Compliant with EU GDPR
This Data Processing Agreement (“DPA”) reflects the parties’ agreement with respect to the terms governing the processing of Personal Data under DB-IP’s Terms of Service (the “TOS”). This DPA is an amendment to the TOS and is effective upon its incorporation into the TOS, which incorporation may be specified in an Order or an executed amendment to the TOS. Upon its incorporation into the TOS, the DPA will form a part of the TOS.
In this agreement:
This agreement shall apply to:
in relation to the Services.
In order to execute the Agreement, and in particular to perform the Services on behalf of Customer, Customer authorizes and requests that DB-IP Process the following information that may contain Digital Personal Data:
Services Data : data that resides on DB-IP server infrastructure
DB-IP processes Customer information according to the terms of its Privacy policy, and treats services data as confidential in accordance with the terms of your order for services.
Categories of Data Subjects: Data subjects may include Customer’s end users, such as partners, and customers of the Customer. Data subjects also may include individuals attempting to communicate or transfer Personal Data to users of the Services.
DB-IP shall Process Personal Data solely for the provision of the Services, and agrees to :
The Service Customer, as Data controller, must accept responsibility for abiding by the applicable data protection legislation. Notably, the Customer has an obligation to assess the lawfulness of the processing of personal data stored on the Platform.
The Customer agrees that it shall ensure compliance at all times with the applicable data protection law, and, in particular, the Customer shall ensure that any disclosure of Personal Data made by it to DB-IP is made with the data subject's consent or is otherwise lawful. The control of Personal Data remains with the Customer, and as between the Customer and DB-IP, the Customer will at all times remain the Data controller for the purposes of the Services, the TOS, and this Data Processing Agreement. The Customer is responsible for compliance with its obligations as Data controller under the applicable data protection Law, in particular for justification of any transmission of Personal Data to DB-IP (including providing any required notices and obtaining any required consents), and for its decisions concerning the Processing and use of the data.
DB-IP shall pass on to the Customer any requests of an individual data subject to delete, release, correct or block Personal Data Processed under the Agreement.
DB-IP treats all Personal Data in a manner consistent with the requirements of the applicable data protection Law and this Data Processing Agreement in all locations globally.
Payment Gateway: Stripe’s services in Europe are provided by a Stripe affiliate—Stripe Payments Europe Limited (“Stripe Payments Europe”)—an entity located in Ireland and subject to European law. In providing Stripe Services, Stripe Payments Europe transfers personal data to Stripe, Inc. in the US. To ensure the adequate protection of personal data, Stripe uses the European Commission’s Standard Contractual Clauses (“Model Clauses”) to allow for the lawful transfer of such data under the EU Data Directive. These Model Clauses cover all transfers of EU personal data between Stripe Payments Europe and Stripe, Inc., including user data and end-customer cardholder data. To learn more about the Stripe data transfers or to request a copy of their Model Clauses, please contact them at [email protected].
Backup Storage:
OVH France backup storage services are provided to DB-IP and located in France. To learn more about OVH’s Privacy Policy, please contact them by mail [email protected] or at :
OVH Siège social :
2 rue Kellermann
59100 Roubaix – France
With respect to Personal Data stored by DB-IP in data centers in the EEA shall ensure compliance its Subprocessors with the requirements of the applicable data protection law as follows:
DB-IP shall not subcontract any of its processing operations performed on behalf of the Customer under the Agreement and the TOS without the prior written consent of the Customer.
Where DB-IP subcontracts its obligations under the Agreement, with the consent of the Customer, it shall do so only by way of a written agreement with the subprocessor which imposes the same obligations on the subprocessor as are imposed on DB-IP under the Agreement. Where the subprocessor fails to fulfil its data protection obligations under such written agreement DB-IP shall remain fully liable to the Customer for the performance of the subprocessor’s obligations under such agreement.
The Customer as Data controller may request that DB-IP audit the Subprocessor or provide confirmation that such an audit has occurred (or, where available, obtain or assist Data Controller in obtaining a third-party audit report concerning Subprocessor’s operations) to ensure compliance with such obligations. The Controller also will be entitled, upon written request, to receive copies of the relevant terms of DB-IP’s agreement with Subprocessors that may process Personal Data, unless the agreement contains confidential information, in which case the DB-IP may provide a redacted version of the agreement.
