Data Processing Addendum
This Data Processing Addendum (“DPA”) is a part of the
contracting document or documents and
include one or more of the following or similarly structured documents (i.e.
Master Service Agreement; Subscription Agreement, License Agreement or similar
agreement) (the “Agreement”) between the entity
signing the Order Form or other ordering document into which the Agreement is
incorporated (“Customer”) and NAVEX Global UK Limited (hereinafter “NAVEX
Global”) to reflect the parties’ agreement related to Processing of Customer
Data, including Personal Data, in accordance with the requirements of
applicable Data Protection Laws and Regulations.
HOW THIS DPA APPLIES
This DPA is an addendum to and forms
part of the Agreement. For avoidance of
doubt, this DPA shall apply to any entity that executes an ordering document
that is governed by the Agreement.
This DPA shall not replace any
additional rights related to Processing of Customer Data previously negotiated
by Customer in the Agreement, but shall replace any existing data processing
addendum to the Agreement unless otherwise explicitly stated herein.
DATA PROCESSING TERMS
In the course of providing the
Services to Customer pursuant to the Agreement, NAVEX Global may Process
Personal Data on behalf of Customer. NAVEX Global agrees to comply with the
following provisions with respect to any Personal Data submitted by or for Customer
to the Services or collected and Processed by or for Customer using the
a) “Affiliate” means, in relation to a party,
its subsidiary or holding company or any subsidiary of any such holding
company, the terms "subsidiary" and "holding company"
having the meanings given to them under the applicable law.
b) “Customer Data” means any data and
information Customer provides, generates, transfers, or makes available to NAVEX
Global under the Agreement, whether in printed, electronic, or other format.
c) “Data Controller” means the entity
which determines the purposes and means of the Processing of Personal Data.
d) “Data Processor” means the entity
which Processes Personal Data on behalf of the Data Controller.
e) “Data Protection Requirements” means
all data protection and privacy laws and regulations, as applicable to a party,
including: (i) Regulation (EU) 2016/679 of the European Parliament and of the
Council on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation or GDPR); and (ii) any other local
or regional data protection, data privacy or data security laws. It also includes, where applicable to NAVEX
Global’s business, in its delivery of the Services, or as otherwise required in
this DPA, application of certain certification requirements, specifically both
the EU-U.S. and Swiss-U.S. Privacy Shield Principles, as further described in
“Data Subject” means an identified or identifiable natural person
whose Personal Data is collected and hosted by NAVEX Global on behalf of Customer,
as may be more fully set forth in Data Protection Requirements, and shall be
meant to include any different but similar term used in Data Protection
g) "European Economic Area"
means the member states of the European Union as well as Iceland, Liechtenstein
h) “GDPR” means the Regulation (EU)
2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data
and on the free movement of such data, and repealing Directive 95/46/EC.
“NAVEX Global” means NAVEX Global, Inc., a company incorporated
under the laws of Delaware.
“NAVEX Global Group” means NAVEX Global and its Affiliates engaged
in the Processing of Personal Data.
k) “Personal Data” means any information
relating to an identified or identifiable natural person as further defined
under Data Protection Requirements, which may include a term similar to
Personal Data but which shall have the same general meaning (for example
“personal information”), where such data is submitted to the Services as Customer
Data as further specified in Appendix 2.
"Privacy Shield" means the EU-U.S. Privacy Shield and
the Swiss-U.S. Privacy Shield self-certification programs, both operated by the
U.S. Department of Commerce and approved by the European Commission pursuant to
Decision C(2016) 4176 of July 12, 2016 (and as may be amended from time to
time) and pursuant to the Swiss Federal Council pronouncement on 11 January
m) "Privacy Shield Principles" means
the Privacy Shield Framework Principles (as supplemented by any Supplemental
Principles) which may be found on the U.S. Department of Commerce website, and
as may be amended, superseded or replaced from time to time.
n) “Processing” means any operation or
set of operations which is performed on Personal Data or on sets of Personal
Data, whether or not by automated means, such as collection, recording,
organization, structuring, storage, adaptation or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or otherwise
making available, alignment or combination, restriction, erasure or
destruction, and shall be meant to include any different but similar term used
in the Data Protection Requirements and as may be more fully set out in Appendix 2.
o) “Security Specifications” means the
security measures employed by NAVEX Global to protect the Personal Data in its
possession in connection with delivering the Services and as more fully set out
in in Appendix 1.
p) Sub-processor” means any Data
Processor engaged by NAVEX Global or a member of the NAVEX Global Group.
