Data Processing Addendum

This Data Processing Addendum (“DPA”) supplements the Order concluded between you (the “Controller” or the “Customer”) and GetResponse ( defined below; the “Processor” or “GetResponse”).

BACKGROUND:

The Customer and GetResponse entered into a GetResponse Order Form for the GetResponse MAX or MAX² Service, or the GetResponse MAX (Enterprise) or MAX² Service Agreement (the “Order”).

1. Definitions

1.1    The following words and phrases used in this DPA shall have the following meanings except where the context otherwise requires:

“Applicable Law”    GDPR, or the PDPA, or LGPD, or any other applicable data protection regulations that Customer or GetResponse are

subject to and that may apply to Personal Data processing activities.

“Controller”                              the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the

purposes and means of the processing of personal data; here the Customer.

“Data Subject”  a natural person who is the subject of Personal Data Processing. 

“GDPR”                                    the EU General Data Protection Regulation (2016/679) and laws implementing and supplementing GDPR.

“GetResponse”                        one of the following entities: (i) GetResponse S. A. al. Grunwaldzka 413, Gdansk (80-309) Poland or (ii) GetResponse Inc. 3

Germay Dr, Ste 5 PMB 15672 Wilmington, DE 19804 USA, or (iii) GetResponse Malaysia Sdn. Bhd.  Unit No. L25-1, Level 25,

TSLAW Tower, No. 39, Jalan Kamuning, 55100 Kuala Lumpur, Wilayah Persekutuan Kuala Lumpur, Malaysia, or (iv)

GetResponse Tecnologias Brasil Ltda. Irmã Gabriela Street, 51, Cidade Monções, City of São Paulo, State of São Paulo, Zip

Code 04571-130, Brasil, depending on which entity the Customer concluded the Order with.

“LGPD”                                     the Brazilian General Personal Data Protection Law 13.709/2018 (“Lei Geral de Proteção de Dados Pessoais” or “LGPD”)

a statutory law on data protection and privacy in the Federative Republic of Brazil.

“Personal Data”                     any information relating to a natural person who is directly or indirectly identified or identifiable from that information or

from that information in combination with other information in the possession of the Controller and as set out  HERE.

“PDPA”                                     the Malaysian Personal Data Protection Act of 2010 and its subsidiary legislation.

“Processing”                           any operation carried out with Personal Data, such as collection, production, receipt, classification, use, access,

reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation or control of the information,

modification, communication, transfer, dissemination or extraction.

“Processor”                            a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.

“Purpose”                                 the purpose for processing Personal Data as set out HERE.

“Services”                                 the Processing of Personal Data to be carried out by GetResponse in accordance with this DPA, the scope of which is set

out in HERE.

“Supervising Authority”         an authority tasked to implement and enforce privacy laws and regulations in a jurisdiction that the Customer and/or the

Processor is/are subject.

1.2 This DPA is subject to the terms of an Order and is incorporated into the Order.

1.3. Except as otherwise defined herein, all capitalized terms used in this DPA or its Annexes shall have the meaning attributed to them in the Order and Terms of Service constituting integral part of the Order.

2.      Subject matter of this DPA and Processing purposes

2.1 For the Purposes of this DPA, the Parties have agreed that the Customer is the Controller and GetResponse is the Processor of the Personal Data.

2.2    The subject matter, duration, nature and purposes of Processing and the Personal Data categories and Data Subject types in respect of which GetResponse may process to fulfill the business purposes of the Order and this DPA are available at www.getresponse.com/legal/max-dpa-description-of-processing.

2.3    The scope of the Services provided by GetResponse shall be limited to providing the Customer with the service tools to be used for the Purpose of Personal Data Processing.

2.4    The Services provided by GetResponse do not impact the scope of the Personal Data processed by the Customer under the Order and this DPA except for specifying the minimum scope of the Personal Data required for the proper use of the Services.

2.5    Unless expressly indicated in this DPA, GetResponse shall not determine nor be responsible for the purposes and means of Processing and shall not monitor the scope of the Personal Data processed nor the lawful bases for their Processing as determined by the Customer.

3.      Customers obligations

3.1  The Customer shall ensure that it will provide GetResponse with such information and co-operation as GetResponse reasonably requires to carry out its Services under this DPA, especially, but not limited to, the Personal Data Processing activities and purposes.

