This Data Processing Agreement (“DPA”) is incorporated into and forms a part of the Cloud Terms of Service, or other applicable service or subscription agreement between you and Struxture Technologies, Inc (DBA Moxie, Previously DBA Hectic and HecticApp) with respect to your use of the Cloud Services (“Services Agreement”). This DPA sets out data protection requirements with respect to the processing of Customer Personal Data (as defined below) that is collected, stored, or otherwise processed by Struxture Technologies for the purpose of providing the Cloud Services. This DPA is effective on the effective date of the Services Agreement, unless this DPA is separately executed in which case it is effective on the date of the last signature.
The following terms have the following meanings when used in this DPA. Any capitalized terms that are not defined in this DPA have the meaning provided in your Services Agreement.
“Customer,” “you” and “your” means the organization that agrees to an Order Form, or uses the Cloud Services subject to the relevant Services Agreement.
“Customer Personal Data” means any personal data that Customer uploads into the Cloud Services that is processed by Struxture Technologies.
“Data Protection Law” means, to the extent applicable, (i)Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (“EUGDPR”); (ii) the Data Protection Act 2018 and EU GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom's European Union(Withdrawal) Act 2018 (“UK GDPR”); (iii) the EU e-Privacy Directive (Directive2002/58/EC); (iv) the Swiss Federal Act on Data Protection (“FADP”); (v) the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code §§ 1798.100 to 1798.199.100), together with the CCPA Regulations (Cal. Code Regs. tit. 11, §§ 7000 to 7102) which may be amended from time to time (“CCPA”); and (vi) any other data protection legislation applicable to the respective party in its role in the processing of Customer Personal Data under the Services Agreement.
“Data Subject Request” has the meaning given to it in Section5.1.
“EEA” means the European Economic Area.
"Subprocessor" means any third-party data processor engaged by Struxture Technologies to process Customer Personal Data.
“Technical and Organizational Security Measures” has the meaning given to it in Section 3.2.
The terms “controller,” “data subject,” “personal data,” “personal data breach,” “processor,” “processing” and “supervisory authority” have the meanings set forth in the EU GDPR.
2.1. Scope and Roles. This DPA applies when Struxture Technologies processes Customer Personal Data in the course of providing the Cloud Services. In this context, Struxture Technologies is a “processor” to Customer, who may act as either a “controller” or “processor” with respect to Customer Personal Data.
2.2. Details of the Processing.
2.2.1. Subject Matter. The subject matter of the data processing under this DPA is Customer Personal Data.
2.2.2. Duration. The duration of the data processing under this DPA is until the expiration or termination of the Services Agreement in accordance with its terms.
2.2.3. Nature and Purpose. The purpose of the data processing under this DPA is the provision of the Cloud Services to Customer in accordance with the Services Agreement.
2.2.4. Types of Customer Personal Data. The types of Customer Personal Data processed under this DPA include any Customer Personal Data uploaded to the Cloud Services by Customer.
2.2.5. Categories of Data Subjects. The data subjects may include Customer’s customers, employees, suppliers, and end users, or any other individual whose personal data Customer uploads to the Cloud Services.
2.3. Compliance with Laws. Each party will comply with all applicable Data Protection Law, including the EU GDPR, in relation to the processing of Customer Personal Data.
2.4. Struxture Technologies Processing. Struxture Technologies will process Customer Personal Data only for the purposes of: (i)provisioning the Cloud Services, (ii) processing initiated by Customer in its use of the Cloud Services, and (iii) processing in accordance with your Services Agreement, this DPA, and your other reasonable documented instructions that are consistent with the terms of your Services Agreement. Any other processing will require prior written agreement between the parties.
2.5. Customer Obligations. Customer acknowledges that it controls the nature and contents of the Customer Personal Data. Customer will ensure that it has obtained all necessary and appropriate consents from and provided notices to data subjects where required by Data Protection Law to enable the lawful transfer of any Customer Personal Data to Struxture Technologies for the duration and purposes of this DPA and the Services Agreement.
