DPA - Version 3 (up to April 25, 2022)

Data Processing Addendum (Version 3)

This Data Processing Addendum (“DPA”) is a part of the contracting document or documents and include one or more of the following or similarly structured documents (i.e. Master Service Agreement; Subscription Agreement, License Agreement or similar agreement) (the “Agreement”) between the entity signing the Order Form or other ordering document into which the Agreement is incorporated (“Customer”) and NAVEX Global UK Limited (hereinafter “NAVEX Global”) to reflect the parties’ agreement related to Processing of Customer Data, including Personal Data, in accordance with the requirements of applicable Data Protection Requirements.

HOW THIS DPA APPLIES

This DPA is an addendum to and forms part of the Agreement. For avoidance of doubt, this DPA shall apply to any entity that executes an ordering document that is governed by the Agreement.

This DPA shall not replace any additional rights related to Processing of Customer Data previously negotiated by Customer in the Agreement, but shall replace any existing data processing addendum to the Agreement unless otherwise explicitly stated herein.

To the extent any terms and conditions of this DPA conflict with the terms and conditions of the Agreement or any previously executed data processing terms, the terms and conditions of this DPA shall control.

For the avoidance of doubt, execution of the Order Form or other document into which this DPA is incorporated shall be deemed to constitute signature and acceptance of the DPA.

DATA PROCESSING TERMS

In the course of providing the Services to Customer pursuant to the Agreement, NAVEX Global may Process Personal Data on behalf of Customer. NAVEX Global agrees to comply with the following provisions with respect to any Personal Data submitted by or for Customer to the Services or collected and Processed by or for Customer using the Services.

1. DEFINITIONS

“Affiliate” means an entity controlling, controlled by, or under common control with a party to the Agreement.
“CCPA” or “California Consumer Privacy Act of 2018” means Assembly Bill 375 of the California House of Representatives, an act to add Title 1.81.5 (commencing with Section 1798.100) to Part 4 of Division 3 of the Civil Code, relating to privacy and approved by the California Governor on June 28, 2018, as amended from time to time.
“Customer Data” means any data and information Customer provides, generates, transfers, or makes available to NAVEX Global under the Agreement, whether in printed, electronic, or other format.
“Data Controller” means the entity which determines the purposes and means of the Processing of Personal Data.
“Data Processor” means the entity which Processes Personal Data on behalf of the Data Controller.
“Data Protection Requirements” means all data protection and privacy laws and regulations, as applicable to a party, including: (i) the GDPR (as defined below); (ii) the GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the “UK GDPR”); (iii) the California Consumer Privacy Act of 2018 (CCPA); and (iv) any other local or regional data protection, data privacy or data security laws.
“Data Subject” means an identified or identifiable natural person whose Personal Data is collected and hosted by NAVEX Global on behalf of Customer, as may be more fully set forth in Data Protection Requirements, and shall be meant to include any different but similar term used in Data Protection Requirements.
“EEA” or “European Economic Area” means the member states of the European Union as well as Iceland, Liechtenstein and Norway.
“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
“Personal Data” means any information relating to an identified or identifiable natural person as further defined under Data Protection Requirements, which may include a term similar to Personal Data but which shall have the same general meaning (for example “personal information”), where such data is submitted to the Services as Customer Data as further specified in Appendix 1.
“Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, and shall be meant to include any different but similar term used in the Data Protection Requirements and as may be more fully set out in Appendix 1.
“Security Specifications” means the security measures employed by NAVEX Global to protect the Personal Data in its possession in connection with delivering the Services and as more fully set out in in Appendix 2.
“Standard Contractual Clauses” means, as applicable, the European Commission’s Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council C/2021/3972 or European Commission’s decision C(2010)593) of 5 February 2010 on Standard Contractual Clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection.
“Sub-processor” means any Data Processor engaged by NAVEX Global, which includes applicable NAVEX
Global Affiliates.

