Data Processing Addendum

Our Data Processing Addendum

LAST UPDATE: April 9, 2024

This Data Processing Addendum (“Addendum”), including its appendices, forms part of the written or electronic agreement between INSIGHT and Client for the purchase of services and access to certain proprietary technologies from INSIGHT (collectively, “Services”) (the “Agreement”) to reflect the parties’ agreement with regard to the Processing of Personal Information.

This Addendum sets forth the terms and conditions relating to each party’s compliance with data privacy laws applicable to the Services provided under the Agreement, which may include (only to the extent applicable), the European General Data Protection Regulation the (“GDPR”) or the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and/or any applicable data privacy law as may be applicable to the Services (collectively, the “Data Protection Laws”).

ARTICLE 1 DEFINITIONS

If a term defined herein is already defined in the Agreement, the definition herein shall replace the definition in the Agreement. Capitalized terms used and not defined in this Addendum shall have the meaning ascribed to such term in the Agreement or applicable Data Protection Laws if not defined herein or in the Agreement.

1.1           “Client Personal Information” means all Personal Information governed and/or regulated by Data Protection Laws, in any form or format, that INSIGHT Processes for or on behalf of Client pursuant to the Agreement and the Services provided thereunder.

1.2          “UK Addendum” means the International Data Transfer Addendum issued by the United Kingdom Information Commissioners Office and laid before Parliament in accordance with s119A(1) of the Data Protection Act 2018 on 2 February 2022.

1.3          “Instructions” means the Agreement, this Addendum and any further written agreement between the parties regarding the Processing of Personal Information.

1.4          “Personal Information” means any information that identifies or locates a natural person (a “Data Subject”) or that, in combination with other data, can be used to identify or locate a natural person, including without limitation IP  addresses, device identifiers, and other information collected by or stored in cookies and other tracking technologies, and, without limiting the foregoing, shall have the meaning as ascribed to it, or to a similar term (including, without limitation, “personal data”) under applicable Data Protection Laws.

1.5          “Personal Information Breach” means a confirmed unauthorized or unlawful disclosure of or access to Client Personal Information within INSIGHT’s possession or control.

1.6          “Process”, “Processing”, or “Processed” means any operation that is performed on Personal Information, whether done by automated means, or as it or a similarly equivalent term is otherwise defined under applicable Data Protection Laws.

1.7          “Standard Contractual Clauses” means the standard contractual clauses set out in the European Commission’s Decision 2021/914/EC of 4 June 2021, or any new or replacement Standard Contractual Clauses adopted by the European Commission for the transfer of Personal Information established in third countries.

1.8          “Services” shall have the same meaning as ascribed to it in the applicable Agreement.

1.9          “Sub-processor” means a subcontractor engaged by INSIGHT in its role of Processor who agrees to receive Client Personal Information exclusively intended for the Processing activities carried out on behalf of Client in accordance with the Agreement, including, without limitation, this Addendum.

1.10        “sale”, “sell”, or “selling” shall have the meaning as ascribed to it or to a similar term under applicable Data Protection Laws.

1.11          “cross-contextual behavioral advertising” and “targeted advertising” shall have the meaning ascribed to them under applicable Data Protection Laws.

1.12         “Business”, “Controller”, “Processor”, “Contractor” and “Service Provider” shall have the meaning as ascribed to it or to a similar term under applicable Data Protection Laws.

ARTICLE 2 PROCESSING PURPOSE AND INSTRUCTIONS; GENERAL OBLIGATIONS

With respect to INSIGHT’s Processing of Client Personal Information pursuant to its provision of the Services to Client under the Agreement and this Addendum:

2.1          The parties hereby agree that Client is the Business or Controller (as applicable), and INSIGHT is the Service Provider or Processor (as applicable) with respect to any Client Personal Information that INSIGHT Processes pursuant to the Agreement and Services. INSIGHT will treat Client Personal Information as confidential and will only Process the Client Personal Information on behalf of and in accordance with the reasonable Instructions of Client and as reasonably necessary to use and provide the Services pursuant to the Agreement (the “Business Purpose(s)”), unless such Processing is required by applicable law.

