Version 2.0 de l'ADP
DATA PROCESSING AGREEMENT
This Data Processing Agreement (“DPA”) may be incorporated by reference into a Software as a Service Agreement (the “SSA”) between Awardco, Inc. (“Processor”) and a customer of Awardco (such customer and, to the extent required under Applicable Data Protection Laws, its Authorized Affiliates, collectively “Controller”). Processor and Controller may be referred to collectively as the “Parties” and each individually as a “Party”. All capitalized terms contained but not defined in this DPA have the meaning given to them in the SSA.
Processor provides certain Awardco Services to Controller pursuant to the SSA, and in the course of providing such Awardco Services Processor may Process Personal Data on behalf of Controller. To ensure adequate safeguards with respect to the Processing of Personal Data provided by Controller to Processor, the Parties agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.
1. DEFINITIONS
"Applicable Data Protection Laws” means all applicable laws, regulations, regulatory guidance, or requirements in any jurisdiction relating to data protection, privacy, or confidentiality of Personal Data including but not limited to (a) the GDPR together with any transposing, implementing or supplemental legislation, and (b) the CCPA.
“Authorized Affiliate” means any of Controller’s Affiliates which (a) are subject to Applicable Data Protection Laws, and (b) are permitted to use Processor for Processing pursuant to the SSA.
“CCPA” means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., and its implementing
regulations, as amended from time to time.
“Controller” means the entity which determines the purposes and means of the Processing of Personal Data. For the avoidance of doubt, the Party identified as “Controller” above is the Controller under this DPA.
“Data Breach” means a breach of security leading to the accidental, unauthorized, or unlawful destruction, loss, alteration, disclosure of, access to, or other Processing of Personal Data transmitted, stored, or otherwise Processed.
“Data Protection Authority” means any representative or agent of a government entity or agency who has the authority to enforce Applicable Data Protection Laws.
“Data Subject” means a natural person to whom Personal Data relates.
“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
“Personal Data” means any information that is considered “personal information,” “personal data,” or “personally identifiable information,” or any functional equivalent of these terms under any applicable laws relating to data privacy, data protection, or cybersecurity.
“Process” shall mean any operation or set of operations which is performed upon Personal Data by the or in connection with and for the purposes of the provision of the Awardco Services, whether or not accomplished by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; and as otherwise defined by Applicable Data Protection Laws. 2 ACO260501.Proc
“Processor” means the entity which Processes Personal Data on behalf of Controller. For the avoidance of doubt, the Party identified as “Processor” above is the Processor under this DPA.
“Service Provider” means a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that process information on behalf of a Data Controller and to which the Data Controller discloses a Data Subject’s Personal Data for a Business Purpose pursuant to a written contract, provided that the contract prohibits the Service Provider from retaining, using, or disclosing the Personal Data for any purpose other than for the specific purpose of performing the services specified in the contract, or as otherwise permitted by the CCPA, including retaining, using, or disclosing the Personal Data for a Commercial Purpose other than providing the services specified in the contract with the Data Controller. The terms “Business Purpose” and “Commercial Purpose” have the same meaning as those terms are used in the CCPA. For the avoidance of doubt, Processor is a Service Provider.
“Sub-processor” means any entity which Processes Personal Data on behalf of Processor.
2. PROCESSING OF PERSONAL DATA
2.1 Roles of the Parties. The parties acknowledge and agree that with respect to the Processing of Personal Data, customer is the Controller and Awardco, Inc. is the Processor or Service Provider. The subject matter, duration, purpose of the Processing, and the types of Personal Data and categories of Data Subjects Processed under this DPA are further specified in Schedule 1 below.
2.2 Controller’s Obligations. Controller’s instructions for the Processing of Personal Data shall comply with Applicable Data Protection Laws. Controller shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Controller acquires Personal Data and provides it to Processor.