2. PROCESSING OF PERSONAL DATA

Roles of the Parties. The parties acknowledge and agree that with regard to the Processing of Personal Data, Customer is the Data Controller, NAVEX Global is a Data Processor and that NAVEX Global will engage Sub-processors pursuant to the requirements set forth in section 8 “Sub-processing” below. Further, each party agrees to comply with its respective obligations under the Data Protection Requirements in relation to its Processing of the Personal Data and NAVEX Global agrees to provide all assistance reasonably required by Customer to enable Customer to take reasonable and appropriate steps to ensure that NAVEX Global effectively Processes Personal Data in a manner consistent with Customer’s obligations under Data Protection Requirements. Customer may authorize its Affiliate’s use of the Services provided that (i) the Customer guarantees any such Affiliate’s performance of all terms and obligations of this DPA; (iii) Customer agrees to comply with any injunction arising out of any Affiliate’s breach of this DPA; (iv) Customer, as the signatory and party to the Agreement, shall be the ultimate Data Controller in the event of any conflicting instructions provided by an Affiliate to NAVEX Global; (v) all use of the Services by Affiliates are subject to any use limitations or restrictions set forth in the Agreement, as typically defined in the applicable Order Form or the financial metric used to calculate the applicable fees (such as the number of “licenses,” “employees,” “reports,” and the like); and (vi) Customer shall be responsible for all use of and access to the Services by any Affiliate.
Customer’s Processing of Personal Data. Customer shall, in its use of the Services, Process Personal Data in accordance with the requirements of Data Protection Requirements. For the avoidance of doubt, Customer’s instructions to NAVEX Global, for the Processing of Personal Data, shall comply with Data Protection Requirements. NAVEX Global shall inform Customer without undue delay if, in its opinion, an instruction infringes Data Protection Requirements. The foregoing notwithstanding, NAVEX Global is not obligated to evaluate whether an instruction issued by Customer complies with applicable Data Protection Requirements.
NAVEX Global’s Processing of Personal Data. NAVEX Global shall only Process Personal Data on behalf of and in accordance with Customer’s instructions and shall treat Personal Data as Confidential Information. Customer instructs NAVEX Global to Process Personal Data for the following purposes: (i) Processing in accordance with the Agreement and applicable Order Form(s); (ii) Processing initiated by users in their use of the Services; and (iii) Processing to comply with other reasonable instructions by Customer that are consistent with the terms of the Agreement. Further, NAVEX Global agrees that it shall, in its capacity as Data Processor:
1. Only carry out Processing of Personal Data on Customer’s instructions, as set forth in the Agreement for the purpose of providing the Services;
2. Provide at least the same level of protection to Personal Data as is required by this DPA and the Data Protection Requirements;
3. ensure that persons authorized to Process the Personal Data are bound to obligations of confidentiality or are under an appropriate statutory obligation of confidentiality;
4. With the exception of those pre-approved Sub-processors detailed in section 8)b) and engaged in the performance of the Services, not share or allow access to files containing Personal Data to any third party for further Processing by that third party or its agents (except for the purposes of mere routing of Personal Data through a third party such as routing through a telecommunications carrier);
5. Promptly notify Customer if it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by Data Protection Requirements, and in such event, to work with Customer to promptly take reasonable and appropriate steps to stop and remediate any Processing until such time as the Processing meets the level of protection as is required by the Data Protection Requirements;
6. Implement and maintain throughout the term of this DPA appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing and accidental destruction or loss so as to allow Customer to comply with the requirement to implement appropriate technical and organizational security measures, in accordance with the Security Specifications and other applicable provisions of the Data Protection Requirements;
7. At Customer’s sole election, cease Processing Personal Data promptly if in Customer’s reasonable discretion, NAVEX Global is not providing the same level of protection to Personal Data as is required by Data Protection Requirements.
8. Keep or cause to be kept, accurate records relating to all Processing of Personal Data on behalf of Customer as part of the Services;
9. Promptly refer to Customer any requests, notices or other communication from Data Subjects, any national data protection authority established in the jurisdiction of Customer, or any other law enforcement authority, for such Customer to resolve, and as the case may be:
  1. Provide all assistance reasonably required by Customer to enable Customer to respond to, comply with or otherwise resolve any request, question or complaint made to it by a Data Subject in relation to the Processing of Personal Data associated with such Data Subject; and
  2. Provide all assistance reasonably required by Customer to enable Customer to respond to, comply with or otherwise resolve any request, question or complaint made to it that is received from any national data protection authority established in the jurisdiction of the Customer, or any other law enforcement authority.
10. Provide reasonable assistance and support to Customer in Customer’s performance of any data protection impact assessments;
11. Provide assistance to Customer in ensuring compliance, if applicable, with the obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of the Processing and the information available to NAVEX Global;
12. NAVEX Global agrees it will not, in its capacity as Data Processor:
  1. Disclose Personal Data to any third party individual other than for the purposes of complying with Data Subject access requests in accordance with Data Protection Requirements and in accordance with this DPA, as applicable.
  2. Include Personal Data in any product or service offered by NAVEX Global to third parties.
California Consumer Privacy Act of 2018. The terms “Consumer,” “Personal Information,” “Sell,” “Service Provider,” and “Third Party” shall have the meanings ascribed to them under the CCPA.
1. NAVEX Global is a Service Provider and not a Third Party.
2. NAVEX Global agrees to act solely as a Service Provider in relation to Personal Information of California residents and Customer alone determines the purposes and means of the processing of Personal Information.
3. NAVEX Global will not Sell Personal Information of California Consumers, and the parties acknowledge and agree that Customer does not Sell Personal Data to NAVEX Global in connection with the Services.
4. For the purposes of CCPA compliance, NAVEX Global certifies that NAVEX Global understands and will comply with the requirements and restrictions set forth in this DPA and with respect to any Personal Information subject to CCPA will not retain, use or disclose the Personal Information:
  1. for any purpose other than for the specific purpose of performing the services specified in the Agreement; or
  2. outside of the direct business relationship between Customer and NAVEX Global.

3. RIGHTS OF DATA SUBJECTS

Correction, Blocking and Deletion. To the extent Customer, in its use of the Services, does not have the ability to correct, amend, block or delete Personal Data, as required by Data Protection Requirements, NAVEX Global shall comply with any commercially reasonable request by Customer to facilitate such actions to the extent NAVEX Global is legally permitted to do so.
Data Subject Requests. NAVEX Global shall, to the extent legally permitted, without undue delay notify Customer if it receives a request from a Data Subject for access to, correction, amendment or deletion of that individual’s Personal Data, or any other rights afforded to a Data Subject pursuant to Data Protection Requirements. NAVEX Global shall not respond to any such Data Subject request without Customer’s prior written consent, or as required by Data Protection Requirements, except to confirm that the request has been received and relates to Customer. NAVEX Global shall provide Customer with commercially reasonable cooperation and assistance in relation to a Data Subject’s request for access to that individual’s Personal Data, to the extent legally permitted and to the extent Customer does not have access to such Personal Data through its use of the Services.