2.2         INSIGHT will ensure that its personnel engaged in the Processing of Personal Information are informed of the confidential nature of the Client Personal Information and are subject to an obligations or duties of confidentiality as appropriate.

2.3         INSIGHT will not Process Client Personal Information outside of the direct relationship between INSIGHT and Client (which, for clarity, includes any Sub-processors that INSIGHT utilizes in connection with the Services). INSIGHT shall not sell or otherwise use the Client Personal Information for targeted advertising or cross-contextual behavioral advertising, as such concepts are defined under applicable Data Protection Laws. Further, INSIGHT shall not combine the Personal Information received, collected, or Processed pursuant to the Agreement with personal information received from other sources without the prior consent of Company, unless otherwise permitted under applicable Data Protection Laws. Each party is and will comply with all Data Protection Laws applicable to their respective performance under this Addendum and the Agreement. If INSIGHT determines that it can no longer comply with the foregoing, it shall promptly provide notice to Client.

2.4         Client represents and warrants that (i) its Instructions to INSIGHT are compliant with Data Protection Laws; (ii) INSIGHT’s Processing of Client Personal Information in compliance with the Agreement and this Addendum will not violate applicable Data Protection Laws; and (iii) it has obtained all necessary consents and provided all necessary notices to applicable Data Subjects in order for INSIGHT to perform the Services as provided under the Agreement.

2.5         The parties acknowledge and agree as follows: (i) The Client Personal Information that Client discloses to INSIGHT is provided to INSIGHT for a Business Purpose, and Client does not sell Personal Information to INSIGHT in connection with the Agreement; and (ii) During the time the Client Personal Information is disclosed to INSIGHT, neither party has knowledge or reason to believe that either party is unable to comply with the provisions of this Addendum.

ARTICLE 3 INFORMATION SECURITY AND PERSONAL INFORMATION BREACH

3.1          Taking into account the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of Data Subjects, INSIGHT has implemented appropriate technical and organizational measures in accordance with industry standards that are designed to ensure a level of security appropriate to the risk. INSIGHT will maintain a commercially reasonable security program in accordance with industry standards and applicable laws which shall incorporate the security measures found at https://www.insight2profit.com/security-measures/.

3.2         In the event of a Personal Information Breach, INSIGHT will, promptly and without undue delay, notify Client of such Personal Information Breach. INSIGHT will provide Client with reasonably requested information about such Personal Information Breach and, at Client’s expense, will provide Client with reasonably requested assistance in responding to a Personal Information Breach. To the extent in its control and upon the occurrence of a Personal Information Breach, INSIGHT will promptly investigate and take reasonable technical steps designed to prevent the progression of the Personal Information Breach and such steps it deems necessary to respond to the Personal Information Breach in accordance with its data incident response policy and procedures.

ARTICLE 4 DATA SUBJECT RIGHTS; GOVERNMENT REQUESTS

4.1          INSIGHT shall promptly notify Client if it receives a request from a Data Subject under any applicable Data Protection Laws with respect to the Client Personal Information (“Data Subject Request”) and INSIGHT will attempt to redirect the Data Subject Request to Client as applicable. INSIGHT shall cooperate and provide assistance as reasonably requested by Client (and at Client’s expense) to the extent necessary for Client to comply with a Data Subject Request.

4.2         Upon Client’s reasonable prior written request and taking into account the nature of the Processing under this Addendum, INSIGHT will provide reasonable assistance (at Client’s expense) to Client with regard to any Client Personal Information data protection impact assessment and prior consultations with supervising government authorities or other applicable government data privacy authorities.

