This Data Processing Agreement (“DPA”) forms part of, and is incorporated by reference into, the Terms and Conditions (the “Agreement”) between Wafix Technologies (“Wafix Technologies,” “we,” “us,” “our,” or “Processor”) and the Client identified in the applicable Order (“Client” or “Controller”), to the extent Wafix Technologies Processes Personal Data on behalf of the Client in the course of providing the Services. This DPA reflects the requirements of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and, where applicable, the UK GDPR and Data Protection Act 2018 (“UK GDPR”). Capitalized terms not defined in this DPA have the meanings given in the Agreement or, where applicable, in Article 4 of the GDPR.
1. Definitions
1.1 “Personal Data,” “Processing,” “Controller,” “Processor,” “Data Subject,” “Supervisory Authority,” and “Personal Data Breach” have the meanings given in Article 4 of the GDPR.
1.2 “Sub-processor” means any third party engaged by Wafix Technologies to Process Personal Data on behalf of the Client in connection with the Services.
1.3 “Client Personal Data” means Personal Data Processed by Wafix Technologies on behalf of the Client as a Processor in connection with the Services, such as end-user or customer data contained within a website, application, database, or marketing list that Wafix Technologies hosts, develops, or manages for the Client. Client Personal Data does not include Personal Data that Wafix Technologies collects and Processes as an independent Controller in its own right (for example, the Client’s own business contact information collected for account administration), which is governed by the Wafix Technologies Privacy Policy.
1.4 “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries pursuant to the GDPR, as adopted by the European Commission (Commission Implementing Decision (EU) 2021/914), and, where applicable, the UK International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner’s Office.
2. Roles of the Parties
2.1 The parties acknowledge that, with respect to Client Personal Data, the Client acts as Controller (or, where applicable, Processor on behalf of a further upstream Controller) and Wafix Technologies acts as Processor, or as a sub-processor where the Client itself acts as a Processor.
2.2 With respect to Personal Data that Wafix Technologies collects and Processes for its own business purposes, including Client business contact information used for account management, billing, and Wafix Technologies’s own marketing (subject to the Client’s marketing preferences), Wafix Technologies acts as an independent Controller under the Wafix Technologies Privacy Policy, and this DPA does not apply to such Processing.
3. Scope and Details of Processing
3.1 Subject Matter. The subject matter of Processing under this DPA is the performance of the Services described in the applicable Order, to the extent such performance requires Wafix Technologies to Process Client Personal Data.
3.2 Duration. Processing will continue for the duration of the Agreement, plus any additional period during which Wafix Technologies retains Client Personal Data in accordance with Section 9.
3.3 Nature and Purpose. The nature and purpose of Processing is to provide the Services requested by the Client, which may include website hosting, application development and hosting, database management, email and marketing platform management, technical support, and related digital services, as further described in the applicable Order.
3.4 Categories of Data Subjects. Data Subjects may include the Client’s customers, website visitors, end users, employees, and other individuals whose Personal Data is contained in materials provided to, or systems managed by, Wafix Technologies in connection with the Services.
3.5 Categories of Personal Data. Categories of Client Personal Data may include, depending on the nature of the Services and the Client’s own systems, contact details, account credentials, transaction and purchase history, technical and usage data, and any other categories of Personal Data the Client incorporates into systems or content managed by Wafix Technologies. The Client is responsible for ensuring that any special categories of Personal Data (as defined in Article 9 of the GDPR) it includes within Client Personal Data are lawfully collected and that Wafix Technologies is informed of any heightened handling requirements.
4. Client Instructions
Wafix Technologies shall Process Client Personal Data only on documented instructions from the Client, including with regard to transfers of Client Personal Data to a third country, unless required to do otherwise by European Union, member state, United Kingdom, or other applicable law, in which case Wafix Technologies shall inform the Client of that legal requirement before Processing, unless prohibited from doing so by law. The Agreement, including the applicable Order and this DPA, constitutes the Client’s documented instructions as of the effective date of the applicable Order. Any additional or alternative instructions must be agreed in writing.
5. Confidentiality
Wafix Technologies shall ensure that persons authorized to Process Client Personal Data have committed themselves to confidentiality obligations or are under an appropriate statutory obligation of confidentiality, consistent with Section 14 (Confidentiality and Non-Disclosure) of the Terms and Conditions.
6. Security of Processing
6.1 Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk to the rights and freedoms of Data Subjects, Wafix Technologies shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, consistent with Article 32 of the GDPR and the Wafix Technologies Security Policy, including, as appropriate: (a) encryption of Personal Data in transit; (b) measures to ensure ongoing confidentiality, integrity, availability, and resilience of Processing systems; (c) the ability to restore availability and access to Personal Data in a timely manner in the event of a physical or technical incident; and (d) a process for regularly testing and evaluating the effectiveness of technical and organizational measures.
6.2 Wafix Technologies shall ensure that access to Client Personal Data is limited to personnel who require such access to perform the Services.