4. NAVEX GLOBAL PERSONNEL

Confidentiality. NAVEX Global shall ensure that its personnel engaged in Processing Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities and have executed written confidentiality agreements. NAVEX Global shall ensure that such confidentiality obligations survive the termination of the personnel engagement.
Reliability. NAVEX Global shall take commercially reasonable steps to ensure the reliability of any NAVEX Global personnel engaged in the Processing of Personal Data.
Limitation of Access. NAVEX Global shall ensure that NAVEX Global’s access to Personal Data is limited to those personnel who require such access to perform under the Agreement.
Data Protection Officer. NAVEX Global has appointed a data protection officer where such appointment is required by Data Protection Requirements. The appointed person may be reached at privacy@navexglobal.com.

5. TECHNICAL AND ORGANIZATIONAL MEASURES AND SECURITY

NAVEX Global shall maintain administrative, physical and technical safeguards for protection of the security, confidentiality and integrity of Customer Data, including Personal Data, as set forth in the Security Specifications. NAVEX Global regularly monitors compliance with these safeguards and will not materially decrease the overall security of the Services during the term of the Agreement.
NAVEX Global has obtained third-party certifications and audits as set forth in the Security Specifications. Upon Customer’s written request, at reasonable intervals, NAVEX Global shall provide a copy of NAVEX Global’s then most recent third-party audit or certification, as applicable, or any summaries thereof, that NAVEX Global generally makes available to its Customers at the time of such request.
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, NAVEX Global shall, and shall procure that each Sub-Processor shall implement and maintain, appropriate technical and organizational measures in relation to the Processing of Personal Data by NAVEX Global or Sub-Processor to ensure a level of security appropriate to that risk including, as appropriate, the measures referred to in Article 32(1) of the GDPR.
In assessing the appropriate level of security, NAVEX Global shall take into account all risks that are presented by Processing the relevant Personal Data, in particular from a Security Incident (as defined below).

6. SECURITY INCIDENT MANAGEMENT AND NOTIFICATION

Security Incident Notification. NAVEX Global maintains security incident management policies and procedures as indicated in the Security Specifications and shall, to the extent permitted by law, without undue delay notify Customer of any actual or reasonably suspected accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to Customer Data, including Personal Data, by NAVEX Global or its Sub-processors of which NAVEX Global becomes aware (a “Security Incident”). To the extent available, such notification shall describe the nature of the Security Incident, including the categories and approximate number of Data Subjects concerned and the categories and approximate number of Personal Data records concerned.
Security Incident Response. To the extent such Security Incident is caused by a violation of the requirements of this DPA by NAVEX Global, NAVEX Global shall: (i) reasonably cooperate with Customer to investigate and resolve the Security Incident; (ii) make reasonable efforts to identify and remediate the cause of such Security Incident; and (iii) keep Customer up-to-date about developments in connection with the Security Incident.

7. RETURN AND DELETION OF CUSTOMER DATA

NAVEX Global shall return Customer Data to Customer and delete Customer Data in accordance with the procedures and timeframes specified in the Agreement. In the event the foregoing is not specified in the Agreement, and unless otherwise agreed by the parties, all Customer Data shall be deleted within forty-five (45) days of expiration or termination of the Agreement or Order Form (as applicable). Customer Data stored in back-ups shall be overwritten in accordance with NAVEX Global’s backup and retention cycle.

8. SUB-PROCESSING

Customer authorizes NAVEX Global to appoint (and permit each Sub-processor appointed in accordance with this section to appoint) Sub-processors in accordance with this section.
NAVEX Global may continue to use those Sub-processors already engaged by NAVEX Global as at the date of this DPA. Customer provides its general authorization and consent to the use of the agreed upon list of Sub-processors set forth in the following link (as applicable): https://www.navexglobal.com/en-us/service-hosting-providers. The foregoing link contains a mechanism to subscribe to notifications of the addition of any new Sub-processors for each applicable Service, to which Customer may subscribe. Such updates provided via this mechanism shall operate as the notification of changes concerning the addition of any new Sub-processors, as required by Data Protection Requirements.
NAVEX Global will notify Customer in advance of any changes to the list of Sub-processors in place (except for deletions of Sub-processors without replacement) at least thirty (30) days in advance of any Processing by the proposed Sub-processor in accordance with the procedure set forth in section 8)(b) above. If Customer has a reasonable objection that relates to the Sub-processors’ Processing of Personal Data, Customer may object to NAVEX Global’s use of a Sub-processor by notifying NAVEX Global in writing at privacy@navexglobal.com within thirty (30) days after receipt of NAVEX Global’s notice. In such event, the Parties will work in good faith to discuss a resolution. NAVEX Global may choose to: (i) not use the Sub-processor to Process Personal Data for Customer or (ii) take the corrective steps requested by Customer in its objection and use the Sub-processor. If neither of these options are reasonably possible and Customer continues to object, Customer may provide notice of termination of the affected portion of the Service as to Customer.
NAVEX Global shall provide for, in substance, the same data protection obligations as set forth in this DPA, on each Sub-processor by way of a contract, providing for third party beneficiary rights for Data Subjects and sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of Data Protection Requirements.
Liability. NAVEX Global shall be liable for the acts and omissions of its Sub-processors to the same extent NAVEX Global would be liable if performing the services of each Sub-processor directly under the terms of this DPA.

