DATA PROCESSING ADDENDUM
This Data Processing Addendum (“Addendum”) is an agreement between Engard Systems Ltd. (“Engard” or “Data Processor”) and you or the entity you represent (“Customer” or “Data Controller”). This Addendum supplements the Engard’s Terms of Use Agreement available at https://engard.io/terms, as updated from time to time, between Customer and Engard or other agreement between Customer and Engard governing Customer’s use of Engard’s Service (the “Agreement”).
To the extent that Engard Processes Personal Data (as defined below) on behalf of Customer in the course of the provision of its Services, this Addendum shall apply.
In consideration of the mutual obligations set out herein, the parties agree that the terms and conditions set out below shall be added as an Addendum to the Agreement. Except where the context requires otherwise, references in this Addendum to the Agreement are to the Agreement as amended, and including, this Addendum.
Definitions
In this Addendum, the following terms shall have the meanings set out below and cognate terms shall be construed accordingly:
"Applicable Laws" means (a) European Union law or any laws of a member state of the European Union in respect of which Engard or Customer is subject to; and (b) any Israeli and other applicable law in respect of which Engard or Customer is subject to;
“Authorized Users” as defined in the Agreement.
"Customer Personal Data" means any Personal Data which may be processed by Processor or a Sub-processor on behalf of Customer, pursuant to or in connection with the Agreement;
"Data Protection Legislation"
1.1.1.GDPR Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) as amended from time to time or any regulation replacing the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, and the relevant applicable data protection law.
"EU" means the European Union;
"EEA" means the European Economic Area. The GDPR applies to the European Economic Area (EEA), which includes all EU countries as well as Iceland, Liechtenstein and Norway;
"GDPR" means EU General Data Protection Regulation 2016/679;
"SCC" means the applicable model of the standard clauses for the transfer of Personal Data pursuant to the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council available at: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914&from=EN
"Services" means the services as defined in the Agreement;
"Sub-processor" means any person (excluding an employee of Engard or any of its sub-contractors) appointed by or on behalf of Engard to Process Personal Data on behalf of Customer in connection with the Agreement;
"Supervisory Authority" means (a) an independent public authority which is established by a member state of the European Union pursuant to Article 51 GDPR; and (b) any similar regulatory authority responsible for the enforcement of Data Protection Legislation;
“Authorized User” means a user of Customer which is an individual natural person, whether an employee, candidate, business partner, contractor, or agent of a Customer, who is registered or permitted by Customer to use the Services and subject to the Agreement and up to any maximum number of users or uses specified at the time of purchase according to the Agreement; and
"Term" means the term of the Agreement, as defined therein.
The terms "Controller", "Processor", "Data Subject", "Member State", "Personal Data", "Personal Data Breach", and "Processing" shall have the same meaning as in the GDPR, and their cognate terms shall be construed accordingly.
Processing of Customer Personal Data
The parties acknowledge that Customer is the Controller and shall comply with the obligations of a Controller under the GDPR and that Engard is acting in the capacity of a Processor. In some circumstances, Customer may additionally or alternatively be a Processor, in which case Customer appoints Engard as an authorised Sub-processor, which shall not change the obligations of the parties under this Addendum as Engard will remain a Processor in any such event. Customer will comply with all obligations applicable to a Controller pursuant to the Data Protection Legislation.
Engard shall process Customer Personal Data, which includes its Authorized User data, on the documented instructions of Customer, unless otherwise required by an Applicable Law to which Engard is subject. In which case, Engard shall notify Customer if, in its opinion, any instruction infringes the Data Protection Legislation or other Applicable Law, unless that law prohibits such notification. Such notification will not constitute a general obligation on the part of Engard to monitor or interpret the laws applicable to Customer, and such notification will not constitute legal advice to Customer.
