This Data Processing Agreement (“DPA”) forms an integral part of the Pexgle Terms and Conditions, available at the website https://www.pexgle.com/terms-and-conditions/ (“Pexgle Terms and Conditions”), between: (i) applicable Pexgle Company as described in the Terms and Conditions (“Pexgle”) acting on its own behalf and as agent for each Pexgle’s affiliate; and (ii) User, as defined in the Pexgle Terms and Conditions. By using the Services, User accepts the terms of this DPA.

This DPA sets out the additional terms, requirements and conditions on which Pexgle will process Personal Data when providing services under the Pexgle Terms and Conditions and shall come into force simultaneously with Terms and Conditions whenever updated by Pexgle accordingly. This DPA contains the mandatory clauses required by Article 28(3) of the General Data Protection Regulation ((EU) 2016/679) (“GDPR”) for contracts between controllers and processors.

AGREED TERMS

1. Definitions and interpretationThe following definitions and rules of interpretation apply in this DPA.
   1. Definitions:Affiliate: any entity controlling, controlled by, or under common control with a party, where “control” is defined as: (a) the ownership of at least fifty percent (50%) of the equity or beneficial interests of the entity; (b) the right to vote for or appoint a majority of the board of directors or other governing body of the entity; or (c) the power to exercise a controlling influence over the management or policies of the entity.

      Alternative Transfer Solution: a solution, other than the Model Contract Clauses, that enables the lawful transfer of personal data to a third country in accordance with Article 45 or 46 of the GDPR (for example, the EU-U.S. Privacy Shield).

      Authorised Persons: the persons or categories of persons that User authorises to give the Pexgle personal data processing instructions either nominated by User or with ostensible or actual authority

      Business Purposes: the Services described in the Pexgle Terms and Conditions.

      Data Protection Legislation: all applicable privacy and data protection laws including the General Data Protection Regulation ((EU) 2016/679) and, to the extent applicable, the data protection or privacy laws of any other country.

      Data Subject: an individual who is the subject of Personal Data.

      Model Contract Clauses: the standard data protection clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, as described in Article 46 of the GDPR.

      Personal Data: means any information relating to an identified or identifiable natural person that is processed by the Pexgle as a result of, or in connection with, the provision of the services under the Pexgle Terms and Conditions; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

      Processing, processes and process: either any activity that involves the use of Personal Data or as the Data Protection Legislation may otherwise define processing, processes or process. It includes any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Processing also includes transferring Personal Data to third parties.

      Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.

   2. This DPA is subject to the terms of the Pexgle Terms and Conditions and is incorporated into the Pexgle Terms and Conditions. Interpretations and defined terms set forth in the Pexgle Terms and Conditions apply to the interpretation of this DPA.
   3. The Annexes form part of this DPA and will have effect as if set out in full in the body of this DPA. Any reference to this DPA includes the Annexes.
   4. A reference to writing or written includes email.
   5. In the case of conflict or ambiguity between:
      1. any provision contained in the body of this DPA and any provision contained in the Annexes, the provision in the body of this DPA will prevail.

2. Duration of DPA

   This DPA will take effect as stipulated in the recitals above and shall remain in effect until, and expire in accordance with clause 12.

3. Personal data types and processing purposes

   1. The User retains control of the Personal Data and remains responsible for its compliance obligations under the applicable Data Protection Legislation, including providing any required notices and obtaining any required consents, and for the processing instructions it gives to the Pexgle.
   2. Annex 1 describes the subject matter, duration, nature and purpose of processing and the Personal Data categories and Data Subject types in respect of which the Pexgle may process to fulfil the Business Purposes of the Pexgle Terms and Conditions.