9. AUDIT

Audit Scope and Frequency. NAVEX Global allows for and contributes to audits of the processing activities and security systems directly related to the Services provided under the Agreement, on an annual basis or if there are reasonable indications of non-compliance with Data Protection Requirements.
Audit Package. To facilitate any risk-based assessments required by Customer of NAVEX Global’s information security program, upon Customer’s request, NAVEX Global will provide the following: NAVEX Global’s completed Standardized Information Gathering Questionnaire, or future equivalent (“SIG”), NAVEX Global’s annual independent SSAE 18 SOC 2 Type II report or future equivalent, NAVEX Global’s annual third-party PEN tests, and any specific policies requested by Customer that NAVEX Global generally makes available to its customers (NAVEX Global’s “Audit Package”).
Desk Audit. In deciding on a review or audit, NAVEX Global requests Customer to in good faith take into account NAVEX Global’s Audit Package in lieu of Customer’s security or other questionnaire. If Customer requests that NAVEX Global complete Customer’s security or other questionnaire(s) in lieu of, or in addition to, the Audit Package, the timelines and parameters shall be agreed upon in good faith and NAVEX Global reserves the right to reasonable compensation based on the size and scope of such desk audit.
On-Site Audit. In deciding on a review or audit, NAVEX Global requests Customer to in good faith take into account NAVEX Global’s Audit Package in lieu of an onsite audit. If Customer does require an onsite audit, it shall take place during NAVEX Global’s regular business hours. Such onsite audit shall be conducted on a mutually agreed upon date, which shall not be sooner than thirty (30) calendar days after NAVEX Global’s receipt of Customer’s written request for such audit. Any onsite portion shall not exceed a cumulative four (4) hours at NAVEX Global’s facilities. If the audit shall exceed such four (4) hour period, Customer shall be responsible for payment of professional services fees to NAVEX Global at the current hourly rate for professional services. If the audit is to be performed by a third party on Customer’s behalf, such third party shall execute a confidentiality and non-disclosure agreement as presented by and for the benefit of the Parties. Upon completion of the audit, Customer shall promptly provide NAVEX Global a summary of the findings from each report prepared in connection with any such audit and discuss results, including any remediation plans. If audit results find NAVEX Global is not in substantial compliance with the requirements of this Data Security Addendum, then Customer shall be entitled, at NAVEX Global’s expense, to perform up to one (1) additional such audit in that year in accordance with the procedure set forth in this section. NAVEX Global agrees to work with Customer to identify reasonable remediation actions and to promptly take action at NAVEX Global’s expense to correct those matters or items upon which NAVEX Global and Customer mutually agreed are identified in any such audit that require correction. The right to audit granted herein shall not be duplicative of any additional audit right provided in the Agreement.

10. INTERNATIONAL TRANSFERS

NAVEX Global personnel, as the Data Processor, are located in the United Kingdom (“UK”) which has been granted adequacy by the European Union (“EU”). All Customer Data is ultimately stored and hosted within the EU. As a result of the foregoing, any controller to processor Standard Contractual Clauses are not required.
NAVEX Global utilizes Sub-processors, including its Affiliates, which may result in temporary Processing activities outside of the UK and the EEA. NAVEX Global has entered into appropriate safeguards, such as the standard contractual clauses, to Process such transfers.

11. DISCLOSURE REQUESTS

The parties agree that in the event that NAVEX Global receives a legally binding request for disclosure of Customer Data by any law enforcement, national security or any other authority pursuant to Section 702 of the US Foreign Intelligence Surveillance Act (50 USC § 1881a) (“Section 702”), Executive Order 12333 of Dec. 4, 1981 (46 FR 59941, 3 CFR, 1981 Comp., p. 200) (“EO 12333”), or the Clarifying Lawful Overseas Use of Data Act (“CLOUD Act”) (collectively a “Public Authority Request”), the parties will mutually agree on appropriate actions to assist the data subject(s) concerned by the order in exercising his/her rights in the concerned jurisdiction, e.g. through ad hoc redress mechanisms and/or legal counselling, if and to the extent permissible under applicable laws.
As of the date of NAVEX Global’s signature below, NAVEX Global attests, to the best of its knowledge and having used best efforts to obtain same, that it has not been subject to any Public Authority Request.
In the event NAVEX Global receives a Public Authority Request for access to Customer Data, it will promptly notify Customer of such request to enable Customer to intervene and seek relief from such disclosure, unless NAVEX Global is otherwise explicitly prohibited from providing such notice by applicable law, such as a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation. NAVEX Global agrees that it will, during the term of the Agreement, cooperate with Customer’s efforts to oppose any Public Authority Request. It will, to the extent permitted by applicable law, await resolution of any challenges Customer initiates prior to producing any Customer Data to a Public Authority.
If NAVEX Global is prohibited from notification and/or suspension of a Public Authority request:
1. Where there exist legal avenues to challenge a Public Authority request, it will use its reasonable best efforts to obtain the right to waive this prohibition in order to communicate as much information as it can and as soon as possible, and be able to reasonably demonstrate that it did so.
2. Review the legality of the request and where NAVEX Global concludes there are grounds to challenge the Public Authority Request, it will use its reasonable best efforts to oppose any such request for access and contest its legal validity to the extent legally permitted under applicable law, including seeking interim measures and informing the requesting public authority of the incompatibility of the Public Authority Request and the resulting conflict of its obligations.
3. NAVEX Global will document and demonstrate to Customer the actions it has taken, exercising its best efforts to fulfill this commitment.