3.1. Confidentiality of Personnel. Struxture Technologies will ensure that any of our personnel and any subcontractors who have access to Customer Personal Data are under an appropriate obligation of confidentiality.
3.2. Security Measures. We will implement appropriate technical and organizational security measures to ensure a level of security appropriate to the risks that are presented by the processing of Customer Personal Data.
3.3. Optional Security Controls. Struxture Technologies makes available a number of security controls, features, and functionalities that Customer may elect to use. Customer is responsible for implementing those measures to ensure a level of security appropriate to the Customer Personal Data.
3.4.BreachNotification.We will notify you without undue delay if we become aware of a personal data breach affecting Customer Personal Data
4.1. Authorized Subprocessors. You acknowledge and agree that we may retain our affiliates and other third parties to further process Customer Personal Data on your behalf as Subprocessors in connection with the provision of the Cloud Services. We maintain a current list of our Subprocessors at: https://www.withmoxie.com/terms-legal/sub-processors which we will update at least 30 days before the addition or replacement of any Subprocessor.
4.2. Objections to Subprocessors. In the event you have a reasonable objection to any new Subprocessor, either (A) we will instruct such Subprocessor not to process Customer Personal Data on your behalf and, if possible, continue to provide the Cloud Services in accordance with the terms of the Services Agreement and any applicable Order Form, or (B) if we cannot provide the Cloud Services without the use of such Subprocessor, you may, as your sole and exclusive remedy, terminate this Agreement and any applicable Order Form and receive a refund of any prepaid fees for unused Subscriptions.
4.3 Subprocessor Obligations. Struxture Technologies will impose on each Subprocessor the same data protection obligations as are imposed on us under this DPA. We will be liable to you for the performance of the Subprocessors' obligations to the extent required by Data Protection Law.
5.1. To assist with your obligations to respond to requests from data subjects, the Cloud Services provide Customer with the ability to retrieve, correct, or delete Customer Personal Data. Customer may use these controls to assist it in connection with its obligations under Data Protection Law, including its obligations related to any request from a data subject to exercise their rights under Data Protection Law (each, a “Data Subject Request”).
5.2. If a data subject contacts Struxture Technologies with a Data Subject Request that identifies Customer, to the extent legally permitted, we will promptly notify Customer. Solely to the extent that Customer is unable to access Customer Personal Data itself, and Struxture Technologies is legally permitted to do so, we will provide commercially reasonable assistance to Customer in responding to the Data Subject Request. To the extent legally permitted, Customer will be responsible for any costs arising from Struxture Technologies’s provision of such assistance, including any fees associated with the provision of additional functionality.
5.3 Dispute Resolution - If a privacy complaint or dispute relating to Personal Data received by Struxture Technologies Inc in reliance on the Data Privacy Framework (or any of its predecessors) cannot be resolved through our internal processes, we have agreed to participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure.
Subject to the terms of the VeraSafe Data Privacy Framework Dispute Resolution
Procedure, VeraSafe will provide appropriate recourse free of charge to you. To file a complaint with VeraSafe and participate in the VeraSafe Data Privacy Framework Dispute Resolution Procedure, please submit the required information here:
https://www.verasafe.com/privacy-services/dispute-resolution/submit-dispute/
If a complaint or dispute cannot be resolved through our internal process, we have also agreed to cooperate with the EU and UK data protection authorities and the Swiss Federal Data Protection and Information Commissioner and to participate in the dispute resolution procedures of the panel established by such data protection authorities.
5.4 Binding Arbitration - If your dispute or complaint related to your Personal Data that we received in reliance on the Data Privacy Framework cannot be resolved by us, nor through the dispute resolution mechanism mentioned above, you may have the right to require that we enter into binding arbitration with you under the Data Privacy Framework “Recourse, Enforcement and Liability” Principle and Annex I of the Data Privacy Framework.