2.3 Processor’s Obligations. All Personal Data Processed by Processor pursuant to the SSA is Confidential Information and Processor will Process Personal Data only in accordance with Controller’s documented instructions
set forth in Schedule 1 or as otherwise provided by Controller in writing. Processor will not sell the Personal Data Processed under this DPA and will not retain, use, or disclose Personal Data outside of the direct business relationship between Processor and Controller. Processor shall comply with all Applicable Data Protection Laws with regard to Processing Personal Data. Processor will not combine Personal Data provided by Controller with Personal Data that it receives from other sources. In the event Processor believes that compliance with any instructions by Controller would result in a violation of any Applicable Data Protection Law, Processor shall notify Controller thereof in writing without delay. Processor shall make available to Controller all information necessary to demonstrate Processor’s compliance with its obligations under this DPA.
2.4 Assistance Requirements. Processor shall assist Controller with the following: compliance with Applicable Data Protection Laws when required by Applicable Data Protection Laws; suspected and relevant Data Breaches; notifications to, or inquiries from a Data Protection Authority; notifications to, and inquiries from, Data Subjects; and Controller’s obligation to carry out data protection impact assessments and prior consultations with a Data Protection Authority.
3. NOTIFICATION OBLIGATIONS
3.1 Processor’s Notification Obligations. Processor shall immediately notify Controller, in writing, of the following:
3.1.1 A Data Subject’s request to exercise their privacy rights such as accessing, rectifying, erasing, transporting, objecting to, or restricting their Personal Data;
3.1.2 Any request or complaint received from Controller’s customers or employees;
3.1.3 Any question, complaint, investigation, or other inquiry from a Data Protection Authority;
3.1.4 Any request for disclosure of Personal Data that is related in any way to Processor’s Processing of Personal Data under this DPA;
3.1.5 A Data Breach pursuant to the notification obligations set forth in Section 7.1; and
3.1.6 Where the Personal Data becomes subject to search a seizure, an attachment order, confiscation during bankruptcy or insolvency proceedings, or similar events or measures by third parties while being Processed.
Processor will assist Controller in fulfilling Controller’s obligations to respond to requests relating to Sections 3.1.1 through 3.1.6 above and will not respond to such requests without Controller’s prior written consent unless Processor is required to respond by applicable law.
4. CONFIDENTIALITY
4.1 Renseignements confidentiels. Toutes les données personnelles fournies au responsable du traitement en vertu de l'entente de services (SSA) constituent des renseignements confidentiels.
4.2 Processor’s Personnel. Processor shall ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities, and have executed written confidentiality agreements, and further that such confidentiality obligations survive the termination of their respective employment relationship with such individuals.
4.3 Limitation of Access. Processor shall ensure that Processor’s access to Personal Data is limited to those personnel performing the Awardco Services in accordance with the SSA.
5. SOUS-TRAITANTS
5.1 Nomination de sous-traitants. Le responsable du contrôle reconnaît et accepte que le responsable du traitement et ses sociétés affiliées puissent engager des sous-traitants tiers dans le cadre de la prestation des services Awardco. Le responsable du traitement ou sa société affiliée doit conclure avec chaque sous-traitant une entente écrite contenant des obligations en matière de protection des données au moins aussi protectrices que celles prévues dans la présente entente de traitement des données (DPA), dans la mesure où elles s'appliquent à la nature des services fournis par ledit sous-traitant.
5.2 Notification of Changes to Sub-processors. Processor will notify Controller in writing of any intended changes concerning the addition or replacement of Sub-processors at least thirty (30) days prior to its use of such new Sub-processor.
5.3 Droit d'opposition aux nouveaux sous-traitants. Le responsable du contrôle peut s'opposer à l'utilisation d'un nouveau sous-traitant par le responsable du traitement en l'en avisant rapidement par écrit dans les quatorze (14) jours suivant la réception de l'avis du responsable du traitement en vertu de la section 5.2. Si le responsable du contrôle s'oppose à un nouveau sous-traitant, le responsable du traitement déploiera des efforts raisonnables pour proposer au responsable du contrôle une modification des services Awardco afin d'éviter le traitement des données personnelles par le nouveau sous-traitant contesté. Si le responsable du traitement n'est pas en mesure d'offrir une telle modification, le responsable du contrôle peut résilier la SSA en ce qui concerne les services Awardco qui ne peuvent être fournis par le responsable du traitement sans l'utilisation du nouveau sous-traitant contesté.