4. Processing of Data

   1. Pexgle and User Responsibilities. If the Data Protection Legislation applies to the processing of User Personal Data, the parties acknowledge and agree that:
      1. the subject matter and details of the processing are described in Annex 1;
      2. Pexgle is a processor of that User Personal Data under the Data Protection Legislation;
      3. User is a controller or processor, as applicable, of that User Personal Data under the Data Protection Legislation; and
      4. User instructs Pexgle (and authorises processor and each processor affiliate to instruct each subprocessor) to in particular, transfer User Personal Data to any country or territory, as reasonably necessary for the provision of the Services and consistent with Pexgle Terms and Conditions; and
      5. each party will comply with the obligations applicable to it under the Data Protection Legislation with respect to the processing of that User Personal Data.

      If the Data Protection Legislation applies to the processing of User Personal Data and User is a processor, User warrants to Pexgle that User’s instructions and actions with respect to that User Personal Data, including its appointment of Pexgle as another processor, have been authorized by the relevant controller.

   2. Pexgle will take into account the nature of the processing, assists the User by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Data Protection Legislation.
   3. Pexgle will assist the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of GDPR taking into account the nature of processing and the information available to the processor.

5. Scope of Processing

   1. User’s Instructions. By entering into this DPA, User instructs Pexgle to process User Personal Data only in accordance with applicable law: (a) to provide the Services and related technical support; (b) as documented in the form of the Pexgle Terms and Conditions, including this DPA; and (d) as further documented in any other written instructions given by User and acknowledged by Pexgle as constituting instructions for purposes of this DPA.
   2. Pexgle’s Compliance with Instructions. Pexgle will comply with the instructions described in Section 5.1 (User’s Instructions) (including with regard to data transfers) unless EU or EU Member State law to which Pexgle is subject requires other processing of User Personal Data by Pexgle, in which case Pexgle will inform User (unless that law prohibits Pexgle from doing so on important grounds of public interest) via the User email address.

6. Pexgle employees

   1. Pexgle will ensure that all employees:
      1. are informed of the confidential nature of the Personal Data and are bound by confidentiality obligations and use restrictions in respect of the Personal Data;
      2. have undertaken training on the Data Protection Legislation relating to handling Personal Data and how it applies to their particular duties; and
      3. are aware both of the Pexgle’s duties and their personal duties and obligations under the Data Protection Legislation and this DPA.

7. Security

   1. Pexgle must at all times implement appropriate technical and organisational measures against unauthorised or unlawful processing, access, disclosure, copying, modification, storage, reproduction, display or distribution of Personal Data, and against accidental or unlawful loss, destruction, alteration, disclosure or damage of Personal Data. Technical and organisational measure are specified in the Annex 2.
   2. Pexgle must implement such measures to ensure a level of security appropriate to the risk involved, including as appropriate:
      1. the pseudonymisation and encryption of personal data;
      2. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
      3. the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and
      4. process for regularly testing, assessing and evaluating the effectiveness of security measures.

8. Personal Data Breach

   1. Pexgle will promptly and without undue delay notify User if any Personal Data is lost or destroyed or becomes damaged, corrupted, or unusable. The Pexgle will restore such Personal Data at its own expense.
   2. Pexgle will immediately and without undue delay notify User if it becomes aware of:
      1. any accidental, unauthorised or unlawful processing of the Personal Data; or
      2. any Personal Data Breach.
   3. Where Pexgle becomes aware of (a) and/or (b) above, it shall, without undue delay, also provide User with the following information:
      1. description of the nature of (a) and/or (b), including the categories and approximate number of both Data Subjects and Personal Data records concerned;
      2. the likely consequences; and
      3. description of the measures taken, or proposed to be taken to address (a) and/or (b), including measures to mitigate its possible adverse effects.
   4. Immediately following any unauthorised or unlawful Personal Data processing or Personal Data Breach, the parties will co-ordinate with each other to investigate the matter. Pexgle will reasonably co-operate with User in User’s handling of the matter in accordacne with Data Protection Legislation.
   5. Pexgle will not inform any third party of any Personal Data Breach without first obtaining User’s prior written consent, except when required to do so by law.
   6. Pexgle agrees that User has the sole right to determine:
      1. whether to provide notice of the Personal Data Breach to any Data Subjects, supervisory authorities, regulators, law enforcement agencies or others, as required by law or regulation or in User’s discretion, including the contents and delivery method of the notice; and
      2. whether to offer any type of remedy to affected Data Subjects, including the nature and extent of such remedy.