3.2   The Customer shall ensure that in circumstances where it intends to carry on the activities of direct marketing it has obtained all necessary marketing consents, including consents to send and distribute commercial information by email or telephone, SMS or any other messaging application or platforms and to use telecommunications terminal equipment and automated phone call systems for direct marketing purposes strictly in accordance with any Applicable Law.

3.3    The Customer shall use the Services in accordance with the Order and ensure the security of Customer Account authentication data at all times and protect this Account authentication data against unauthorized access and use.

3.4    The Customer also confirms and expressly undertakes not to engage in any activity in connection with Personal Data that is in breach of any Applicable Law.

3.5    The Customer shall not request or instruct GetResponse to perform any act or service that amounts to an infringement of any Applicable Law.

4.      Obligations of GetResponse

4.1 GetResponse shall process the Personal Data within the scope and for the purposes expressly indicated in the Agreement and this DPA only, and for no other scope or purpose.

4.2 GetResponse shall process the Personal Data only in accordance with Applicable Law and shall not perform its obligations under this DPA in such a way as to cause the Customer to breach any of its applicable obligations under Applicable Law.

4.3 GetResponse shall only process the Personal Data on behalf of the Customer and in strict compliance with the Customer’s instructions as set out and contained in this DPA and the Agreement and shall not process the Personal Data in any manner for any other purposes which also applies to transfers of Personal Data to a third country or an international organization under GDPR, save as is required by applicable legal regulations or by any regulatory body to which GetResponse is subject, in which case GetResponse shall inform the Customer of this legal obligation prior to the start of processing, unless such law prohibits the provision of such information for reasons of important public interest.

4.4 GetResponse shall ensure that all GetResponse employees:

a. are informed of the confidential nature of the Personal Data and are bound by confidentiality obligations and use restrictions of the Personal Data;

b. have undertaken training on the data protection and security;

c.  are aware both of their personal duties and obligations under Applicable Law and this DPA.

4.5. In Processing Personal Data in accordance with this DPA and the Agreement, GetResponse shall implement and ensure that it has in place sufficient and appropriate technical and organizational security measures to protect the Personal Data against unauthorized or unlawful Processing, and against accidental loss, destruction, damage, misuse, alteration or disclosure.  These measures shall be sufficient and appropriate to avoid harm which might result from any unauthorized or unlawful Processing, accidental loss, destruction, misuse or damage to the Personal Data, having regard to the state of technological development, the costs of implementation (including, as appropriate, the measures referred to in Article 32(1) of the GDPR or any other that may arise from Applicable Law) and the nature, scope, context and purposes of Processing the Personal Data, as well as the risk of varying likelihood and severity for the rights and freedoms of the Data Subjects. GetResponse may at any time change the implemented measures provided that the security and protection level shall not be lower than originally provided and ensured.

4.6 GetResponse shall provide all reasonable assistance to the Customer in the Customer’s response to any Data Subject requests, complaints or enquiries from either a Data Subject or from a relevant Supervising Authority.

4.7 GetResponse shall assist the Customer in complying with the obligations pursuant to Articles 32 to 36 of the GDPR, if applicable, or any other Applicable Law in respect of the Services by providing the Customer with all necessary information and in respect of supporting the Customer in connection with any data protection impact assessment and consultation with a Supervising Authority shall do so only in so far as the Customer is unable to fulfil its obligations by other means and upon payment of the reasonable costs incurred by GetResponse.

5          Transfer of Personal Data outside the EEA, if GDPR applies

5.1. In case of transfer of Personal Data under this DPA outside the European Economic Area (EEA) to third countries that ensure an adequate level of protection of Personal Data, the implementing decisions of the European Commission stating the adequate level of protection of Personal Data shall apply.

5.2. In case of transfer of Personal Data under this DPA outside the European Economic Area (EEA) to third countries that do not ensure an adequate level of protection of Personal Data within the meaning of the GDPR, the SCC shall apply to this DPA. SCC content is available HERE.

5.3. To the extent that the Parties rely on the SCC to legalize the transfer of Personal Data outside the EEA, and this mechanism is no longer considered to provide an adequate level of protection within the meaning of the GDPR, the Parties undertake to cooperate to promptly identify and implement an appropriate alternative mechanism, that can lawfully support such a transfer.      

