Subspace is here for WebRTC applications.

LEARN MORE
SUBSPACESUBSPACE

Subspace is here for WebRTC applications.

LEARN MORE
SUBSPACESUBSPACE
Log In

Data Processing Addendum

This Data Processing Addendum (“DPA”) amends and forms part of the [End User License Agreement / Terms of Service / Agreement] (the “Agreement”) between Subspace, Inc. (“Company”) and the [Customer, Inc.] (“Customer”). This DPA prevails over any conflicting term of the Agreement.

Definitions

1.1 In this DPA: a) “Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing”, “Processor”, and “Supervisory Authority” have the meaning given to them in the GDPR; “Customer Personal Data” means any Customer Data that constitutes Personal Data, the Processing of which is subject to Data Protection Law, for which Customer or Customer’s customers are the Controller, and which is Processed by Company to provide the Services; b) “Data Protection Law” means General Data Protection Regulation (EU) 2016/679 (“GDPR”), and e-Privacy Directive 2002/58/EC (as amended by Directive 2009/136/EC), and their national implementations in the European Economic Area (“EEA”), Switzerland and the United Kingdom, each as applicable, and as may be amended or replaced from time to time; c) “Data Subject Rights” means Data Subjects’ rights to information, access, rectification, erasure, restriction, portability, objection, and not to be subject to automated individual decision-making in accordance with Data Protection Law; d) “International Data Transfer” means any transfer of Customer Personal Data from the EEA, Switzerland or the United Kingdom to an international organization or to a country outside of the EEA, Switzerland and the United Kingdom; e) “Services” means the services provided by Company to Customer under the Agreement; f) “Subprocessor” means a Processor engaged by Company to Process Customer Personal Data; and g) “Standard Contractual Clauses” means the clauses annexed to EU Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council (OJ L 39, 12.2.2010, p. 5-18). Scope and applicability

2.1 This DPA applies to Processing of Customer Personal Data by Company to provide the Services.

2.2 Customer is a Controller and appoints Company as a Processor on behalf of Customer. Customer is responsible for compliance with the requirements of Data Protection Law applicable to Controllers.

2.3 Customer acknowledges that Company may Process Personal Data relating to the operation, support, or use of the Services for its own business purposes, such as billing, account management, data analysis, benchmarking, technical support, product development, and compliance with law. Instructions

3.1 Company will Process Customer Personal Data to provide the Services and in accordance with Customer’s documented instructions. The Controller’s instructions are documented in this DPA, the Agreement, and any applicable statement of work.

3.2 Unless prohibited by applicable law, Company will inform Customer if Company is subject to a legal obligation that requires Company to Process Customer Personal Data in contravention of Customer’s documented instructions. Personnel

4.1 Company will ensure that all personnel authorized to Process Customer Personal Data are subject to an obligation of confidentiality. Security and Personal Data Breaches

5.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Company will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

5.2 Company will notify Customer without undue delay after becoming aware of a Personal Data Breach involving Customer Personal Data. If Company’s notification is delayed, it will be accompanied by reasons for the delay. Subprocessing

6.1 Customer hereby authorizes Company to engage Subprocessors. A list of Company’s current Subprocessors is [available at URL].

6.2 Company will enter into a written agreement with Subprocessors which imposes the same obligations as required by Data Protection Law. Company will notify Customer prior to any intended change to Subprocessors. Customer may object to the addition of a Subprocessor based on reasonable grounds relating to a potential or actual violation of Data Protection Law by providing written notice detailing the grounds of such objection within thirty (30) days following Company’s notification of the intended change. Customer and Company will work together in good faith to address Customer’s objection. Assistance

7.1 Taking into account the nature of the Processing, and the information available to Company, Company will assist Customer, including, as appropriate, by implementing technical and organizational measures, with the fulfilment of Customer’s own obligations under Data Protection Law to: comply with requests to exercise Data Subject Rights; conduct data protection impact assessments, and prior consultations with Supervisory Authorities; and notify a Personal Data Breach. Audit

8.1 Company will make available to Customer required information necessary to demonstrate compliance with the obligations of this DPA and allow for and contribute to audits, including inspections, as mandated by a Supervisory Authority or reasonably requested by Customer by at least sixty (60) days’ notice, and no more than once per calendar year, and performed by an independent auditor as agreed upon by Customer and Company. Any such audit must be conducted during Company’s business hours, without disruption to Company’s operations, and in compliance with Company’s confidentiality obligations.

8.2 Company will inform Customer if Company believes that Customer’s instruction under Section 8.1 infringes Data Protection Law. Company may suspend the audit or inspection, or withhold requested information until Customer has modified or confirmed the lawfulness of the instructions in writing. International Data Transfers

9.1 Customer hereby authorizes Company to perform International Data Transfers to any country deemed adequate by the EU Commission; on the basis of appropriate safeguards in accordance with Data Protection Law; or pursuant to the Standard Contractual Clauses referred to in Section 9.2.

9.2 By signing this DPA, Customer and Company conclude the Standard Contractual Clauses, which are hereby incorporated into this DPA and completed as follows: the “data exporter” is Customer; the “data importer” is Company; the governing law in Clause 9 and Clause 11.3 of the Standard Contractual Clauses is the law of the country in which Customer is established; Appendix 1 and Appendix 2 to the Standard Contractual Clauses, are covered by this DPA; and the optional indemnification clause is struck. Notifications

10.1 All notices made under this DPA shall be made to Customer via email at [email]. Termination and return or deletion

11.1 This DPA is terminated upon the termination of the Agreement. Customer may request return of Customer Personal Data up to ninety (90) days after termination of the Agreement. Unless required or permitted by applicable law, Company will delete all remaining copies of Customer Personal Data within one hundred eighty (180) days after returning Customer Personal Data to Customer.