ARTICLE 5 DURATION OF PROCESSING; DELETION AND RETURN

5.1          Upon termination of the Services and Client’s written request, INSIGHT shall, within a maximum of ninety (90) days and at Client’s option: (i) return to Client all Client Personal Information and all copies thereof by secure file transfer in a standard format (as determined by INSIGHT), or (ii) destroy and/or securely delete all other copies of Client Personal Information. Upon Client’s subsequent written request, INSIGHT shall provide, in each case, written certification to Client that it has complied fully with the foregoing.

5.2         Notwithstanding the foregoing, to the extent applicable law requires INSIGHT to keep and maintain Client Personal Information or the Client Personal Information is a part of INSIGHT’s regular back-up files and systems such Client Personal Information will be kept in accordance with the terms of this Addendum remaining in effect until such Client Personal Information is securely deleted or returned.

ARTICLE 6 SUB-PROCESSORS

6.1          Client provides its general authorization to INSIGHT to disclose or transfer Client Personal Information to Sub-processors. Prior to any disclosure to a Sub-processor, INSIGHT shall enter into a written agreement with the Sub-processor that imposes substantially equivalent obligations on the Sub-processor as are set out in this Addendum. INSIGHT is responsible for its Sub-processors’ compliance with this Addendum.

6.2         INSIGHT will notify Client of an engagement of any new Sub-processors by updating the following webpage: https://www.insight2profit.com/data-processing-addendum/. Client shall monitor the foregoing link of new Sub-processors that are engaged from time to time. INSIGHT will respond in good faith to any reasonable objections by Client, provided Client may only object to such new Sub-processors if there are reasonable grounds to believe that the Sub-processor will be unable to comply with the terms of this Addendum. If Client has a good faith objection to the engagement of a new Sub-processor, it must provide written notice of such objection setting forth the reasonable basis for the objection to INSIGHT within ten (10) days of receiving notice of the new engagement. The parties will work in good faith to resolve the objection.

ARTICLE 7 DATA PROTECTION ASSESSMENTS AND AUDIT

7.1          Upon reasonable request and no more than once per calendar twelve (12) months, INSIGHT will provide Client with the information and records necessary to show INSIGHT’s compliance with this Addendum and applicable Data Protection Laws.

ARTICLE 8 TRANSFERS OF PERSONAL INFORMATION

8.1          To the extent INSIGHT’s Processing of Client Personal Information includes transfers of Personal Information out of the European Economic Area (“EEA”), the parties, with effect from the commencement of the relevant transfer, hereby enter into the Standard Contractual Clauses (mutatis mutandis, as the case may be) in respect of any transfer (or onward transfer), unless an alternative transfer mechanism permitted by applicable Data Protection Law exists, in which case, the parties can mutually agree to such alternative mechanism in writing. If applicable, the Standard Contractual Clauses are entered into as set forth in Appendix 2.

8.2         To the extent INSIGHT’s Processing of Client Personal Information includes transfers of Personal Information out of the United Kingdom (“UK”), the parties, with effect from the commencement of the relevant transfer, hereby enter into the Standard Contractual Clauses (mutatis mutandis, as the case may be) and the UK Addendum in respect of any transfer (or onward transfer), unless an alternative transfer mechanism permitted by applicable Data Protection Law exists, in which case, the parties can mutually agree to such alternative mechanism in writing. If applicable, the Standard Contractual Clauses are entered into as set forth in Appendix 2 and the UK Addendum is entered into as set forth in Appendix 3.

ARTICLE 9 MISCELLANEOUS

9.1          For clarity, and notwithstanding anything to the contrary in the Agreement or this Addendum, this Addendum shall not apply to any Personal Information that has been anonymized or aggregated, in compliance with applicable requirements under applicable Data Protection Laws where such requirements exist, such that it is no longer considered Personal Information as defined under applicable Data Protection Laws.

9.2         The parties agree that this Addendum shall terminate automatically upon the termination of the Agreement. Notwithstanding the foregoing, any obligations imposed on a party set forth in this Addendum in relation to the Processing of Client Personal Information shall survive any termination or expiration of the Agreement and this Addendum.