PROCESSING OF PERSONAL DATA
Roles of the Parties. The parties acknowledge and agree that with
regard to the Processing of Personal Data, Customer is the Data Controller, NAVEX
Global is a Data Processor and that NAVEX Global or members of the NAVEX Global
Group will engage Sub-processors pursuant to the requirements set forth in
section 8 “Sub-processing” below.
Further, each party agrees to comply with its respective obligations
under the Data Protection Requirements in relation to its Processing of the
Personal Data and NAVEX Global agrees to provide all assistance reasonably
required by Customer to enable Customer to take reasonable and appropriate
steps to ensure that NAVEX Global effectively Processes Personal Data in a
manner consistent with Customer’s obligations under Data Protection
Requirements, including the GDPR or the Privacy Shield Principles, as
Processing of Personal Data. Customer
shall, in its use of the Services, Process Personal Data in accordance with the
requirements of Data Protection Requirements. For the avoidance of doubt, Customer’s
instructions to NAVEX Global, for the Processing of Personal Data, shall comply
with Data Protection Requirements. NAVEX Global shall inform Customer without
undue delay if, in its opinion, an instruction infringes Data Protection Requirements.
The foregoing notwithstanding, NAVEX Global is not obligated to evaluate
whether an instruction issued by Customer complies with applicable Data
NAVEX Global’s Processing of Personal Data. NAVEX Global shall only Process Personal
Data on behalf of and in accordance with Customer’s instructions and shall
treat Personal Data as Confidential Information. Customer instructs NAVEX
Global to Process Personal Data for the following purposes: (i) Processing in accordance with the
Agreement and applicable Order Form(s); (ii) Processing initiated by users in
their use of the Services; and (iii)
Processing to comply with other reasonable instructions by Customer that are
consistent with the terms of the Agreement.
Further, NAVEX Global agrees that it shall, in its capacity as Data Processor:
Only carry out Processing of Personal
Data on Customer’s instructions, as set forth in the Agreement for the purpose
of providing the Services;
Provide at least the same level of
protection to Personal Data as is required by this DPA and the Data Protection
ensure that persons authorized to
Process the Personal Data are bound to obligations of confidentiality or are
under an appropriate statutory obligation of confidentiality;
With the exception of those
pre-approved subcontractors detailed in section 8)b) and engaged in the performance of the
Services, not share or allow access to files containing Personal Data to any
third party for further Processing by that third party or its agents (except
for the purposes of mere routing of Personal Data through a third party such as
routing through a telecommunications carrier);
Promptly notify Customer if it makes a
determination that it can no longer meet its obligation to provide the same
level of protection as is required by Data Protection Requirements, and in such
event, to work with Customer to promptly take reasonable and appropriate steps
to stop and remediate any Processing until such time as the Processing meets
the level of protection as is required by the Data Protection Requirements;
Implement and maintain throughout the
term of this DPA appropriate technical and organizational measures to protect
Personal Data against unauthorized or unlawful processing and accidental
destruction or loss so as to allow Customer to comply with the requirement to
implement appropriate technical and organizational security measures, in
accordance with the Security Specifications and other applicable provisions of
the Data Protection Requirements;
At Customer’s sole election, cease Processing
Personal Data promptly if in Customer’s reasonable discretion, NAVEX Global is
not providing the same level of protection to Personal Data as is required by
Data Protection Requirements.