5.4 Responsabilité pour les actes des sous-traitants. Le responsable du traitement est responsable des actes et omissions de ses sous-traitants dans la même mesure que si le responsable du traitement effectuait lui-même les services de chaque sous-traitant en vertu des modalités de la présente DPA.
6. SÉCURITÉ
6.1 Protection of Personal Data. Processor shall maintain appropriate technical and organizational measures for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to, Personal Data), confidentiality and integrity of Personal Data taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.
6.2 Audit Rights. Controller, or Controller’s designee, has the right to audit and inspect, at Controller’s sole cost and expense, Processor’s premises, policies, procedures, and computer systems to make sure Processor complies with the requirements in this DPA. Such audit and inspection shall be commercially reasonable in scope and nature and will be subject to Processor’s confidentiality obligations with Processor’s other clients. Controller, or Controller’s designee, will provide at least 72 hours written notice before conducting an audit, unless, under applicable law, such audit is required due to a Data Breach involving Processor.
7. VIOLATIONS DE DONNÉES
7.1 Data Breach Notification. Processor shall notify Controller in writing without undue delay after becoming aware of a Data Breach.
7.2 Data Breach Management. Processor shall make reasonable efforts to identify the cause of such Data Breach and take those steps as Processor deems necessary and reasonable to remediate the cause of such a Data Breach to the extent the remediation is within Processors reasonable control.
8. RÉSILIATION
8.1 Termination. This DPA shall terminate automatically upon the later of (a) the termination or expiration of the SSA, or (b) Processor’s deletion or return of Personal Data. Controller shall further be entitled to terminate this DPA for cause if Processor is in material or persistent breach of this DPA which, in the case of a breach capable of remedy, shall not have been remedied within thirty (30) days from the date of receipt by Processor of a notice from Controller identifying the breach and requesting its remedy.
8.2 Return or Deletion of Data. Upon termination of this DPA, Processor will delete or return all existing copies of Personal Data unless applicable law requires continued retention of the Personal Data. Upon the request of Controller, Processor shall confirm compliance with such obligations in writing and delete all existing copies. In instances where applicable law requires Processor to retain Personal Data, Processor will protect the confidentiality, integrity, and accessibility of the Personal Data; will not actively Process the Personal Data; and will continue to comply with the terms of this DPA.
9. MÉCANISMES DE TRANSFERTS INTERNATIONAUX
9.1 Transferts hors de l'UE/du Royaume-Uni/de la Suisse vers un pays bénéficiant d'une décision d'adéquation. Le responsable du traitement s'appuie sur une décision d'adéquation pour transférer des données personnelles lorsqu'une telle décision a été accordée en vertu des lois applicables sur la protection des données. Pour éviter toute ambiguïté, si le responsable du traitement est certifié dans le cadre du programme du Cadre de protection des données (DPF), accordé par la décision d'exécution de la Commission du 10 juillet 2023 sur le niveau adéquat de protection des données personnelles en vertu du Cadre de protection des données UE-États-Unis, ainsi que l'extension britannique au Cadre de protection des données UE-États-Unis et le Cadre de protection des données Suisse-États-Unis (collectivement, le « DPF »), le DPF s'applique et remplace le ou les mécanismes de transfert applicables énoncés à la section 9.2 de la présente DPA en tant que mécanisme de transfert valide pour les données personnelles transférées aux États-Unis.