9.3         INSIGHT’s obligations under this Addendum shall be subject to the limitations on liability set forth in the Agreement (as applicable), including, without limitation, those limitations on the types or amounts of INSIGHT’s liability to Client set forth in the Agreement.

9.4         Notwithstanding anything to the contrary contained here, INSIGHT shall have no obligation to monitor changes in Data Protections Laws or to notify Client of the same. Nothing herein shall impact Client’s obligation to continually comply with Data Protection Laws as described hereunder.

9.5         This Addendum shall be governed by the laws of the country or territory stipulated for this purpose in the Agreement.

 

Appendix 1

Details of Processing

Duration of Processing

INSIGHT will Process Personal Information for the duration of the Agreement and in accordance with the Addendum.

Purpose and Nature of the Processing

INSIGHT will Process Personal Information in furtherance of its provision of Services to Client and in accordance with the Addendum.

Categories of Data Subjects

Types of Personal Information

List of Sub-processors: N/A

 

Appendix 2

Standard Contractual Clauses

1. Standard Contractual Clause Appendix: The Appendix to the Standard Contractual Clauses shall be deemed completed pursuant to the below table.

2. Annex I to the Standard Contractual Clauses: By signing the parties agree to also be bound by the UK Addendum to the EU Commission Standard Contractual Clauses attached hereto. Annex I to the Standard Contractual Clauses shall be deemed completed pursuant to the below table.

Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union]

Data importer(s): [Identity and contact details of the data importer(s), including any contact person with responsibility for data protection]

A. DESCRIPTION OF TRANSFER

B. COMPETENT SUPERVISORY AUTHORITY

3. Annex II to the Standard Contractual Clauses: Annex II to the Standard Contractual Clauses shall be deemed completed pursuant to the below.

Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.

As described in Section 3.1 of the Addendum

For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter

As set forth herein.

4. Annex III to the Standard Contractual Clauses: Annex III to the Standard Contractual Clauses shall be deemed completed pursuant to the below table.

The controller has authorised the use of the following sub-processors: Those Sub-processors identified in Appendix 1.

 

Appendix 3

UK Addendum

This Appendix 3 shall apply to any transfer of Personal Information from a Data Exporter located in the United Kingdom, to a Data Importer located in a third country that is not deemed to offer adequately similar protection as provided under United Kingdom law.

TABLE 1: Parties

TABLE 2: Selected SCCs, Modules, and Selected Clauses

TABLE 3: Appendix Information

“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this UK Addendum is set out in:

See Appendix 2 to the Addendum.

TABLE 4: Ending this UK Addendum when the Approved Addendum Changes

Neither party shall have the right to terminate this Appendix 3 in the event this Approved UK Addendum changes.

MANDATORY CLAUSES

Entering into this UK Addendum

  1. Each Party agrees to be bound by the terms and conditions set out in this UK Addendum, in exchange for the other Party also agreeing to be bound by this UK Addendum.
  2. Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this UK Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this UK Addendum. Entering into this UK Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.

Interpretation of this UK Addendum

  1. Where this UK Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:

  1. This UK Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties’ obligation to provide the Appropriate Safeguards.
  2. If the provisions included in the UK Addendum EU SCCs amend the Approved SCCs in any way which is not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not be incorporated in this UK Addendum and the equivalent provision of the Approved EU SCCs will take their place.
  3. If there is any inconsistency or conflict between UK Data Protection Laws and this UK Addendum, UK Data Protection Laws applies.
  4. If the meaning of this UK Addendum is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies.
  5. Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, reenacted and/or replaced after this UK Addendum has been entered into.