Keep or cause to be kept, accurate
records relating to all Processing of Personal Data on behalf of Customer as
part of the Services;
Promptly refer to Customer any
requests, notices or other communication from Data Subjects, any national data
protection authority established in the jurisdiction of Customer, or any other
law enforcement authority, for such Customer to resolve, and as the case may
Provide all assistance reasonably required by Customer
to enable Customer to respond to, comply with or otherwise resolve any request,
question or complaint made to it by a Data Subject in relation to the Processing
of Personal Data associated with such Data Subject; and
Provide all assistance reasonably
required by Customer to enable Customer to respond to, comply with or otherwise
resolve any request, question or complaint made to it that is received from:
(a) any independent recourse mechanism that Customer elects to adopt under the
Privacy Shield Principles (where applicable); (b) any applicable U.S., EU or
Swiss regulator or data protection authority; or (c) any arbitration panel set
up under Annex I to the Privacy Shield Framework.
Provide reasonable assistance and
support to Customer in Customer’s performance of any data protection impact
Provide assistance to Customer in
ensuring compliance, if applicable, with the obligations pursuant to Articles
32 to 36 of the GDPR, taking into account the nature of the Processing and the
information available to NAVEX Global;
NAVEX Global agrees it will not, in
its capacity as Data Processor:
Disclose Personal Data to any third
party individual other than for the purposes of complying with Data Subject
access requests in accordance with Data Protection Requirements and in
accordance with this DPA, as applicable.
Include Personal Data in any product
or service offered by NAVEX Global to third parties;
RIGHTS OF DATA SUBJECTS
Correction, Blocking and Deletion. To the extent Customer, in its use of the
Services, does not have the ability to correct, amend, block or delete Personal
Data, as required by Data Protection Requirements, NAVEX Global shall comply
with any commercially reasonable request by Customer to facilitate such actions
to the extent NAVEX Global is legally permitted to do so.
Data Subject Requests. NAVEX Global shall, to the extent legally
permitted, without undue delay notify Customer if it receives a request from a
Data Subject for access to, correction, amendment or deletion of that
individual’s Personal Data. NAVEX Global shall not respond to any such Data
Subject request without Customer’s prior written consent, or as required by
Data Protection Requirements, except to confirm that the request has been
received and relates to Customer. NAVEX Global shall provide Customer with
commercially reasonable cooperation and assistance in relation to a Data
Subject’s request for access to that individual’s Personal Data, to the extent
legally permitted and to the extent Customer does not have access to such
Personal Data through its use of the Services.
NAVEX GLOBAL PERSONNEL
Confidentiality. NAVEX Global shall ensure that its personnel
engaged in Processing Personal Data are informed of the confidential nature of
the Personal Data, have received appropriate training on their responsibilities
and have executed written confidentiality agreements. NAVEX Global shall ensure
that such confidentiality obligations survive the termination of the personnel
Reliability. NAVEX Global shall take commercially reasonable steps to ensure
the reliability of any NAVEX Global personnel engaged in the Processing of
Limitation of Access. NAVEX Global shall ensure that NAVEX Global’s
access to Personal Data is limited to those personnel who require such access
to perform under the Agreement.
Data Protection Officer. Members of the NAVEX Global Group have
appointed a data protection officer where such appointment is required by Data
Protection Requirements. The appointed
person may be reached at firstname.lastname@example.org.
TECHNICAL AND ORGANIZATIONAL MEASURES AND
NAVEX Global shall maintain
administrative, physical and technical safeguards for protection of the
security, confidentiality and integrity of Customer Data, including Personal
Data, as set forth in the Security Specifications. NAVEX Global regularly
monitors compliance with these safeguards and will not materially decrease the
overall security of the Services during the term of the Agreement.
NAVEX Global has obtained third-party
certifications and audits as set forth in the Security Specifications. Upon Customer’s
written request, at reasonable intervals, NAVEX Global shall provide a copy of NAVEX
Global’s then most recent third-party audit or certification, as applicable, or
any summaries thereof, that NAVEX Global generally makes available to its Customers
at the time of such request.