9.2 Transferts hors de l'UE/du Royaume-Uni/de la Suisse vers un pays ne bénéficiant pas d'une décision d'adéquation. Lors de la prestation des services Awardco, il peut être nécessaire pour le responsable du contrôle de transférer des données personnelles de l'Union européenne, de l'Espace économique européen et/ou de leurs États membres, du Royaume-Uni ou de la Suisse vers le responsable du traitement dans un pays qui ne bénéficie pas d'une décision d'adéquation ou qui n'est pas situé dans l'Espace économique européen. En cas d'un tel transfert, les clauses contractuelles types s'appliquent comme suit :
9.2.1. En ce qui concerne les données personnelles soumises au RGPD : (i) le responsable du traitement sera considéré comme l'« importateur de données » et le responsable du contrôle comme l'« exportateur de données » ; (ii) les modalités du module deux s'appliquent lorsque le responsable du contrôle est un responsable du traitement et que le responsable du traitement est un sous-traitant ; (iii) à la clause 7, la clause d'adhésion facultative est supprimée ; (iv) à la clause 9 du module deux, l'option 2 s'applique et
la liste des sous-traitants et le délai de préavis pour les changements seront tels que convenus à la section 5 de la présente DPA ; (v) à la clause 11, le libellé facultatif est supprimé ; (vi) à la clause 17, l'option 1 s'applique et les clauses contractuelles types sont régies par l'État membre où le responsable du contrôle est domicilié ; (vii) à la clause 18(b), les litiges seront résolus devant les tribunaux de l'État membre où le responsable du contrôle est domicilié ; (viii) les annexes I et II seront réputées complétées par les informations énoncées à l'annexe 1 de la présente DPA, respectivement ; et (ix) si et dans la mesure où les clauses contractuelles types entrent en conflit avec une disposition de la SSA (y compris la présente DPA), les clauses contractuelles types prévalent dans la mesure de ce conflit. Pour cette section, les clauses contractuelles types issues de la décision d'exécution (UE) 2021/914 de la Commission sont incorporées par référence et disponibles ici : https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en.
9.2.2. En ce qui concerne les données personnelles soumises aux lois britanniques sur la protection des données, l'Accord de transfert international de données (« IDTA ») s'applique avec les modifications suivantes : (i) les coordonnées des parties à la SSA sont les coordonnées pour l'IDTA ; (ii) le responsable du contrôle est l'exportateur de données et le responsable du traitement est l'importateur de données ; (iii) les lois qui régissent l'IDTA et le lieu où les réclamations juridiques peuvent être déposées sont l'Angleterre et le Pays de Galles ; (iv) le RGPD britannique ne s'applique pas au traitement des données transférées par l'importateur de données ; (v) les parties n'utilisent pas les clauses de sécurité ou commerciales supplémentaires de l'IDTA ; et (vi) les informations contenues dans la présente DPA et l'annexe 1 peuvent être utilisées pour les tableaux 1 à 4. Les clauses obligatoires de la partie 4 de l'IDTA approuvé, soit le modèle IDTA A.1.0 émis par l'ICO et déposé devant le Parlement conformément à l'article 119A de la Loi sur la protection des données de 2018 le 2 février 2022, tel que révisé en vertu de la section 5.4 de ces clauses obligatoires, sont incorporées par référence et disponibles ici : https://ico.org.uk/media2/migrated/4019538/international-data-transfer-agreement.pdf
9.2.3. En ce qui concerne les données personnelles soumises à la LPD suisse, les clauses contractuelles types mentionnées à la section 9.1.1 s'appliquent avec les modifications suivantes : (i) les références au « Règlement (UE) 2016/679 » sont interprétées comme des références à la LPD suisse ; (ii) les références à l'« UE », à l'« Union » et au « droit des États membres » sont interprétées comme des références au droit suisse ; et (iii) les références à l'« autorité de contrôle compétente » et aux « tribunaux compétents » sont remplacées par le « Préposé fédéral à la protection des données et à la transparence » et les « tribunaux compétents en Suisse ».