7. Sub-processors
7.1 General Authorization. The Client provides Wafix Technologies with a general authorization to engage Sub-processors to Process Client Personal Data in connection with the Services, including hosting providers, cloud infrastructure providers, email and communications platforms, and other vendors reasonably necessary to perform the Services.
7.2 Notice of Changes. Wafix Technologies will maintain a current list of its material Sub-processors, available upon request, and will provide the Client with reasonable advance notice of the addition or replacement of a material Sub-processor, giving the Client the opportunity to object on reasonable data protection grounds. If the Client objects and the parties cannot resolve the objection, either party may terminate the affected Services upon written notice.
7.3 Flow-Down Obligations. Wafix Technologies shall enter into a written agreement with each Sub-processor imposing data protection obligations substantially similar to those set out in this DPA, and shall remain liable to the Client for the performance of each Sub-processor’s obligations to the same extent Wafix Technologies would be liable if performing the Services directly.
8. Assistance with Data Subject Rights
Taking into account the nature of the Processing, Wafix Technologies shall provide reasonable assistance to the Client, insofar as this is possible, by appropriate technical and organizational measures, for the fulfillment of the Client’s obligation to respond to requests from Data Subjects seeking to exercise their rights under Chapter III of the GDPR (including rights of access, rectification, erasure, restriction, portability, and objection). Where Wafix Technologies receives a request directly from a Data Subject relating to Client Personal Data, Wafix Technologies will promptly forward the request to the Client and will not respond directly except to confirm receipt, unless otherwise instructed by the Client or required by law.
9. Data Retention and Deletion
Upon termination or expiration of the Agreement, or upon the Client’s earlier written request, Wafix Technologies shall, at the Client’s election, delete or return all Client Personal Data to the Client, and delete existing copies, within a commercially reasonable period not to exceed sixty (60) days, unless applicable law requires storage of the Client Personal Data for a longer period, in which case Wafix Technologies shall continue to protect that data in accordance with this DPA for the duration of such retention.
10. Personal Data Breach Notification
10.1 Wafix Technologies shall notify the Client without undue delay, and in any event within seventy-two (72) hours of becoming aware, after becoming aware of a Personal Data Breach affecting Client Personal Data.
10.2 Such notification shall, to the extent reasonably known at the time, describe: (a) the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects and Personal Data records concerned; (b) the likely consequences of the Personal Data Breach; and (c) the measures taken or proposed to be taken by Wafix Technologies to address the Personal Data Breach, including measures to mitigate its possible adverse effects.
10.3 Wafix Technologies shall cooperate with the Client and take reasonable steps as directed by the Client to assist in the investigation, mitigation, and remediation of a Personal Data Breach, and to assist the Client in meeting its own notification obligations to Supervisory Authorities and affected Data Subjects under Articles 33 and 34 of the GDPR.
11. Data Protection Impact Assessments
Wafix Technologies shall provide reasonable assistance to the Client, taking into account the nature of Processing and the information available to Wafix Technologies, with any data protection impact assessments and prior consultations with Supervisory Authorities that the Client reasonably determines are required under Articles 35 and 36 of the GDPR in relation to the Services.
12. Audits
Wafix Technologies shall make available to the Client information reasonably necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Client or an auditor mandated by the Client, subject to reasonable advance written notice, confidentiality obligations, and no more than once per calendar year absent a Personal Data Breach or a specific regulatory requirement. In lieu of an on-site audit, Wafix Technologies may provide a relevant third-party audit report or security certification, where available, and the Client agrees to accept such report where it reasonably addresses the Client’s audit objectives.
13. International Data Transfers
Where the Processing of Client Personal Data involves a transfer from the EEA, United Kingdom, or Switzerland to a country not subject to an adequacy decision, the parties agree that such transfer shall be governed by the Standard Contractual Clauses, which are incorporated into this DPA by reference, with Wafix Technologies (or the relevant Sub-processor) as “data importer” and the Client as “data exporter,” using Module Two (Controller to Processor) or Module Three (Processor to Processor), as applicable. To the extent the UK GDPR applies, the UK International Data Transfer Addendum shall apply in conjunction with the SCCs. Wafix Technologies shall implement supplementary measures as reasonably necessary to ensure an adequate level of protection for transferred Client Personal Data.
14. Liability
Each party’s liability arising out of or in connection with this DPA, whether in contract, tort, or otherwise, shall be subject to the limitations and exclusions of liability set out in Section 27 (Limitation of Liability) of the Terms and Conditions, except to the extent such limitations are not permitted under applicable data protection law.
15. Order of Precedence
In the event of a conflict between the terms of this DPA and the Terms and Conditions, this DPA shall govern with respect to the Processing of Client Personal Data. In the event of a conflict between this DPA and the SCCs, the SCCs shall prevail.
16. Term
This DPA shall remain in effect for as long as Wafix Technologies Processes Client Personal Data on behalf of the Client under the Agreement.