In any event, NAVEX Global will not make any disclosures of Customer Data to any Public Authority that are determined to be massive, disproportionate and indiscriminate in a manner that it would go beyond what is necessary under the law.

NAVEX Global also agrees that it will not voluntarily assist a Public Authority where applicable, specifically the US government in conducting any operations under EO 12333. NAVEX Global shall, where possible, take such measures as it, in its sole discretion, deems reasonable to prevent data from being intercepted in transmission.
NAVEX Global warrants that to the extent applicable to the type of services provided by NAVEX Global (i) it has not and will not purposefully create back doors, alternative means or similar programming that could be used by Public Authorities to access the system and/or Customer Data, (ii) it has not and will not purposefully create or change its business processes in a manner that facilitates access by Public Authorities to Customer Data or systems, and (iii) it is not aware of a requirement under national law or government policy requiring NAVEX Global to create or maintain back doors or to facilitate access to Customer Data or systems by Public Authorities or to hand over to Public Authorities the encryption key in this context. In the event NAVEX Global is notified that a Public Authority has had access to any Customer Data that NAVEX Global processes on behalf of the Customer, NAVEX Global undertakes to notify the Customer without delay.
In furtherance of NAVEX Global’s obligation to allow for and contribute to audits by Customer of its processing activities pursuant to the DPA, Customer shall be permitted to verify if data was disclosed to public authorities and under which conditions.
The parties are aware of the recent decisions by the European Union Court of Justice, which have raised a number of questions in relation to transfer of Personal Data outside of EEA, specifically to the US. The parties are committed to and will cooperate to ensure its and its sub-processors’ have safeguards are in place to protect the confidentiality, integrity, and availability of Personal Data.

12. LEGAL EFFECT

This DPA shall only become legally binding between Customer and NAVEX Global when the Order Form or other document into which it is incorporated is executed in full.
NAVEX Global’s obligations as set forth in this DPA shall survive until NAVEX Global no longer Processes Personal Data.

Appendix 1 to the DPA

A. LIST OF PARTIES

Data Controller:

Data Controller is the legal entity that has executed this DPA and all Affiliates (as defined in the agreement between Customer and NAVEX Global) authorized to use the Services.

Data Processor:

NAVEX Global UK Limited or GCS Compliance Services Europe Unlimited Company trading as NAVEX Global, as applicable

Address: Vantage West – 4th floor, Great West Road, Brentford, TW8 9AG, United Kingdom

Contact person’s name, position and contact details: Jessica Wilburn, DPO & Sr. Counsel, privacy@navexglobal.com

NAVEX Global is a provider of governance, risk and compliance computing solutions, including but not limited to, whistleblower hotlines, case management systems, employee training systems, policy management systems, third party risk assessment systems, surveys and assessments and related consulting services, which processes personal data upon the instruction of its customers/data controllers and on their behalf in accordance with the terms of said services agreement. The list of services relevant to the Processing are detailed here (as applicable): https://www.navexglobal.com/en-us/service-hosting-providers.

B. DESCRIPTION OF PROCESSING

Categories of data subjects whose personal data is Processed

Customer has instructed NAVEX Global to process certain information as may be submitted to the applicable risk and compliance software service. The information submitted may include personal data provided by the individual data subject or the organization in accordance with the relevant services selected by such organization. The extent of the personal data collected is ultimately determined and controlled by Customer in its sole discretion, and may include, but is not limited to personal data relating to the following categories of data subjects:

Employees of Customer
Clients/customers, business partners and vendors of Customer (who are natural persons)
Employees or contact persons of Customers’ third-party suppliers, business partners and vendors
Customer’s users authorized by Customer to use the relevant Service(s)

Categories of personal data Processed

As instructed by Customer, including but not limited to: name, job title, job position, location, employer, relationship with the organization, e-mail address, telephone number, log-in credentials, date of birth;
For whistle-blower hotline and case management reports, in addition to the foregoing, the following may also be captured:
- facts reported by a reporter about a suspected violation, including how and where the suspected violation occurred and how the reporter learned about the suspected violation;
- identity, function and contact details of individuals allegedly involved in the suspected violation; and
- identity, function and contact details of individuals who could provide information relating to the suspected violation.

Sensitive data Processed (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

The only service offerings that may involve Processing of “Sensitive Data” (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation, or data relating to criminal convictions and offences) are the whistle-blower hotline and incident management services and RiskRate services. For the RiskRate services, sensitive data is not transferred from Customer to NAVEX Global, however, Sensitive Data may be provided back as part of the due diligence screening, resulting in the potential for sensitive data categories to ultimately be processed within that set of services. Therefore, if applicable, Customer, whistle-blower hotine and case management reporters or authorized users of these services may submit sensitive categories of data to the services, the extent of which is determined and controlled by Customer as part of these services.