9.3. Autres mécanismes de transfert de données. Les parties reconnaissent que les lois, règles et règlements relatifs aux transferts internationaux de données évoluent rapidement. Dans le cas où le responsable du contrôle adopterait un autre mécanisme autorisé par les lois, règles ou règlements applicables pour transférer des données personnelles (chacun étant un « autre mécanisme de transfert de données »), les parties conviennent de collaborer de bonne foi pour mettre en œuvre toute modification de la présente DPA nécessaire à l'application de cet autre mécanisme de transfert de données.
10. DISPOSITIONS DIVERSES
10.1. Amendments. This DPA may not be amended or supplemented, nor shall any of its provisions be deemed to be waived or otherwise modified, except through a writing duly executed by authorized representatives of both Parties.
10.2 Governing Law. This DPA shall be governed by the governing law set forth in the SSA.
[LES ANNEXES 1 ET 2 SUIVENT]
ANNEXE 1
Description of Processing
Contact Information
Pour le responsable du traitement : Awardco, Inc., 2080 W 400 N, Lindon, UT 84042, à l'attention du : Délégué à la protection des données ; privacy@awardco.com
Pour le responsable du contrôle : la personne, l'adresse et l'adresse courriel indiquées dans le formulaire de commande applicable en vertu de la SSA.
Subject-Matter
The subject matter of Processing is the Awardco Services pursuant to the SSA.
Duration
The duration of Processing is as set forth in the SSA.
Étendue, type et finalité du traitement
L'étendue, le type et la finalité du traitement sont tels qu'énoncés dans la SSA.
Frequency of Transfer
The frequency of transfer is continuous.
Data Subjects
Le traitement des données personnelles peut concerner les employés du responsable du contrôle.
Sub-processor Transfers
The following table lists the Sub-processors that will receive Personal Data, the subject matter for those transfers, how that information will be processed, and the duration of processing:
Categories of Data
The Personal Data Processed may concern the following categories of data:
● Identifying Information
● Social and Contact Information
● Tracking Data
Technical and Organizational Measures to Secure Data
Set forth in Schedule 2
SCHEDULE 2
Awardco Technical and Organizational Measures to Secure Data
Technical Security Measures
- Endpoint protection, anti-malware, and EDR on all machines. Awardco deploys anti-virus, endpoint protection, and endpoint detection and response technologies across company-managed machines, with security tooling configured to remain current and active.
- All endpoints are encrypted. Endpoints are protected with full-disk encryption to help safeguard data stored on company-issued devices.
- Identity and Access Management (IAM). Awardco uses an Identity and Access Management system to manage the identity and assign appropriate permission sets for each employee.
- MFA and SSO are required to log into Awardco systems. Combined with the Identity and Access Management System, access to company systems is protected through strong authentication controls, including single sign-on and multi-factor authentication, to reduce the risk of unauthorized access.
- Awardco enforces strict password requirements. Users must create long, complex passwords, and accounts are locked after five failed login attempts. Awardco also prevents the reuse of the previous five passwords and restricts the use of common passwords
- All corporate endpoints are managed with the capability to wipe the machines. Company-issued devices are centrally managed and can be remotely wiped when necessary to protect data in the event of loss, theft, or device retirement.
- No employees have admin access to their machines. Employee admin access is restricted and managed through technical controls.
- Awardco production environment utilizes several next gen firewalls, a web application firewall (WAF), and load balancers to allow approved traffic only into the environment. The production environment is protected by layered network security controls, including a WAF, designed to restrict inbound and outbound traffic to approved and authorized connections only. Additionally, the WAF targets the OWASP vulnerabilities.
- Corporate, development, and production environments are all segmented and cannot access each other. Awardco maintains segregated environments to reduce the risk of unauthorized access, cross-environment exposure, and unapproved changes reaching production.
- All data at rest is encrypted using AES-256. Data at rest is encrypted using AES-256 to help protect sensitive information stored in production systems.
- All data in transit is encrypted using TLS 1.3. Data transmitted between customer and processor networks is encrypted using TLS 1.3 to protect information in transit between users, systems, and services.
