer can export and retrieve the personal data processed by the Provider in a standard format. Export and retrieval may be subject to technical restrictions; in this case the Provider and the Customer will find a mutually satisfactory method to give the Customer access to the personal data.

Deletion: Before termination of the Usage Contract, the Customer can use the Provider’s self-service export tools (where available) to export the personal data from the boring.legal platform (which constitutes a ‘return’ of the personal data). The Customer hereby instructs the Provider, at the end of the term of the Usage Contract, to securely delete the personal data remaining on the servers on which the boring.legal platform is hosted within a reasonable period in accordance with Data Protection Law, unless applicable EU or member state law requires longer storage.

4. Audits

Audit by the Customer: The Customer or an independent auditor acceptable to the Provider (this excludes auditors who are either competitors of the Provider or who are not sufficiently qualified or independent) may audit the Provider’s system environment and security measures with regard to the personal data processed by the Provider, insofar as:

• the Provider has not sufficiently demonstrated that it complies with the technical and organisational measures for the protection of the systems of the boring.legal platform by presenting either (i) a certification of compliance with ISO 27001 or other standards (scope as defined in the certificate) or (ii) a valid ISAE3402 and/or ISAE3000 or another SOC1-3 attestation report. Audit reports or ISO certifications are available from the external auditor or the Provider at the Customer’s request;
• a personal data breach has occurred;
• an audit is formally requested by the Customer’s competent data protection authority; or
• Data Protection Law grants the Customer a direct audit right and provides that the Customer only carries out one audit in any period of twelve (12) months, unless Data Protection Law provides for more frequent audits.

Further requirements: Audits of the Provider’s system environment and security measures relevant to the Customer’s personal data processed by the Provider on the basis of this DPA are subject to the condition that it can be technically ensured that no access can be gained during an audit to data that are not processed under the subscription agreement with the Customer, and in particular to data of other customers of the Provider. The Provider may refuse to provide information or access to the Provider’s business premises and IT systems if and insofar as this could breach the Provider’s confidentiality obligations. The Provider will provide the Customer with all information necessary to demonstrate compliance with the obligations agreed herein.

Audit intervals: Except in the event of a personal data breach, the Customer shall announce each audit at least sixty (60) days in advance, unless Data Protection Law or a competent data protection authority provides for shorter notice (or earlier, if the Parties so agree). The Customer’s audits are limited to a maximum of three (3) working days, unless the Parties agree otherwise. The Customer will provide the Provider with the results of an audit without being asked.

Audit costs: The Customer bears the costs of an audit, unless such an audit reveals a material breach of this DPA by the Provider; in that case, the Provider bears its own costs for an audit. If an audit establishes that the Provider has breached its obligations under this DPA, the Provider will remedy the breach without undue delay at its own expense.

5. Sub-processors

Permitted use: The Provider is entitled to engage subcontractors (additional processors) after prior express written or documented authorisation by the Customer. The Customer hereby grants a general authorisation to engage the sub-processors listed further below in this document. The use of sub-processors is generally subject to the requirements under Clause 5(2), and changes to the subcontractors engaged by the Provider are subject to the requirements under Clause 5(3) of this DPA.

A general prerequisite for the use of sub-processors by the Provider is that:

• the Provider engages the sub-processor under a written contract (including in electronic form) in accordance with the terms of this DPA with regard to the processing of personal data, and the Provider is fully liable for all breaches, acts and omissions of its sub-processors in accordance with this DPA; and that
• the Provider will exercise reasonable care in selecting sub-processors and will review a sub-processor’s security, data protection and confidentiality measures before selection to ensure that it is able to guarantee the level of protection for personal data required by this DPA, and the Provider will regularly evaluate the security measures of each sub-processor with regard to data processing.

New sub-processors: Insofar as the Provider proposes the use of new sub-processors, the following applies:

• The Provider will inform the Customer in advance (it notifies the Customer by email or via the boring.legal platform of every update to the list of sub-processors, including the name, place of processing and role of the new sub-processor); and
• the Customer may object to such changes in accordance with Clause 5(3) of this DPA.

Objection to new sub-processors: The Customer may object to any newly proposed sub-processor as follows:

• If the Customer has a legitimate reason to object to the processing of personal data by a new sub-processor, it may terminate the Usage Contract for which the new sub-processor is to be used by notifying the Provider (text form is sufficient). Such termination takes effect at the time specified by the Customer, but no later than fourteen (14) days after the date of the Provider’s notification informing the Customer of the new sub-processor. If the Customer does not terminate within this period of fourteen (14) days, it is deemed to have accepted the new sub-processor.
• Within the period of fourteen (14) days from the date of the Provider’s notification informing the Customer of the new sub-processor, the Customer may request that the Parties find a solution in good faith for the reasons underlying the Customer’s objection. Such negotiations do not extend the notice period and do not affect the Provider’s right to use the new sub-processor(s) after the period of fourteen (14) days has expired.
• Any termination under this Clause 5(3) of this DPA is deemed to be without fault and is subject to the other terms of the Usage Contract, in particular with regard to remuneration payable by the Customer or other contractual obligations.

Emergency replacement: The Provider may replace a sub-processor without prior notice if the reason for the change is beyond the Provider’s reasonable control and immediate replacement is necessary for security or other urgent reasons, subject to the provisions of Clause 5(1) of this DPA. In this case, the Provider will inform the Customer of the new sub-processor as soon as possible after its appointment. Clause 5(3) of this DPA applies accordingly.

6. International processing

The Provider is entitled to transfer personal data to countries outside the EU/EEA. If personal data processed under the Usage Contract and this DPA are transferred from a country within the EU/EEA to a country outside the EU/EEA, the Parties shall ensure that the personal data are adequately protected. To achieve this, the Provider will, unless otherwise agreed, only transfer personal data outside the EU/EEA in accordance with the requirements of Chapter V of the GDPR. When selecting service providers (in particular sub-processors), the Provider gives priority, where technically possible and economically reasonable, to service providers from a country within the EU/EEA.

7. Documentation

Each Party is responsible for complying with its documentation obligations, in particular for keeping records of processing activities insofar as required under Data Protection Law. Each Party will reasonably support the other Party in fulfilling its documentation obligations, including by providing the information required by the other Party in a manner reasonably requested by the other Party (e.g. using electronic systems), in order to enable the other Party to comply with its data protection obligations regarding the documentation of processing. Insofar as provided for by Data Protection Law, the Provider will make this documentation available to the Customer or a competent supervisory authority upon request.

Annex to this DPA:

Annex - Details of data processing (see below).

Annex – Details of data processing

Sub-processors – web application (app service)

Sub-processors – marketing website