9. Cross-border transfers of personal data

   1. Data storage and processing facilities. User agrees that Pexgle may, subject to Section 9.2 (Transfers of Data out of the EEA), store and process User Data in the United States of America and any other country in which Pexgle or any of its subprocessors maintains facilities.
   2. Transfers of Data out of the EEA.
      1. Pexgle’s Transfer Obligations. If the storage and/or processing of User Personal Data (as set out in Section 9.1 (Data storage and processing facilities)) involves transfers of User Personal Data out of the EEA and the Data Protection Legislation applies to the transfers of such data (“Transferred Personal Data”), Pexgle will:
         1. if requested to do so by User, ensure that Pexgle as the data importer of the Transferred Personal Data enters into Model Contract Clauses with User as the data exporter of such data, and that the transfers are made in accordance with such Model Contract Clauses; and/or
         2. offer an Alternative Transfer Solution, ensure that the transfers are made in accordance with such Alternative Transfer Solution, and make information available to User about such Alternative Transfer Solution.
      2. User’s Transfer Obligations. In respect of Transferred Personal Data, User agrees that:
         1. if under the Data Protection Legislation Pexgle reasonably requires User to enter into Model Contract Clauses in respect of such transfers, User will do so; and
         2. if under the Data Protection Legislation Pexgle reasonably requires User to use an Alternative Transfer Solution offered by Pexgle, and reasonably requests that User take any action (which may include execution of documents) strictly required to give full effect to such solution, User will do so.
   3. Disclosure of Confidential Information сontaining Personal Data. If User has entered into Model Contract Clauses as described in Section 9.2 (Transfers of Data out of the EEA), Pexgle will, notwithstanding any term to the contrary in the applicable agreement, ensure that any disclosure of User’s Confidential Information containing personal data, and any notifications relating to any such disclosures, will be made in accordance with such Model Contract Clauses.

10. Subprocessors

    1. Consent to subprocessor engagement. User specifically authorizes the engagement of Pexgle’s Affiliates as subprocessors. In addition, Pexgle generally authorizes the engagement of any other third parties as subprocessors (“Third Party Subprocessors”). If User has entered into Model Contract Clauses as described in Section 10.2 (Transfers of Data out of the EEA), the above authorizations will constitute User’s prior written consent to the subcontracting by Pexgle of the processing of User Data if such consent is required under the Model Contract Clauses.
    2. Information about subprocessors. Information about subprocessors is available in Annex 1 (as may be updated by Pexgle from time to time in accordance with this DPA).
    3. Requirements for subprocessor engagement. When engaging any subprocessor, Pexgle will:
       1. ensure via a written contract that:
          1. the subprocessor only accesses and uses User Data to the extent required to perform the obligations subcontracted to it, and does so in accordance with the applicable agreement (including this DPA) and any Model Contract Clauses entered into or Alternative Transfer Solution adopted by Pexgle as described in Section 9.2 (Transfers of Data out of the EEA); and
          2. if the Data Protection Legislation applies to the processing of User Personal Data, the data protection obligations set out in Article 28(3) of the GDPR, as described in this DPA, are imposed on the subprocessor; and
       2. remain fully liable for all obligations subcontracted to, and all acts and omissions of, the subprocessor.
    4. Opportunity to object to subprocessor changes:
       1. when any new Third Party Subprocessor is engaged during the applicable term, Pexgle will, at least 30 days before the new Third Party Subprocessor processes any User Data, inform User of the engagement (including the name and location of the relevant subprocessor and the activities it will perform) by sending an email to the email address.
       2. User may object to any new Third Party Subprocessor by terminating the applicable agreement immediately upon written notice to Pexgle, on condition that User provides such notice within 90 days of being informed of the engagement of the subprocessor as described in Section 10.4(a). This termination right is User’s sole and exclusive remedy if User objects to any new Third Party Subprocessor.