Taking into account the state of the
art, the costs of implementation and the nature, scope, context and purposes of
Processing as well as the risk of varying likelihood and severity for the
rights and freedoms of natural persons, NAVEX Global shall, and shall procure
that each Sub-Processor shall implement and maintain, appropriate technical and
organizational measures in relation to the Processing of Personal Data by NAVEX
Global or Sub-Processor to ensure a level of security appropriate to that risk
including, as appropriate, the measures referred to in Article 32(1) of the
In assessing the appropriate level of
security, NAVEX Global shall take into account all risks that are presented by Processing
the relevant Personal Data, in particular from a Security Incident (as defined
SECURITY INCIDENT MANAGEMENT AND NOTIFICATION
Security Incident Notification. NAVEX
Global maintains security incident management policies and procedures as
indicated in the Security Specifications and shall, to the extent permitted by
law, without undue delay notify Customer of any actual or reasonably suspected
accidental or unlawful destruction, loss, alteration, unauthorized disclosure
or access to Customer Data, including Personal Data, by NAVEX Global or its
Sub-processors of which NAVEX Global becomes aware (a “Security Incident”). To
the extent available, such notification shall describe the nature of the Security
Incident, including the categories and approximate number of Data Subjects
concerned and the categories and approximate number of Personal Data records
Security Incident Response. To
the extent such Security Incident is caused by a violation of the requirements
of this DPA by NAVEX Global, NAVEX Global shall: (i) reasonably cooperate with Customer
to investigate and resolve the Security Incident; (ii) make reasonable efforts
to identify and remediate the cause of such Security Incident; and (iii) keep Customer
up-to-date about developments in connection with the Security Incident.
RETURN AND DELETION OF CUSTOMER DATA
NAVEX Global shall return Customer Data to Customer and delete Customer
Data in accordance with the procedures and timeframes specified in the Agreement.
In the event the foregoing is not specified in the Agreement, and unless
otherwise agreed by the parties, all Customer Data shall be deleted within
forty-five (45) days of expiration or termination of the Agreement or Order
Form (as applicable). Customer Data stored in back-ups shall be overwritten in
accordance with NAVEX Global’s backup and retention cycle.
Customer authorizes NAVEX Global to appoint (and permit each Sub-processor appointed in accordance with this section
to appoint) Sub-processors in accordance with this section.
NAVEX Global may
continue to use those Sub-processors already engaged by NAVEX Global as at the
date of this DPA. Customer consents to
the use of the Sub-processors set forth in the following link (as applicable): https://www.navexglobal.com/en-us/service-hosting-providers.
In addition, Customer acknowledges and agrees that NAVEX Global’s Affiliates
may be retained as Sub-processors. The
foregoing link contains a mechanism to subscribe to notifications of the
addition of any new Sub-processors for each applicable Service, to which Customer
may subscribe. Such updates provided via this mechanism shall operate as the notification
of changes concerning the addition of any new Sub-processors, as required by
Data Protection Requirements.
NAVEX Global will notify Customer in advance of any changes to the
list of Sub-processors in place (except for deletions of Sub-processors without
replacement) at least thirty (30) days in advance of any Processing by the
proposed Sub-processor in accordance with the procedure set forth in Section 8)(b)
above. If Customer has a reasonable objection that relates to the
Sub-processors’ Processing of Personal Data, Customer may object to NAVEX
Global’s use of a Sub-processor by notifying NAVEX Global in writing at email@example.com
within thirty (30) days after receipt of NAVEX Global’s notice. In such event,
the Parties will work in good faith to discuss a resolution. NAVEX Global may
choose to: (i) not use the Sub-processor to Process Personal Data for Customer
or (ii) take the corrective steps requested by Customer in its objection and
use the Sub-processor. If neither of
these options are reasonably possible and Customer continues to object,
Customer may provide notice of termination of the affected portion of the
Service as to Customer.