Customer warrants that it has all the necessary rights to provide the Personal Data, including Personal Data of its Authorized Users, to Engard for the Processing to be performed in relation to the Services, and that one or more lawful bases set forth in the Data Protection Legislation support the lawfulness of the Processing. To the extent required by the Data Protection Legislation, Customer is responsible for ensuring that all necessary privacy notices are provided to Data Subjects, and unless another legal bases set forth in the Data Protection Legislation supports the lawfulness of the processing, that any necessary Data subject consents to the Processing are obtained, and for ensuring that a record of such consent is maintained. Should such consent be revoked by a Data Subject, Customer is responsible for communicating the fact of such revocation to Engard, and Engard will act pursuant to Customer's instructions as seems appropriate.
Annex 1 to this Addendum sets out certain information as required by Article 28(3) of the GDPR according to, Personal Data may be processed by Engard. Customer warrants it is an accurate reflection of the Processing activities pursuant to this Addendum and the Agreement. The nature of the Processing operations will depend on the scope of the Services and the nature of the Personal Data that Customer provides in its sole discretion, in a manner by which Engard finds appropriate to provide the required Services. Such Services may include the following: storage, use, combining, analysing, archiving and/or destruction.
Confidentiality
Without prejudice to any existing contractual arrangements between the parties, Engard shall ensure that any person that it authorises to Process the Personal Data on its behalf, shall be subject to a duty of confidentiality that shall survive the termination of their employment and/or contractual relationship.
Security
Taken into account the measures required by Article 32 of the GDPR, and the state of the art, the costs of implementation and nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural person, Engard shall implement appropriate technical and organizational measures to ensure a level of security of the Processing of Personal Data appropriate to the risk. Such measures may be updated by Engard from time to time, provided that such updates shall not materially decrease the protection of Personal Data for Data Subjects.
Customer acknowledges that the security requirements are constantly changing and that effective security requires frequent evaluation and regular improvements of outdated security measures. Customer will therefore evaluate the measures implemented in accordance with section 4 on an on-going basis in order to maintain compliance with the requirements set forth in this section. The parties will negotiate in good faith, the cost, if any, to implement changes required by specific updated security requirements set forth in Data Protection Legislation or by data protection authorities of competent jurisdiction.
Sub-processing
Customer authorises Engard to appoint (and permit each Sub-processor to appoint) Sub-processors in accordance with Annex 2 to this Addendum and any restrictions in the Agreement, if required to do so to provide the Services.
Engard shall notify Customer as soon as reasonably practicable of any intended changes concerning the addition or replacement of any of the Sub-Processors that will Process any Customer Personal Data ("New Sub-Processor"). If, within 14 calendar days of receipt of that notice, Customer notifies Engard in writing of any objections made on reasonable grounds, to the proposed appointment of a New Sub-Processor, the parties will endeavour to agree (acting reasonably), without undue delay, the commercially reasonable steps to be taken to ensure that the new Sub-processor is compliant with Article 28(4) of the GDPR.
In the absence of a resolution, Engard will make commercially reasonable efforts to provide Customer with the same level of Service described in the Agreement, without using the objected Sub-Processor to process Customer Personal Data.
Where the Customer reasonably argues, that the risks involved with the sub-processing activities are still unacceptable, in the context of Article 28(4) and in relation to the appropriate steps, within the requisite time frame, the parties shall promptly seek to resolve the issues. Where the parties are unable to resolve the issues within such time frame, Customer's sole remedy will be to terminate the Agreement.
With respect to each Sub-processors, Engard shall ensure that the sub-processor is bound by data protection obligations compatible with those of the Data Processor under this Addendum.
Data Subject Rights
Customer shall comply with requests received from Data Subjects to exercise their rights pursuant to Chapter III of the GDPR or Data Protection Legislation, with regard to accessing Customer Personal Data held by Customer.
When Customer is unable to perform according to section 6.1, and therefore requires Engard's assistance, while taking into account the nature of the Processing, Engard shall assist Customer, upon Customer's request and at the Customer's cost, by using appropriate technical and organisational measures, insofar as this is possible to comply with requests to exercise Data Subject rights, under the Data Protection Legislation.