The following applied restrictions and safeguards include:

Encryption at rest within the database using certificate based AES-256 Transparent Database Encryption (TDE)
- The above encrypts the data files, index files, and transaction files
- This prevents unauthorized restores, as the certificate is required for database restoration
Encryption in flight on public untrusted networks using TLS 1.2 or higher
Heightened access control in accordance with the principle of least privilege
- At least quarterly user audits
- Production environnment is physically and logically isolated from Data importer’s coporate network
Security Information and Event Management (SEIM) tools are utilized
- Log aggregation and alerting is managed by the SIEM
- Events are captured within the SIEM
As is the case with all NAVEX Global services, all processing strictly limited to the purposes of providing the services agreed with Customer and pursuant to their documented instructions
Onward transfers are strictly limited to approved sub-processing activites
Appropriate training is provided to all personnel with access

In addition to the foregoing, the measures set forth in Appendix 2 to this DPA also apply to these sets of services.

The frequency of the Processing

The data is Processed on a continuous basis during the term of the agreement(s) in order for Customer to receive, and for NAVEX Global to provide, the services.

Nature of the Processing

The nature of the processing is to collect, host, process, maintain, deliver services, secure, and support the selected services agreed on between Customer and NAVEX Global.

Purpose(s) of the Processing

To support Customer’s services provided by NAVEX Global. The purpose of the Processing is to provide the best services with regard to the collecting, hosting, processing, maintenance, service delivery, security, and support to the selected services agreed on between Customer and NAVEX Global.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

Throughout the term of the Agreement(s) between Customer and NAVEX Global, Customer determines the period for which the personal data will be retained within the applicable services. Any criteria used during the term to set a retention period during the term is determined by Customer.

At the end of the applicable relationship, where NAVEX Global is no longer providing the services, the data is deleted and/or returned and then deleted in accordance with the provisions and timeframes set forth in the Agreement(s) (for example, data is typically deleted forty-five (45) days post termination). If deletion at the end of the term is not specified, and unless otherwise agreed, all the data shall be deleted within forty-five (45) days of expiration or termination. The data stored in back-ups shall be overwritten in accordance with NAVEX Global’s backup and retention cycle (typically thirty (30) calendar days).

Appendix 2 to the DPA

Security Specifications

NAVEX Global will maintain administrative, physical, organizational, and technical measures for protection of the security, confidentiality and integrity of personal data uploaded or submitted to the applicable services, as described in detail below, as updated from time to time, and made reasonably available by NAVEX Global upon request.

In addition to the below, NAVEX Global maintains an annual Standardized Information Gathering Questionnaire (“SIG”) or future equivalent and a Data Security Addendum, which is available to its customers upon request.