Liability. NAVEX Global shall be liable for the acts and omissions of its
Sub-processors to the same extent NAVEX Global would be liable if performing
the services of each Sub-processor directly under the terms of this DPA.
a) During NAVEX Global’s regular business hours,
but not any more frequently than once a year, Customer may, at its sole
expense, perform a confidential audit of NAVEX Global’s technical operations
directly related to the Services provided under the Agreement. Such audits shall
not be duplicative of any additional audit right provided in the Agreement and shall
be conducted on a mutually agreed upon date, which shall not be sooner than
thirty (30) calendar days after NAVEX Global’s receipt of Customer’s written
request for such audit. Such audits
shall be limited to security systems as they pertain to the Services and the
onsite portion shall not exceed a cumulative four (4) hours at NAVEX Global’s
facilities. If the audit shall exceed
such four (4) hour period, Customer shall be responsible for payment of
professional services fees to NAVEX Global at the current hourly rate for
professional services. If the audit is
to be performed by a third party on Customer’s behalf, such third party shall
execute a confidentiality and non-disclosure agreement as presented by and for
the benefit of the Parties. Upon
completion of the audit, Customer shall promptly provide NAVEX Global a summary
of the findings from each report prepared in connection with any such audit and
discuss results, including any remediation plans. If audit results find NAVEX Global is not in
substantial compliance with the requirements of this DPA, then Customer shall
be entitled, at NAVEX Global’s expense, to perform up to one (1) additional
such audit in that year in accordance with the procedure set forth in this
Section. NAVEX Global agrees to work
with Customer to identify reasonable remediation actions and to promptly take
action at NAVEX Global’s expense to correct those matters or items upon which
NAVEX Global and Customer mutually agreed are identified in any such audit that
a) Self-certification. NAVEX Global, Inc. has self-certified under
the Privacy Shield so as to ensure that adequate safeguards are adduced with
respect to the protection of privacy and fundamental rights and freedoms of
individuals located in the European Economic Area and Switzerland for the
transfer of any Personal Data by Customer to NAVEX Global, Inc. Accordingly, NAVEX Global, Inc. agrees to
process any such Personal Data in compliance with the Privacy Shield
b) Sub-processing. NAVEX Global, Inc. agrees to remain responsible for any Personal
Data received from Customer under Privacy Shield which is subsequently
transferred to Sub-processor.
c) Conflict. In the event of any conflict or inconsistency between this DPA
and the Privacy Shield Principles, the Privacy Shield Principles shall prevail.
d) Adequacy. In the event that during the term of the Agreement NAVEX Global,
Inc. is no longer self-certified under Privacy Shield, NAVEX Global, Inc. shall
notify Customer and continue to process any Personal Data previously
transferred under the Privacy Shield in accordance with the Privacy Shield
Principles. In addition, NAVEX Global,
Inc. shall do all such things as are required to ensure adequate protection for
Personal Data in accordance with Data Protection Requirements. Such measures may include ensuring that NAVEX
Global, Inc. and Customer enter into Standard Contractual Clauses approved by
the European Commission or implement any other data export adequacy measure
permitted by Data Protection Requirements.
a) This DPA shall only become legally binding
between Customer and NAVEX Global when the Order Form or other ordering
document into which it is incorporated is executed in full.
b) NAVEX Global’s obligations as set
forth in this DPA shall survive until NAVEX Global no longer Processes Personal
1 to THE DATA PROCESSING ADDENDUM
NAVEX Global will maintain administrative, physical, and technical
safeguards for protection of the security, confidentiality and integrity of
Personal Data uploaded to the applicable Services, as described in the Security
Specifications below, as updated from time to time, and made reasonably
available by NAVEX Global upon request.
In addition, NAVEX Global engages a third party, annually, to perform an
audit that includes an assessment of the Security Specifications.
In addition to an Information Security Policy, NAVEX Global employs the
following technical and organisational measures to safeguard the records within
controls employed for preventing unauthorized persons from gaining access to
data processing systems within which personal data is processed or used.
Data center controls include:
access card reading system
of keys / documentation of key holders
desk with required sign in for all visitors
Monitored building management system
control measures taken for preventing data processing systems from being used
- Personal and individual user log-in when
entering the system and/or the corporate network
Password procedures minimum of 8 characters, with one upper case, lower
case, and digit. If the user account
has five invalid logon attempts, the account will be locked out. All
passwords expire after 90 days. Upon verification of the username and
password, the application uses session-based token authentication.