Hierarchy

  1. Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the parties, the parties agree that, for Restricted Transfers, the hierarchy in Section 10 will prevail.
  2. Where there is any inconsistency or conflict between the Approved Addendum and the UK Addendum EU SCCs (as applicable), the Approved Addendum overrides the UK Addendum EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the UK Addendum EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved Addendum.
  3. Where this UK Addendum incorporates UK Addendum EU SCCs which have been entered into to protect transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties acknowledge that nothing in this UK Addendum impacts those UK Addendum EU SCCs

Incorporation of and Changes to the EU SCCs

  1. This UK Addendum incorporates the UK Addendum EU SCCs which are amended to the extent necessary so that: a. together they operate for data transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s processing when making that data transfer, and they provide Appropriate Safeguards for those data transfers; b. Sections 9 to 11 override Clause 5 (Hierarchy) of the UK Addendum EU SCCs; and c. this UK Addendum (including the UK Addendum EU SCCs incorporated into it) is (1) governed by the laws of England and Wales and (2) any dispute arising from it is resolved by the courts of England and Wales, in each case unless the laws and/or courts of Scotland or Northern Ireland have been expressly selected by the Parties.
  2. Unless the Parties have agreed alternative amendments which meet the requirements of Section 12, the provisions of Section 15 will apply.
  3. No amendments to the Approved EU SCCs other than to meet the requirements of Section 12 may be made.
  4. The following amendments to the UK Addendum EU SCCs (for the purpose of Section 12) are made:

a. References to the “Clauses” means this UK Addendum, incorporating the UK Addendum EU SCCs;

b. In Clause 2, delete the words: “and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679”;

c. Clause 6 (Description of the transfer(s)) is replaced with: “The details of the transfers(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply to the data exporter’s processing when making that transfer.”;

d. Clause 8.7(i) of Module 1 is replaced with: “it is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer”;

e. Clause 8.8(i) of Modules 2 and 3 is replaced with: “the onward transfer is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer;”

f. References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)” and “that Regulation” are all replaced by “UK Data Protection Laws”. References to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK Data Protection Laws;

g. References to Regulation (EU) 2018/1725 are removed;

h. References to the “European Union”, “Union”, “EU”, “EU Member State”, “Member State” and “EU or Member State” are all replaced with the “UK”;

i. The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one, is replaced with “Clause 11(c)(i)”;

j. Clause 13(a) and Part C of Annex I are not used;

k. The “competent supervisory authority” and “supervisory authority” are both replaced with the “Information Commissioner”;

l. In Clause 16(e), subsection (i) is replaced with: “the Secretary of State makes regulations pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data to which these clauses apply;”;

m. Clause 17 is replaced with: “These Clauses are governed by the laws of England and Wales.”;

n. Clause 18 is replaced with: “Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”; and

o. The footnotes to the Approved EU SCCs do not form part of the UK Addendum, except for footnotes 8, 9, 10 and 11.

Amendments to this UK Addendum

  1. The Parties may agree to change Clauses 17 and/or 18 of the UK Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.
  2. If the Parties wish to change the format of the information included in Part 1: Tables of the Approved UK Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.
  3. From time to time, the ICO may issue a revised Approved Addendum which: a. makes reasonable and proportionate changes to the Approved Addendum, including correcting errors in the Approved Addendum; and/or b. reflects changes to UK Data Protection Laws; The revised Approved Addendum will specify the start date from which the changes to the Approved Addendum are effective and whether the Parties need to review this UK Addendum including the Appendix Information. This UK Addendum is automatically amended as set out in the revised Approved Addendum from the start date specified.
  4. If the ICO issues a revised Approved Addendum under Section 18, if any Party selected in Table 4 “Ending the UK Addendum when the Approved Addendum changes”, will as a direct result of the changes in the Approved Addendum have a substantial, disproportionate and demonstrable increase in: a its direct costs of performing its obligations under the UK Addendum; and/or b its risk under the UK Addendum, and in either case it has first taken reasonable steps to reduce those costs or risks so that it is not substantial and disproportionate, then that Party may end this UK Addendum at the end of a reasonable notice period, by providing written notice for that period to the other Party before the start date of the revised Approved Addendum.
  5. The Parties do not need the consent of any third party to make changes to this UK Addendum, but any changes must be made in accordance with its terms.