6.         Security measures

GetResponse shall at all times implement sufficient and appropriate technical and organizational security measures against unauthorized or unlawful Processing, access, disclosure, copying, modification, storage, reproduction, display or distribution of Personal Data, and against accidental or unlawful loss, destruction, alteration, disclosure, misuse or damage to Personal Data in accordance with the security measures listed at www.getresponse.com/legal/max-dpa-technical-measures.

7. Personal Data breach

7.1       GetResponse will promptly and within 48 hours notify the Customer if any Personal Data is lost or destroyed or becomes damaged, corrupted or unusable.

7.2       GetResponse will promptly and within 48 hours notify the Customer if it becomes aware of any accidental, unauthorized or unlawful Processing of the Personal Data or any Personal Data breach.

7.3       GetResponse will provide the Customer with a description of the nature of the Personal Data breach including the categories and approximate number of both the Data Subjects and Personal Data records concerned, the likely consequences and the measures taken to mitigate against any possible adverse effects arising from the Personal Data breach.

8. Sub-processors

8.1.The Customer authorises GetResponse to engage any of the third party sub-processors listed at www.getresponse.com/legal/max-dpa-list-of-subprocessors

8.2 In the event of any intended change to the listed sub-processors, GetResponse shall inform the Customer of such change upon 30 days’ notice via the web page indicated in Clause 8.1 herein. A change of the list doesn’t constitute a change of the DPA.

8.3 The Customer shall have the opportunity to object to such change by emailing GetResponse and within 14 days of receipt of notice of such intended change.

8.4 In the event of any objection GetResponse shall have a period of 30 days from receipt of such objection to determine its response. Parties shall jointly and in good faith attempt to find an appropriate solution to accommodate the Customer’s objection and possibility to continue using the Service. At the same time, GetResponse may indicate that expressing an objection may result in a limitation of certain functionalities of the Service. On the expiry of the 30-day period, if the Parties cannot agree on whether the list of sub-processers may be changed, either Party may terminate the Order pursuant to the relevant provisions of the Order.

8.5. Engagement of sub-processors may only take place within the limits of and for the purpose of performing the Services. GetResponse hereby represents that (i) the sub-processors it has engaged meet all the requirements arising from Applicable Law, (ii) it has entered into Personal Data processing agreements with the sub-processors and that such agreements include provisions imposing obligations analogical to those defined in the DPA in respect of GetResponse, and that (iii) the Personal Data protection standard followed by the sub-processors is at least equal to the Personal Data protection standard followed by GetResponse. If sub-processor chosen by GetResponse is located in a third country within the meaning of GDPR, and GDPR applies, GetResponse shall be obliged to ensure that the conditions set in Chapter V of the GDPR are met.

9.    Data Subject requests and third party rights

9.1 GetResponse shall reasonably support the Customer and take such technical and organizational measures as may be appropriate and promptly provide the Customer with such information as the Customer may reasonably require to enable the Customer to comply with the rights of Data Subjects under Applicable Law subject always to the Customer agreeing to pay the reasonable costs incurred by GetResponse in providing such assistance. The Customer shall be responsible to satisfy the requests of the Data Subjects and to prepare replies to such requests in accordance with the requirements under Applicable Law.

9.2 GetResponse will notify the Customer if it receives any complaint, notice or communication that relates directly or indirectly to the Processing of the Personal Data or to either Party’s compliance with the Applicable Law.

10.  Term

This DPA will remain in full force and effect so long as the Order remains in effect, unless the following provisions impose additional obligations.

11.   Data return and destruction

11.1 If the Order is terminated, GetResponse shall, according to Customer’s written request, delete the Personal Data or return them to the Customer. If GetResponse does not receive any written request referred to in the preceding sentence, whether in writing or by e-mail, within 5 days of the Order termination, the Customer shall be deemed to require that the entrusted Personal Data be deleted, unless GetResponse has the right to further process the Personal Data under Applicable Law.

11.2 From the effective date of this DPA, the Customer may request a copy of the Personal Data processed by GetResponse, but no such request will be entertained if made on a date that is later than 30 days after the termination of the Order.

11.3 At the expiry of the 30-day period in Clause 11.2 above and within 7 days after such expiry, the Personal Data will be encrypted and stored in backup copies only. The said 7-day period is required for GetResponse to delete the Personal Data completely due to specifics of the backup copies operations.