- Automated screen locks after a defined period
- Password protected screen savers
- All service account passwords are
electronically documented and protected against unauthorized access
- User accounts are audited quarterly
control measures taken to ensure that persons entitled to use a data
processing system have access only to personal data to which they have a
right of access, and that personal data cannot be read, copied, modified or removed
without authorizations in the course of processing or use and after storage.
authentication is based on username and strong password
- All transactional records contain identifiers to
distinguish client records.
- System processing uses a rule-based mechanism to
tailor data access to specific users and roles
insert, deletion, and modification are logged
control measures taken to ensure that personal data cannot be read, copied,
modified or removed without authorization during electronic transmission or
transport, and that it is possible to check and establish to which bodies the
transfer of personal data by means of data transmission facilities is
data on untrusted systems are encrypted in flight using TLS
storage is not used.
measures taken to ensure that it is possible to check and establish whether
and by whom personal data have been entered into data processing systems,
modified or removed.
- Record entry is restricted to a defined set of
- All entry is date/time stamped and includes
identifiers for entering party
- Firewalls and intrusion prevention systems are
in place to prevent unauthorized access
control measures employed to ensure that, in the case of commissioned
processing of personal data, the data are processed strictly in accordance
with the instructions of the principal.
agreements are in place for all individuals with data access
is conducted during onboarding and on a regular basis
third parties used for the processing of data other than as described in this
policy describes rights and obligations of agent and principle
control measures taken to ensure that personal data are protected from
accidental destruction or loss.
employ redundancies such as RAID
arrays and redundant equipment
air conditioning units are installed to provide redundant capacity in a
sensitivity smoke detection
fiber routing and multiple carriers
control measures taken to ensure that personal data collected for different
purposes can be processed separately.
systems are used to physically separate presentation, business
processing and storage
of duties is used internally to ensure functions pass through change
development, staging and production environments are maintained.
routing of data for processing is controlled through automated rules
and storage is on equipment owned by Processor
Appendix 2 to the DATA PROCESSING ADDENDUM
Data Controller is the legal entity that has executed the DPA.
NAVEX Global, Inc. is a provider of governance, risk and
compliance computing solutions, including whistleblower hotlines, case management
systems, employee training systems, policy management systems, third party risk
assessment systems, surveys and assessments and related consulting services,
which processes personal data upon the instruction of the Data Controller in
accordance with the terms of the Agreement.
Data Controller has instructed Data Processor to collect and host certain
information as may be submitted in the course of submitting a hotline report,
information for employees to perform certain training and/or access to certain
corporate policies and procedures, surveys and assessments, and/or information
for third parties necessary to perform corporate due diligence. The information submitted may include
Personal Data provided by the individual data subject or the organization in
accordance with the relevant Services selected by such organization. The extent of the Personal Data collected is
determined and controlled by the Data Controller in its sole discretion, and
may include, but is not limited to Personal Data relating to the following
categories of data subjects:
data exporter (who
are natural persons)
Employees or contact
of Data Controllers’ third party suppliers, business partners and
Data Controller’s users authorized by Data
Controller to use the relevant Service(s)
Categories of data
personal data processed concern the following categories of data:
name, job title, job position, location,
employer, relationship with the organization, e-mail address, telephone number;
for whistle-blower hotline reports, in
addition to the foregoing, the following may also be captured:
facts reported by a reporter about a
suspected violation, including how and where the suspected violation occurred
and how the reporter learned about the suspected violation;
identity, function and contact details of
individuals allegedly involved in the suspected violation; and
- identity, function and contact details
of individuals who could provide information relating to the suspected
Special categories of data (if
Data Controller, reporters or authorized users of the
Services may submit special categories of data to the Services, the extent of
which is determined and controlled by the Data Controller in its sole
discretion, and which is for the sake of clarity Personal Data that may include
information revealing racial or ethnic origin, political opinions, religious or
philosophical beliefs, trade-union
membership, and the processing of data concerning health or sex life.
personal data transferred will be processed by data
processor as more fully set forth in the Agreement.