- Awardco backs up data within industry standard methodology. Production data is backed up frequently and replicated in a manner intended to support availability, resiliency, and recovery.
- Awardco has a DR site that is ready to take traffic at any moment should the need arise. Awardco maintains disaster recovery capabilities designed to support service continuity and recovery in the event of a disruption.
- Awardco utilizes a SOC and SIEM to monitor the environment 24/7. Security monitoring is performed on a continuous basis through security operation functions and SIEM capabilities to support the detection, investigation, and response to suspicious or malicious activity. Additionally, Awardco leverages Microsoft Azure security toolsets to enhance its overall security monitoring posture.
- Awardco uses DLP controls to help prevent private data from being moved, copied, or stolen. Data loss prevention controls are used to help detect and prevent unauthorized movement, copying, or exfiltration of sensitive data.
- Awardco maintains a formal vulnerability management program. Vulnerabilities are regularly identified, prioritized based on risk, and tracked through remediation to reduce exposure to known security weaknesses.
- Awardco maintains a patch management process for systems and endpoints. Security patches are evaluated and deployed according to defined timelines and risk-based requirements to reduce exposure to known vulnerabilities.
- Awardco uses formal change management procedures for production systems. Changes to applications, infrastructure, and supporting systems are reviewed, tested, approved, and tracked before deployment to production.
- Awardco logs and monitors system and administrative access. Access to key systems and services is logged and monitored to support security oversight, investigation, and auditability. This function is executed via the SIEM platform as part of centralized security monitoring and event correlation.
Organizational Measures
- Awardco Information Security Management System (ISMS). Awardco maintains a formal ISMS program that documents and governs all facets of its information security processes. This program provides a structured framework for security policies, risk management, access control, incident response, and change management, and is regularly reviewed and updated to support continuous improvement and regulatory and contractual compliance.
- Awardco Governance, Risk, and Compliance (GRC) Program. Awardco operates a dedicated Governance, Risk, and Compliance (GRC) program responsible for designing, maintaining, and continuously improving a mature information security and compliance program. This program is independently validated through SOC 2 Type II, ISO 27001, and Cyber Essentials / Cyber Essentials Plus certifications and applicable privacy and security obligations. The GRC function also owns Awardco’s AI governance committee, ensuring AI use cases are inventoried, risk-assessed, and approved. Foundational controls are organized and mapped against key regulatory and industry frameworks, including HIPAA, GDPR, CCPA/CPRA, and relevant NIST guidance, to support a risk-based control framework, strong governance, and consistent, auditable execution of security and privacy requirements.
- Only select authorized individuals have access to the production environment. Access to the production environment is limited to authorized personnel whose job responsibilities require that level of access.
- Awardco uses role-based access with least privilege. Access is provisioned on a role-based model and restricted to the minimum privileges required to perform defined job functions.
- Awardco maintains a comprehensive security and privacy awareness program for all personnel. All employees complete mandatory, annually recurring security and privacy training covering core domains such as secure data handling, phishing and social engineering, and individual security obligations. The same curriculum is assigned to all new hires during onboarding to establish and maintain a consistent, organization-wide baseline of security and privacy awareness.
- Awardco maintains a formal incident response program. Awardco maintains incident response procedures and escalation processes to support timely identification, containment, response, and recovery from security incidents.
- Awardco maintains a formal risk management process. Risk assessments are performed, and identified risks are evaluated, tracked, and addressed through appropriate mitigation measures.
- Vendor and Third-Party Risk Management program. Awardco maintains a vendor and third-party risk management program that vets critical providers before onboarding, enforces appropriate security and privacy obligations in contracts, and continuously monitors key vendors and supply-chain dependencies as part of its broader risk and continuity planning.
- Policies and procedures are written and accessible to all employees. Security and operational policies and procedures are formally documented and centrally published to employees to promote control awareness, standardized implementation, and consistent, repeatable execution across the organization.