The provisions relating to data protection aspects for subprocessing of the contract referred to in paragraph 1 shall be governed by the law of the Member State in which the Customer is established.
When Processing Personal Data on behalf of Customer in connection with the Services, DB-IP shall ensure that it implements and maintains compliance with appropriate technical and organizational security measures for the Processing of such data. Accordingly, DB-IP will implement the following measures:
a) To prevent unauthorized persons from gaining access to data processing systems in which Personal Data are Processed (physical access control), DB-IP shall take measures to prevent physical access.
b) To prevent data processing systems from being used without authorization (system access control), the following may, among other controls, be applied depending upon the particular Services ordered: authentication via passwords and logging of access on several levels.
c) To ensure that persons entitled to use a data processing system only have access to the Personal Data to which they have privilege of access, and that Personal Data cannot be read, copied, modified or removed without authorization in the course of Processing and/or after storage (data access control), Personal Data is accessible and manageable only by properly authorized staff, direct database query access is restricted, and application access rights are established and enforced.
d) To ensure that Personal Data cannot be read, copied, modified or removed without authorization during electronic transmission or transport, and that it is possible to check and establish to which entities the transfer of Personal Data by means of data transmission facilities is envisaged (transmission control), DB-IP will comply with the following requirements: Transfers of data outside the Service environment are encrypted (HTTPS). The content of communications (including sender and recipient addresses) sent through some email or messaging services may not be encrypted once received through such services. Data Controller is solely responsible for the results of its decision to use non-encrypted communications or transmissions.
e) To ensure that Personal Data is protected against accidental destruction or loss: back- ups are taken on a regular basis.
The Customer may audit DB-IP’s compliance with the terms of the Agreement and this Data Processing Agreement up to once per year.
The Customer may perform more frequent audits of the Service computer systems that Process Personal Data to the extent required by laws applicable to the Customer. If a third party is to conduct the audit, the third party must be mutually agreed to by both parties and must execute a written confidentiality agreement acceptable to DB-IP before conducting the audit.
To request an audit, the Customer must submit a detailed audit plan at least 4 weeks in advance of the proposed audit date describing the proposed scope, duration, and start date of the audit. DB-IP will review the audit plan and provide Data Controller with any concerns or questions (for example, any request for information that could compromise DB-IP’s security, privacy, or employment policies).
The audit reports are Confidential Information of the parties under the terms of the Agreement. Any audits are at the Data Controller's expense.
Any request for DB-IP to provide assistance with an audit is considered a separate service if such audit assistance requires the use of different or additional resources. DB-IP will seek the Data Controller's written approval and agreement to pay any related fees before performing such audit assistance.
DB-IP evaluates and responds to incidents that create suspicion of unauthorized access to or handling of Personal Data.
The Customer is informed of such incidents and, depending on the nature of the activity, defines escalation paths and response teams to address those incidents. DB-IP will work with the Customer, with the appropriate technical teams and, where necessary, with outside law enforcement to respond to the incident. The goal of the incident response will be to restore the confidentiality, integrity, and availability of the Services environment, and to establish root causes and remediation steps.
DB-IP operations staff is instructed on responding to incidents where handling of personal data may have been unauthorized.
DB-IP shall notify the Customer without undue delay after becoming aware of a personal data breach. DB-IP shall promptly investigate any security breach and take reasonable measures to identify its root cause(s) and prevent a recurrence. As information is collected or otherwise becomes available, unless prohibited by law, DB-IP will provide Data Controller with a description of the security breach, the type of data that was the subject of the breach, and other information Data Controller may reasonably request concerning the affected persons. The parties agree to coordinate in good faith on developing the content of any related public statements or any required notices for the affected persons.
Except as otherwise required by law, DB-IP will promptly notify the Customer of any subpoena, judicial, administrative or arbitral order of an executive or administrative agency or other governmental authority (“demand”) that it receives and which relates to the Personal Data DB-IP is Processing on Customer’s behalf. At Customer’s request, DB-IP will provide reasonable information in its possession that may be responsive to the demand and any assistance reasonably required for the Customer to respond to the demand in a timely manner. The Customer acknowledges that DB-IP has no responsibility to interact directly with the entity making the demand.
The parties agree that on the termination of the provision of data processing services, DB-IP warrants that it will guarantee the confidentiality of the personal data transferred and will not actively process the personal data transferred anymore.