11. Complaints, data subject requests and third party rights

    1.  Pexgle shall take such technical and organisational measures as may be appropriate, and promptly provide such information to User as User may reasonably require, to enable User to comply with:
       1. the rights of Data Subjects under the Data Protection Legislation, including subject access rights, the rights to rectify and erase personal data, object to the processing and automated processing of personal data, and restrict the processing of personal data; and
       2. information or assessment notices served on User by any supervisory authority under the Data Protection Legislation.
    2. Pexgle shall notify User immediately if it receives any complaint, notice or communication that relates directly or indirectly to the processing of the Personal Data or to either party’s compliance with the Data Protection Legislation.
    3. Pexgle must notify User within 24 hours if it receives a request from a Data Subject for access to their Personal Data or to exercise any of their related rights under the Data Protection Legislation.
    4. Pexgle will give User its full co-operation and assistance in responding to any complaint, notice, communication or Data Subject request.
    5. Pexgle must not disclose the Personal Data to any Data Subject or to a third party other than at User’s request or instruction, as provided for in this Agreement or as required by law.

12. Term and termination

    1. This DPA will remain in full force and effect so long as:
       1. Pexgle Terms and Conditions remains in effect, or
       2. Pexgle retains any Personal Data related to the Pexgle Terms and Conditions in its possession or control (Term).
    2. Any provision of this DPA that expressly or by implication should come into or continue in force on or after termination of the Pexgle Terms and Conditions  in order to protect Personal Data will remain in full force and effect.
    3. Pexgle’s failure to comply with the terms of this DPA is a material breach of the Pexgle Terms and Conditions. In such event, User may terminate the Pexgle Terms and Conditions effective immediately on written notice to the Pexgle without further liability or obligation.
    4. If a change in any Data Protection Legislation prevents either party from fulfilling all or part of its Pexgle Terms and Conditions obligations, the parties will suspend the processing of Personal Data until that processing complies with the new requirements. If the parties are unable to bring the Personal Data processing into compliance with the Data Protection Legislation, they may terminate relations with Pexgle Terms and Conditions on written notice to Pexgle.

13. Data return and destruction

    1. Where it is applicable under legislation at User’s request, the Pexgle will give User a copy of or access to all or part of User’s Personal Data in its possession or control in the format and on the media reasonably specified by User.
    2. On termination of relations with Pexgle for any reason Pexgle will securely delete or destroy or, if directed in writing by User, return and not retain, all or any Personal Data related to this DPA in its possession or control.
    3. If any law, regulation, or government or regulatory body requires the Pexgle to retain any documents or materials that the Pexgle would otherwise be required to return or destroy, it will notify User in writing of that retention requirement, giving details of the documents or materials that it must retain, the legal basis for retention, and establishing a specific timeline for destruction once the retention requirement ends.
    4. Pexgle will certify in writing that it has destroyed the Personal Data within no more than 90 (ninety) days after it completes the destruction, unless Data Protection Legislation requires storage.

14. Records

    1. Where it is applicable under legislation Pexgle will keep detailed, accurate and up-to-date written records regarding any processing of Personal Data it carries out for User in accordance with Data Protection Legislation, including but not limited to, the access, control and security of the Personal Data, the processing purposes, categories of processing, any transfers of personal data to a third country and related safeguards, and a general description of the technical and organisational security measures (Records).
    2. Pexgle will ensure that the Records are sufficient to enable User to verify the Pexgle’s compliance with its obligations under this DPA and the Pexgle will provide User with copies of the Records upon request.