12. Audit

12.1 GetResponse will permit the Customer and its third-party authorized representative to audit its compliance with its DPA obligations on conditions indicated in Clause 12.2 below and other specific conditions, as may be agreed by the Parties.

12.2 GetResponse will give the Customer all necessary assistance to conduct such audits. The audit shall be limited to and conditional on:

(a)The appointment of an authorized independent auditor who is not in conflict with or a competitor of GetResponse;

(b)The Personal Data entrusted to GetResponse for Processing under this DPA;

(c)A reasonable period of time agreed upon between GetResponse and the Customer;

(d)The confidentiality of this DPA and the Personal Data processed.

(e)The Customer paying the costs of and incidental to the audit.

13.     Liability

13.1  The Customer and GetResponse are each liable for their breach of Personal Data in accordance with the scope of Personal Data entrusted to them. With regard to the limitation of liability of GetResponse from contract and tort, the Parties confirm the validity of the relevant provisions (Limitation of Liability) in the Terms of Services of GetResponse.

13.2 GetResponse shall be liable for to the Customer for the acts and omissions of any sub-processor listed at www.getresponse.com/legal/max-dpa-list-of-subprocessors as if they were the acts and omissions of GetResponse.

13.3 GetResponse shall be liable for satisfying claims of  Data Subjects in connection with any damage arising from improper Processing of Personal Data by GetResponse under this DPA, if the Customer demonstrates that the damage resulted from the sole through fault of GetResponse or GetResponse’s sub-processors.

13.4  GetResponse shall be liable for its violation of the provisions of the DPA or any Applicable Law, as a result of which the Customer shall be obliged to pay compensation or any fine only if GetResponse does not fulfill its obligations which the Applicable Law directly imposes on data Processors or if GetResponse processes the Personal Data not compliant with the Customer’s express instructions.

14.    Force Majeure

Neither Party shall be liable for failure to perform or delay in performing any obligation under this DPA if the failure or delay is caused by any circumstances beyond its reasonable control, including but not limited to acts of god, war, terrorism, civil commotion or industrial dispute (not extending to disputes by its own employees or sub-contractors).

15.    General  

15.1 The failure on the part of either Party to this DPA to exercise or enforce any rights conferred by this DPA shall not be deemed to be a waiver of any such right nor operate so as to bar the exercise or enforcement at any time.

15.2 No variation of this DPA shall be binding unless agreed to in advance by the Parties.

15.3 If any provision of this DPA is declared by any competent court or body to be illegal, invalid or unenforceable under the law of any jurisdiction, or if any enactment is passed that renders any provision of this DPA illegal, invalid or unenforceable under the law of any jurisdiction this shall not affect or impair the legality, validity or enforceability of the remaining provisions of this DPA or the Order.

15.4 In case of any disputes that cannot be amicably resolved, either Party may submit this DPA to a court, which shall be the one chosen and provided for in the Agreement, excluding any other, however privileged it may be, especially in relation to any dispute or lawsuit that may arise from the application of the rules of this DPA, including, but not limited to, issues regarding their existence, validity, termination or any consequences of any nullities.

15.5 This DPA shall be governed by the laws provided in the Agreement.

16.    Entire agreement

This DPA (as amended from time to time) together with any document expressly referred to in its terms, contains the entire agreement between the Parties relating to the subject matter covered, unless otherwise stipulated in the Order. No oral explanation or oral information given by any Party shall alter the interpretation of this DPA. Amendments to DPA and its annexes may be introduced according to the procedure for amending Terms of Service, subject to Clause 8.2 – 8.4 above.

17. Rights of Third Parties

Nothing in this DPA shall be construed as conferring any rights (including the right to rely on any exclusion or limitation clause contained within it) or obligations on any person or class of persons whether in existence now or at any time in the future that is not a party to this DPA.

18. Data Protection Officer

GetResponse S. A. has appointed a Data Protection Officer who can be contacted on all matters relating to the Processing of Personal Data and the exercise of rights related thereto. Contact with the Data Protection Officer can be made through: 

– contact form available here

– in writing: the Data Protection Officer, GetResponse S.A., 413 Grunwaldzka Avenue, 80-309 Gdańsk

Annexes:

1. Annex no. 1 – Description of Personal Data Processing;
2. Annex no. 2 – Description of the implemented organizational and technical measures for Personal Data protection;
3. Annex no. 3 – List of GetResponse’s sub-processors.