6.1. If we receive a valid and binding legal order (“Request”)from any governmental body (“Requesting Party”) for disclosure of Customer Personal Data, we will use commercially reasonable efforts to redirect the Requesting Party to seek that Customer Personal Data directly from Customer.
6.2. If, despite our efforts, we are compelled to disclose Customer Personal Data to a Requesting Party, we will:
(a) if legally permitted, promptly notify Customer of the Request to allow Customer to seek a protective order or other appropriate remedy. If we are prohibited from notifying Customer, we will use commercially reasonable efforts to obtain a waiver of that prohibition;
(b) challenge any over-broad or inappropriate Request (including Requests that conflict with the law of the European Union); and
(c) disclose only the minimum amount of Customer Personal Data necessary to satisfy the Request.
Taking into account the nature of the processing and the information available to us, at your request and cost, Struxture Technologies will provide reasonable assistance to ensure compliance with the obligations under applicable Data Protection Law with respect to implementing appropriate security measures, personal data breach notifications, impact assessments and consultations with supervisory authorities or regulators, in each case solely related to processing of Customer Personal Data by Struxture Technologies.
8.1. Upon Customer’s request, and subject to the confidentiality obligations set forth in your Services Agreement, Struxture Technologies will make available to Customer (or Customer’s independent, third-party auditor)information regarding Struxture Technologies’ compliance with the security obligations set forth in this DPA in the form of third-party certifications and audits.
8.2. If that information is not sufficient to demonstrate our compliance with the security obligations in the DPA, you may contact Struxture Technologies in accordance with the notice provision of your Services Agreement to request an on-site audit of Struxture Technologies’ procedures relevant to the protection of Customer Personal Data, but only to the extent required under applicable Data Protection Law. Customer will reimburse Struxture Technologies for its reasonable costs associated with any such on-site audit. Before the commencement of any such on-site audit, Customer and Struxture Technologies will mutually agree upon the scope, timing, and duration of the audit.
8.3. Customer will promptly notify Struxture Technologies with information regarding any non-compliance discovered during the course of an audit, and Struxture Technologies will use commercially reasonable efforts to address any confirmed non-compliance.
9.1. Processing Locations. You may choose to use certain optional features of the Cloud Services that require transfers of Customer Personal Data outside of the EEA, Switzerland or the United Kingdom. When required by Data Protection Law, such transfers will be governed by the provisions of Section 9.2 below.
9.2. Transfer Mechanism. Where the transfer of Customer Personal Data is from the EEA, Switzerland or the United Kingdom to a territory which has not been recognized by the relevant data protection authorities as providing an adequate level of protection for personal data according to Data Protection Law, Struxture Technologies agrees to process that Customer Personal Data in compliance with the provisions set out in Schedule 1below, which forms an integral part of this DPA.
Customer may retrieve or delete all Customer Personal Data upon expiration or termination of the Services Agreement. Upon termination of your Services Agreement or upon your request, Struxture Technologies will delete any Customer Personal Data not deleted by Customer, unless we are legally required to store the Customer Personal Data.
For purposes of this Section 11, Customer Personal Data shall include “personal information” (as that term is defined under CCPA) that Customer uploads into the Cloud Services that is processed by Struxture Technologies. Struxture Technologies is a “service provider” as defined in CCPA.
11.1. Struxture Technologies will not:
11.1.1. retain, use, or disclose Customer Personal Data for any purpose other than providing the Cloud Services;
11.1.2. retain, use, or disclose Customer Personal Data outside of the direct business relationship between Struxture Technologies and Customer;
11.1.3. sell or share Customer Personal Data (as the terms "sell” and “share” are defined in CCPA); or
11.1.4. combine Customer Personal Data with personal information that Struxture Technologies has received from another Struxture Technologies customer, except as permitted under CCPA.
11.2. We will notify you if we determine that we can no longer comply with our obligations as a service provider under CCPA.