Specific Technical and Organisational Measures – All Product Offerings

	Measures of encryption of personal data	Customer Data is encrypted at rest using either full-disk encryption or within the database using TDE. Data at rest will be encrypted using AES 256 or better. Data importer encrypts Personal data in flight on public untrusted networks using TLS 1.2 or higher.
	Measures for ensuring ongoing confidentiality, integrity, availability and resilience of processing systems and services	Data importer will implement and maintain a written information security program that maintains administrative, physical, and technical safeguards, designed to: • ensure the security and confidentiality of all Customer Data that is processed, stored, or controlled by NAVEX Global; • protect against anticipated threats or hazards to the security or integrity of Customer Data; • prevent unauthorized access to or loss, acquisition, disclosure, or use of Customer Data; and • ensure the secure disposal of Customer Data in compliance with applicable industry standards. NAVEX Global will use reasonable efforts to ensure its written information security program and implemented safeguards align with accepted industry practices and comply with applicable data protection and privacy laws. NAVEX Global will designate a security manager to oversee its information security program and ensure that these requirements are reviewed, implemented and adhered to by NAVEX Global’s personnel.
	Measures for ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident	NAVEX Global will maintain a Business Continuity and Disaster Recovery Plan (“BCP”) for the Services in line with industry best practices for data, services, and communications backup and recoverability, and will implement the BCP in the event of a disaster. The BCP will include disaster avoidance procedures which are designed to safeguard Customer Data and NAVEX Global’s data processing capabilities. The BCP shall support the pre-defined recovery time objective (RTO) / recovery point objective (RPO) as defined by NAVEX Global. NAVEX Global systems shall ensure portability and successful recovery of applications and backup or restoration services. NAVEX Global’s primary and disaster recovery data centers will be located in geographically diverse locations to enhance security, availability, and resiliency. NAVEX Global will test the BCP on at least an annual basis. An executive summary of the BCP is available to Customer upon its request.
	Processes for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of the processing	VULNERABILITY MANAGEMENT NAVEX Global will deploy vulnerability scanning mechanisms in its information systems and on hosted applications. NAVEX Global will configure such mechanisms to conduct web application scans (monthly), internal network scans (weekly) and external network scans (daily). NAVEX Global shall maintain a standard patch management process to ensure the protection of any devices or systems used to access, process or store Customer Data. ANNUAL SECURITY REVIEWS On an annual basis, NAVEX Global will engage a recognized, independent third party to conduct a Statement on Standards for Attestation Engagements No. 16, Service Organization Control 2, Type 2 (“SSAE 18 SOC 2 Type 2”) audit (or its equivalent or successor) of its information security program and its administrative, technical, and physical safeguards for all facilities used to deliver the Services. At least annually, NAVEX Global will have an application and infrastructure PEN test performed by a reputable third-party, on all web applications and infrastructure. NAVEX Global will assess criticality and remediate, or implement compensating controls for, any issues identified by NAVEX Global as requiring remediation in a timely manner based on level of criticality and risk. NAVEX Global will provide an executive summary of the results of such assessments upon Customer’s request. APPLICATION SECURITY NAVEX Global will proactively ensure the security of its applications in accordance with industry accepted standards, will security-harden all network devices and servers that will host or process Customer Data that are under NAVEX Global’s control. NAVEX Global shall maintain multiple firewalls supporting standard internet firewall technologies that meet ICSA Firewall, IPSec and cryptography standards. Additionally, NAVEX Global regularly tests the security of all applications by: • Performing monthly vulnerability scans of our production applications • Performing weekly vulnerability scans of our pre-production applications • Performing static code analysis scans of our applications during the development process • Performing peer code reviews during the development process • Contracting with an independent third-party to perform an annual PEN test of our applications NAVEX Global will enforce a formal change management process which will include tracking and approving all product changes. Any such changes will be internally reviewed and tested within a lower environment before such changes are finalized and deployed.
	Measures for the protection of data during storage	Customer Data is encrypted at rest using either full-disk encryption or within the database using TDE. Data at rest is encrypted using AES 256 or better.
	Measures for ensuring events logging	NAVEX Global has various tools and processes in place for monitoring and event logging. Monitoring covers internal and external systems monitoring, SIEM, and other alerting notifications and alerts. Within the production environment, audit logs record privileged user access activities, authorized and unauthorized access attempts, system exceptions, and information security events, and comply with applicable policies and regulations. System clocks are synchronized to an agreed standard, ensuring the accuracy of audit logs. Logs are stored in secure and segregated data storage. Backups are routinely performed and stored both on and off site.
	Measures for ensuring system configuration, including default configuration	NAVEX Global has documented hardening process, which is maintained on its internal collaboration site, Confluence. NAVEX Global uses Puppet tool for configuration integrity management. Web server lockdown scripts and Puppet are used to apply configuration scripts to newly deployed systems. Configuration integrity checks are automatically performed every 30 minutes by the Puppet system.
	Measures for internal IT and IT security governance and management	NAVEX Global implements data protection policies which go through a formal approval process. Policies are created, approved, managed and distributed using NAVEX Global’s policy management system. NAVEX Global is in a continual state of audit relative to applicable laws and regulations and contractual obligations. Areas of focus include information security, disaster recovery, data privacy, compliance, physical security, and regulations specific to the healthcare and financial sectors. Annual Business Impact Assessments are performed which include the following departments: Services, Product Engineering, Legal, Contact Center operations, Sales and Marketing. NAVEX Global maintains a Risk Register which is updated as new findings are identified. The Risk Register is reviewed semi-annually by management and other members of the security team.
	Measures for certification/assurance of processes and products	On an annual basis, NAVEX Global engages a recognized, independent third party to conduct a Statement on Standards for Attestation Engagements No. 16, Service Organization Control 2, Type 2 (“SSAE 18 SOC 2 Type 2”) audit (or its equivalent or successor) of its information security program and its administrative, technical, and physical safeguards for all facilities used to deliver the Services. The annual SOC report includes testing against four of the five Trusted Principles (security, availability, confidentiality, and privacy) as defined by the AICPA Service Organization Control framework.
	Measures for ensuring data minimisation and data quality	NAVEX Global is the data processor/third party service provider with respect to scoped customer data, and the customer is the data controller determining the means and purposes of the processing of the personal data submitted to each product/service. NAVEX Global holistically practices the minimum necessary principle and does not solicit more information than necessary to provide the services.
	Measures for ensuring limited data retention	At the end of the relationship, NAVEX Global shall return Customer Data to Customer and delete Customer Data in accordance with the procedures and timeframes specified in the Agreement. In the event the foregoing is not specified in the Agreement, and unless otherwise agreed by the parties, all Customer Data shall be deleted within forty-five (45) days of expiration or termination of the Agreement or Order Form (as applicable). Customer Data stored in back-ups shall be overwritten in accordance with NAVEX Global’s backup and retention cycle. During the term of the agreement(s), NAVEX Global’s services are either equipped with self-servicing functionality for deletion capabilities or NAVEX Global supports requests submitted by the customer’s administrators without undue delay. Customers are responsible for any data retention periods during the term of the agreement(s).