Personal Data Breach
When Engard becomes aware of an incident that has a material impact on the Processing of Personal Data that is the subject to the Agreement, it shall notify Customer about the incident. Engard shall cooperate with Customer and follow Customer's instructions with regard to such incidents, to enable Customer to perform an investigation into the incident, formulate a correct response and take suitable further steps in respect to the incident.
Where the incident is reasonably likely to require a data breach notification by Customer under the Data Protection Legislation, Engard will assist Customer with the notification process.
Any notifications made by Engard to Customer, shall be addressed to the Customer. Such notifications will contain;
A description of the nature of the incident, including where possible, the categories and approximate number of Data Subjects concerned and the categories and the proximate number of Personal Data records concerned.
The name and contact details of Engard's Data Protection Officer or another contact point where more information can be obtained.
A description of the likely consequences of the incident.
A description of the measures taken or proposed to be taken by Engard to address the incident including, where appropriate, measures to mitigate its possible adverse effects.
On the basis of such notification, where applicable Customer shall notify the data breach to the competent Supervisory Authority in accordance with Article 33 of the GDPR and communicate such a breach to the Data Subject in accordance with Article 34 of the GDPR.
Engard shall, at Customer's cost, cooperate with Customer and take the reasonable commercial steps which shall reasonably be instructed by Customer, to assist in the investigation and mitigation of every occurring Personal Data Breach.
Deletion or Return of Customer Personal Data
Subject to section 8.3, Customer may in its discretion by written notice to Engard within 30 calendar days of the cessation date, require Engard to (a) return a complete copy of all Customer Personal Data to the Customer; and (b) delete all other copies of Customer's Personal Data Processed by Processor. Engard shall comply with any such written request within 60 calendar days of the cessation date.
Engard shall notify the relevant Sub-processors, Processing Personal Data on its behalf, of the termination of the Addendum.
Processor may retain Customer Personal Data to the extent and for such period as required by Applicable Laws.
Audit Rights
Subject to section 9.2 and 9.3, Engard shall make available to Customer upon a reasonable request, information which is reasonably necessary to demonstrate compliance with Article 28(3) of the GDPR.
Where applicable, if Customer is not otherwise satisfied by its audit rights pursuant to the Agreement, Engard shall, at the Customer's costs, allow for audits, including inspections, by an auditor mandated by Customer (subject to section 9.3 where auditor shall be subject to written confidentiality obligations in relation to such information) in relation to the Processing of the Customer's Personal Data by the Processor, provided that:
Customer shall give Engard a reasonable notice of any audit or inspection to be conducted; and
Customer shall take reasonable steps to ensure (and shall procure that each of its mandated auditors) to minimize disruption to the Processor’s business, in the course of such audit or inspection, while such audits or inspections shall be conducted during normal working hours.
Engard may object to an auditor mandated by Customer if the auditor is, in Engard’s opinion, not suitably qualified or independent, a competitor of Engard, or otherwise manifestly unsuitable. In the event of such an objection, Customer shall appoint another auditor or conduct the audit itself.
Transfers
Personal Data may be transferred to third party companies and individuals to facilitate the Services, who are located in a country outside of the EEA. To the extent that the provision of Services involves any such transfers of Personal Data, the parties agree that such transfers shall be made subject to the terms of the applicable EU Standard Contractual Clauses (“SCC”), as approved by the European Commission (as amended, superseded or updated from time to time), and as entered into between Customer and Engard, and as incorporated into this Addendum by reference, when the following conditions are met:
When such Personal Data is subject to data transfer restrictions under the GDPR;
When such transfer is to a country located outside the EEA which is not recognized by the European Commission as ensuring an adequate level of protection to the Processed Personal Data pursuant to Article 45 of GDPR; and
When such transfer of Personal Data is not otherwise subject to an approved transfer mechanism which provides an adequate level of protection pursuant to GDPR.