15. Audit

    1. User may, prior to the commencement of processing, and at regular intervals thereafter, audit the technical and organizational measures taken by Pexgle.For such purpose, User may:
       • obtain information from Pexgle,
       • request Pexgle to submit to User an existing attestation or certificate by an independent professional expert.
    2. Pexgle shall, upon User’s written request and within a reasonable period of time, provide User with all information necessary for such audit, to the extent that such information is within User’s control and User is not precluded from disclosing it by applicable law, a duty of confidentiality, or any other obligation owed to a third party.
    3. Pexgle may object in writing to an auditor appointed by User to conduct any audit under this clause if the auditor is, in Pexgle’s reasonable opinion, not suitably qualified or independent, a competitor of Pexgle, or otherwise manifestly unsuitable. Any such objection by Pexgle will require User to appoint another auditor or conduct the audit itself.

16. Warranties

    1. The User warrants and represents that the Pexgle’s expected use of the Personal Data for the Business Purposes and as specifically instructed by User will comply with the Data Protection Legislation.

17. Notice

    1. Any notice or other communication given to a party under or in connection with this DPA must be in writing and delivered to: support@pexgle.com
    2. Clause 17.1 does not apply to the service of any proceedings or other documents in any legal action or, where applicable, any arbitration or other method of dispute resolution.

Subject matter of processing: Pexgle’s provision of the Services and related technical support to User.

Duration of Processing: Personal Data will be Processed for the duration of the DPA.

Nature of Processing: Pexgle will process User Personal Data submitted, stored, sent or received by User via the Services for the purposes of providing the Services and related technical support to Pexgle in accordance with the DPA.

Personal Data Categories: Contact Information, the extent of which is determined and controlled by the User in its sole discretion, and other Personal Data such as navigational data (including website usage information), email data, system usage data, application integration data, and other electronic data submitted, stored, sent, or received by end users via the Service.

Data Subject Types: Personal data submitted, stored, sent or received via the Services may concern the following categories of data subjects: end users including User’s employees; and any other person who transmits data via the Services.

Pexgle and Pexgle Affiliates may engage third party suppliers to provide other services such as facilities management, maintenance and security services from time to time.

This Annex forms an integral part of the DPA and describes the technical and organizational security measures implemented by Pexgle. Pexgle may update or modify these security measures from time to time provided that such updates and modifications do not result in the degradation of the overall security of the Services.

1. Data Center

   1. Pexgle stores all production data in physically secure data centers.
   2. Infrastructure systems have been designed to eliminate single points of failure and minimize the impact of anticipated environmental risks. Dual circuits, switches, networks or other necessary devices help provide this redundancy. The Services are designed to allow Pexgle to perform certain types of preventative and corrective maintenance without interruption. All environmental equipment and facilities have documented preventative maintenance procedures that detail the process for and frequency of performance in accordance with the manufacturer’s or internal specifications. Preventative and corrective maintenance of the data center equipment is scheduled through a standard change process according to documented procedures.
   3. The data center electrical power systems are designed to be redundant and maintainable without impact to continuous operations, 24 hours a day, and 7 days a week. In most cases, a primary as well as an alternate power source, each with equal capacity, is provided for critical infrastructure components in the data center. Backup power is provided by various mechanisms such as uninterruptible power supplies (UPS) batteries, which supply consistently reliable power protection during utility brownouts, blackouts, over voltage, under voltage, and out-of-tolerance frequency conditions. If utility power is interrupted, backup power is designed to provide transitory power to the data center, at full capacity, for up to 10 minutes until the diesel generator systems take over. The diesel generators are capable of automatically starting up within seconds to provide enough emergency electrical power to run the data center at full capacity typically for a period of days.
   4. Pexgle has designed and regularly plans and tests its business continuity planning/disaster recovery checks.