	Measures for ensuring accountability	NAVEX Global implements data protection policies which go through a formal approval process. Policies are created, approved, managed and distributed using NAVEX Global’s policy management system. NAVEX Global takes a “Privacy by design” approach putting appropriate data protection measures in place throughout the entire lifecycle of its processing operations. As a result, privacy is embedded in all processes, including use limitation and strict access by our employees and affiliates, vetting of vendors, suppliers and agents as well as in development of our products and services. For the products and services specifically, the Product Engineering teams have a privacy by design/privacy by default policy. NAVEX Global has contracts and data processing agreements in place with subcontractors, where appropriate. NAVEX Global relies on subcontractors to have proper controls and checks in place which they will manage for their subcontractors. As applicable, NAVEX Global maintains data flows as well as records of processing detailing the categories of data and processing operations. In the event of a data breach involving a customer’s personal data, NAVEX Global will alert the customer as soon as reasonably possible of the breach and the extent of the breach. NAVEX Global has a designated data protection officer NAVEX Global maintains the Code of Conduct policy. Employees are required to review and attest to the policy during the new hire employment process. NAVEX Glboal’s accountability measures are reviewed and updated at appropriate intervals (annually).
	Measures for allowing data portability and ensuring erasure	NAVEX Global transmits personal data in structured, commonly used and machine-readable formats. As applicable, NAVEX Global will export data in XML, or flat files per NAVEX Global’s file specifications. During the life of the services agreement, customers are responsible for managing data retention in accordance with the laws applicable to them. At the end of the service agreement, retention and deletion of customer scoped data is collaborated on between customer and NAVEX Global to complete the data deletion lifecycle in accordance with the timeframes agreed upon.
	Measures by which assistance will be provided, and scope and extent of assistance required, to support Customer in fulfilling data subject rights requests	During the term of the agreement(s), NAVEX Global’s services are either equipped with self-servicing functionality for data management capabilities or NAVEX Global supports requests submitted by the customer’s administrators without undue delay. Regardless, where Customer does not have the self-servicing capability or where Customer requires support, NAVEX Global fully cooperates and provides assistance to Customer which may include but is not limited to providing necessary access to data, service functionality assistance, data editing assistance, data exporting services, and deletion assistance and related services.
	Physical access controls employed for preventing unauthorized persons from gaining access to data processing systems within which personal data is processed or used.	NAVEX Global shall employ physical security procedures and controls to ensure that only authorized individuals have access to NAVEX Global data centres. Data centre controls include: Electronic access card reading system Management of keys / documentation of key holders Front desk with required sign in for all visitors CCTV Monitored building management system Adequate and appropriate identification, authentication and authorization mechanisms. Colocation facilities are protected 24x7 by security guards and monitored video surveillance, alarm systems, and external security firm patrols Measures are taken to ensure that equipment and media containing Customer Data are placed in secure areas to be protected from accidental destruction or loss and the premises where Customer Data is stored must be physically strong and protected from risk of damage by water, fire, vibration, dust, and environmental hazards.
	Admission control measures taken for preventing data processing systems from being used without authorization.	NAVEX Global will follow the principle of “least privilege” when granting access to NAVEX Global systems. NAVEX Global will utilize multi-factor authentication for Data importer employees who connect to the “backend” systems for support and maintenance and for NAVEX Global employees when connecting remotely to the corporate network. NAVEX Global will enforce complex password requirements across all NAVEX Global systems to minimize password-related access control risks. Personal and individual user log-in when entering the system and/or the corporate network Password procedures minimum of 8 characters, with one upper case, lower case, and digit. If the user account has five invalid logon attempts, the account will be locked out. All passwords expire after 90 days. Upon verification of the username and password, the application uses session-based token authentication. Automated screen locks after a defined period of inactivity Password protected screen savers All service account passwords are electronically documented and protected against unauthorized access through encryption User accounts are audited quarterly
	Virtual access control measures taken to ensure that persons entitled to use a data processing system have access only to personal data to which they have a right of access, and that personal data cannot be read, copied, modified or removed without authorizations in the course of processing or use and after storage.	User authentication is based on username and strong password All transactional records contain identifiers to distinguish customer records. System processing uses a rule-based mechanism to tailor data access to specific users and roles Data insert, deletion, and modification are logged
	Transmission control measures taken to ensure that personal data cannot be read, copied, modified or removed without authorization during electronic transmission or transport, and that it is possible to check and establish to which bodies the transfer of personal data by means of data transmission facilities is envisaged.	All data on untrusted systems are encrypted in flight using TLS Removable storage is not used.
	Input control measures taken to ensure that it is possible to check and establish whether and by whom personal data have been entered into data processing systems, modified or removed.	Record entry is restricted to a defined set of roles All entry is date/time stamped and includes identifiers for entering party Firewalls and intrusion prevention systems are in place to prevent unauthorized access
	Assignment control measures employed to ensure that, in the case of commissioned processing of personal data, the data are processed strictly in accordance with the instructions of the principal.	Confidentiality agreements are in place for all individuals with data access Global data privacy training within a GDPR focus is conducted during onboarding and on a regular basis No third parties used for the processing of data other than as approved via our customer contract Privacy and security policies describe rights and obligations of agent and principle
	Availability control measures taken to ensure that personal data are protected from accidental destruction or loss.	Systems employ redundancies such as RAID arrays and redundant equipment Multiple air conditioning units are installed to provide redundant capacity in a N+1 configuration. High sensitivity smoke detection UPS backed generator Diverse fiber routing and multiple carriers
	Separation control measures taken to ensure that personal data collected for different purposes can be processed separately.	Multiple-tier systems are used to physically separate presentation, business processing and storage Separation of duties is used internally to ensure functions pass through change control processes Discrete development, staging and production environments are maintained. All routing of data for processing is controlled through automated rules engines. Computing and storage is on equipment owned by NAVEX Global

For Processing by (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to Customer and, for transfers from NAVEX Global to a sub-processor, to Customer

Specific technical and organisational measures taken by NAVEX Global’s Sub-processors to be able to provide assistance to Customer, for transfers from NAVEX Global to Sub-processor, to Customer:

Sub-processing activities are limited and/or temporary, with no persistent storage
Security measures are reviewed annually
Sub-processors are required to have policies in place for personal data incident reporting, legal authority access request notification, data subject request notification and full cooperation with any such requests
Sub-processors comply with applicable data protection laws and have robust agreements in place with NAVEX Global

NAVEX Global ensures all Sub-procesors are fully able to assist Customer as applicable. If there are any specific questions regarding NAVEX Global’s Sub-processors, Customer is encouraged and directed to submit questions to its account representative(s).