11.3. You have the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of personal information that is protected under CCPA.
1. Definitions.
“Standard Contractual Clauses” means, as the circumstances may require, the applicable module(s) of the Standard Contractual Clauses approved by the European Commission in decision 2021/914, or any subsequent versions of the Standard Contractual Clauses which may be adopted by the European Commission from time to time. Upon the effective date of adoption for any revised Standard Contractual Clauses by the European Commission, all references in this DPA to the “Standard Contractual Clauses” shall refer to that latest version thereof.
“Alternative Transfer Mechanism” means a mechanism, other than the Standard Contractual Clauses, that enables the lawful cross-border transfer of Customer Personal Data to a territory which has not been recognized by the relevant data protection authorities as providing an adequate level of protection for Customer Personal Data in accordance with Data Protection Law, including but not limited to any replacement international instruments for the invalidated EU-U.S. and Switzerland-U.S. Privacy Shield Frameworks or Binding Corporate Rules under Article 47 of EU GDPR.
2. Order of Precedence for Transfer Mechanisms. For transfers of Customer Personal Data that are subject to Section 9.3 of the DPA, the transfer mechanisms below shall apply in the following order of precedence in accordance with Data Protection Law: (A) Struxture Technologies ’certification to or adoption of an Alternative Transfer Mechanism; and (B) the Standard Contractual Clauses in accordance with Section 3 below.
3. Incorporation of the Standard Contractual Clauses.
3.1. When the Standard Contractual Clauses are the applicable transfer mechanism in accordance with Section 2 above, the parties agree that:
3.1.1 Clause 7 will not apply.
3.1.2 in Clause 9(a), Option 2 will apply, and the time period for prior notice of Subprocessor changes will be as set forth in Section 4.1 of the DPA.
3.1.3 in Clause 11(a), the optional language will not apply.
3.1.4 in Clause 17, Option 1 will apply, and the Standard Contractual Clauses will be governed by the law of the Republic of Ireland.
3.1.5 in Clause 18(b), disputes will be resolved before the courts of the Republic of Ireland.
3.2. For purposes of Annex I, Part A of the Standard Contractual Clauses (List of Parties):
3.2.1 Data Exporter: Customer.
3.2.2 Data Importer: Struxture Technologies, Inc.
3.3. For purposes of Annex I, Part B of the Standard Contractual Clauses (Description of Transfer):
3.4. For purposes of Annex I, Part C of the Standard Contractual Clauses (Competent Supervisory Authority), the competent supervisory authority/ies shall be determined in accordance with EU GDPR and Clause 13 of the Standard Contractual Clauses.
3.5. Sections 3 and 4.3 of the DPA contain the information required under Annex II of the Standard Contractual Clauses (Technical and Organizational Measures).
3.6. In addition to the above stipulations, each of the following forms part of the Standard Contractual Clauses and sets out the parties’ understanding of their respective obligations under the Standard Contractual Clauses:
4. Transfers of Customer Personal Data Protected by FADP.
4.1. With respect to transfers of Customer Personal Data protected by FADP, the Standard Contractual Clauses will apply in accordance with Sections 2 and 3 above, with the following modifications:
5. Transfers of Customer Personal Data Protected by UK GDPR.
5.1. With respect to transfers of Customer Personal Data protected by UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued under S119A(1) Data Protection Act 2018 (“UK Addendum”), shall apply and be incorporated by reference into this DPA, with Part 1: Tables completed in accordance with the applicable stipulations in Section 3 of this Schedule 1. Either data exporter or data importer may terminate the UK Addendum pursuant to Section 19 of the UK Addendum if, after a good faith effort by the parties to amend the DPA to account for the approved changes and any reasonable clarifications to the UK Addendum, the parties are unable to come to agreement. To the extent of any conflict between Section 3 of this Schedule 1 and any mandatory clauses of the UK Addendum, the UK Addendum shall govern to the extent UK GDPR applies to the transfer.