In such cases, Customer and Engard agree that the incorporation of the SCC into this Addendum shall act as a legally-binding execution of the SCC, provided that if and to the extent there is any conflict between the terms in this Addendum and the terms of the SCC, the terms of the SCC shall prevail with respect to subject matter of the SCC. If the SCC is updated by the EU authorities, and that creates any conflict between the updated SCC and the terms of this Addendum, the terms of the updated SCC prevail, and the parties shall cooperate in good faith to replace the existing SCC with the updated SCC if necessary.
In cases where Customer’s assessment or a court of competent jurisdiction or Supervisory Authority orders finds the SCC to be insufficient to guarantee a lawful transfer, Engard shall implement supplementary measures to assure that the transfer shall be lawful under the standards set forth in the GDPR.
In addition, Engard agrees to implement appropriate safeguards (including but not limited to technical and organizational measures) to transfer Personal Data outside of the EU/EEA if:
Customer considers that the parties cannot guarantee an adequate level of data protection as required under the Data Protection Legislation for the transferred Personal Data, while taking into account the circumstances the country to which Personal Data is designated to be transferred to; and
Customer notifies Engard of such lack of adequate level of data protection.
To the extent that Engard or Customer are relying on a specific statutory mechanism to normalize international data transfers and that mechanism is subsequently modified, revoked, or held in a court of a competent jurisdiction to be invalid, Engard or Customer agree to cooperate in good faith to promptly suspend the transfer or to pursue a suitable alternate mechanism that can lawfully support the transfer.
General Terms
Liability and Indemnity
Customer shall indemnify Engard and will hold Engard harmless against all claims, losses, damages and expenses incurred by Engard arising out of a breach of this Addendum and/or the Data Protection Legislation by Customer.
Order of Precedence
With regard to the subject matter of this Addendum, in the event of inconsistencies between the provisions of this Addendum and any other agreements between the parties, including the Agreement, the provisions of this Addendum shall prevail.
Changes in Data Protection Legislation
If any variation is required to this Addendum as a result of a change in Data Protection Legislation, then either party may provide written notice to the other party of that change of law. The parties shall discuss the change in Data Protection Legislation and negotiate in good faith with a view to agreeing on any necessary variations to this Addendum to address such changes, including any resulting charges.
Governing Law and Jurisdiction
This Addendum is governed by the laws of the state of Israel. Any disputes arising from or in connection with this Addendum, shall be brought exclusively before the competent court of Tel Aviv, Israel, to the exclusion of any other jurisdiction.
Severance
Should any provision of this Addendum be invalid or unenforceable, then the remainder of this Addendum shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, while preserving the parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.
ANNEX 1: DETAILS OF PROCESSING OF CUSTOMER PERSONAL DATA
This Annex 1 includes certain details of the Processing of Customer Personal Data as required by Article 28(3) GDPR.
Subject Matter and Duration of the Processing of Customer's Personal Data
The subject matter and duration of the Processing of the Customer Personal Data are set out in the Agreement and this Addendum.
The nature and purpose of the Processing of Customer's Personal Data
Engard provides a SaaS platform that enables the prediction, analysis, prevention, and evaluation of a potential destructive behavior at the workplace conducted by the employees, candidates, etc. (“Platform”). With psychological tools backed by AI, Engard accurately predicts threats and provides actionable tools to mitigate the risk. The provision of the Platform requires the Processing of Personal Data of Authorized Users, such as Customer’s employees or job candidates, who are selected by the Customer, and agree to perform the assessment maintained by the Platform.
Special Categories of Personal Data to be Processed [i.e. g racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation]
The special categories of Personal Data which are processed: philosophical beliefs.
The Categories of Data Subject to whom the Customer's Personal Data Relates
The categories of Data Subject are the Authorized Users, such as employees, candidates, business partners, contractors, or agents of the Customer.
The Obligations and Rights of Customer and Customer Affiliates
The obligations and rights of Customer are set out in the Agreement and this Addendum.
ANNEX 2: LIST OF SUB-PROCESSORS