2. Access Control

   1. Preventing Unauthorized Services Access:
      1. Pexgle hosts its Service with outsourced cloud infrastructure providers.
      2. Additionally, Pexgle maintains contractual relationships with vendors in order to provide the Service in accordance with DPA. Pexgle relies on contractual agreements, privacy policies, and vendor compliance procedures in order to protect data processed or stored by these vendors.
      3. Pexgle hosts its Services infrastructure with multi-tenant, outsourced infrastructure providers.
      4.  Pexgle implemented a uniform password policy for its Services and correspondent tools and features. Users who interact with the Services via the user interface must authenticate before accessing non-public user data.
      5. User data is stored in multi-tenant storage systems accessible to User via only application user interfaces and application programming interfaces. Users are not allowed direct access to the underlying application infrastructure. The authorization model in each of tools and features of Pexgle Services is designed to ensure that only the appropriately assigned individuals can access relevant features, views, and customization options. Authorization to data sets is performed through validating the user’s permissions.
      6. Public Services APIs may be accessed using an API key.
   2. Preventing Unauthorized Services Use.Pexgle implements industry standard access controls and detection capabilities for the internal networks that support its Services:
      1. Network access control mechanisms are designed to prevent network traffic using unauthorized protocols from reaching the Services infrastructure. The technical measures implemented differ between infrastructure providers and include Virtual Private Cloud (VPC) implementations, security group assignment, and traditional firewall rules.
      2. Pexgle implemented a Web Application Firewall (WAF) solution to protect internet-accessible applications. The WAF is designed to identify and prevent attacks against publicly available network services.
      3. Security reviews parts of code stored in Pexgle source code repositories is performed, checking for coding best practices and identifiable software flaws.
      4. Pexgle conducts penetration tests annually. The intent of the penetration tests is to identify and resolve foreseeable attack vectors and potential abuse scenarios.
      5. A bug bounty program invites and incentivizes independent security researchers to ethically discover and disclose security flaws. Pexgle implemented a bug bounty program in an effort to widen the available opportunities to engage with the security community and improve the Services defenses against sophisticated attacks.
   3. Authorization Requirements:A subset of Pexgle and Pexgle affiliates’ employees have access to User data via controlled interfaces. The intent of providing access to a subset of employees is to provide effective customer support, to troubleshoot potential problems, to detect and respond to security incidents and implement data security. Pexgle and Pexgle affiliates’ employees are required to conduct themselves in a manner consistent with the Pexgle guidelines regarding confidentiality, business ethics, appropriate usage, and professional standards.

3. Transmission Control

   Pexgle makes HTTPS encryption (also referred to as SSL or TLS) available on every one of its login interfaces. Pexgle HTTPS implementation uses industry standard algorithms and certificates.

4. Input Control

   1. Pexgle designed its infrastructure to log extensive information about the system behavior, traffic received, system authentication, and other application requests partly. Internal systems aggregated log data and alert appropriate employees of malicious, unintended, or anomalous activities. Pexgle personnel, including security are responsive to known incidents.
   2. Pexgle maintains a record of known security incidents that includes description, dates and times of relevant activities, and incident disposition. Suspected and confirmed security incidents are investigated by security, operations, or support personnel; and appropriate resolution steps are identified and documented. For any confirmed incidents, Pexgle will take appropriate steps to minimize User damage or unauthorized disclosure.
   3. If Pexgle becomes aware of unlawful access to Pexgle data stored within its Services, Pexgle will:
      1. notify the affected Users of the incident;
      2. provide a description of the steps Pexgle is taking to resolve the incident; and
      3. provide status updates to the User contact, as Pexgle deems necessary.
   4. Notification(s) of incidents, if any, will be delivered to one or more of the User’s contacts in a form Pexgle selects, which may include via email or telephone.

5. Availability Control

   1. The infrastructure providers use commercially reasonable efforts to ensure a minimum of 99.9% uptime. The providers maintain a minimum of N+1 redundancy to power, network, and HVAC services.
   2. Backup and replication strategies are designed to ensure redundancy and fail-over protections during a significant processing failure. Pexgle data is backed up to multiple durable data stores and replicated across multiple availability zones.
   3. Where feasible, production databases are designed to replicate data between no less than 1 primary and 1 secondary database. All databases are backed up and maintained using at least industry standard methods.

   Pexgle Services are designed to ensure redundancy and seamless failover. The server instances that support the Services are also architected with a goal to prevent single points of failure. This design assists Pexgle operations in maintaining and updating the Services applications and backend while limiting downtime.