{"id":245427,"date":"2021-03-12T12:19:35","date_gmt":"2021-03-12T00:19:35","guid":{"rendered":"https:\/\/www.reckon.com\/au\/?page_id=245427"},"modified":"2021-07-02T12:31:57","modified_gmt":"2021-07-02T00:31:57","slug":"data-processing-addendum","status":"publish","type":"page","link":"https:\/\/www.reckon.com\/au\/policies\/data-processing-addendum\/","title":{"rendered":"Policies – APS – Data Processing Addendum"},"content":{"rendered":"

[et_pb_section fb_built=”1″ admin_label=”Header” module_id=”header-plain” _builder_version=”4.4.8″][et_pb_row _builder_version=”4.4.3″][et_pb_column type=”4_4″ _builder_version=”4.0.4″ custom_padding=”0px||||false|false”][et_pb_text content_tablet=”<\/p>\n

Anti-Piracy Policy<\/h1>\n

” content_phone=”<\/p>\n

Anti-Piracy Policy<\/h1>\n

” content_last_edited=”off|desktop” admin_label=”Add title here” _builder_version=”4.9.0″]<\/p>\n

APS Data Processing Addendum<\/h1>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=”1″ _builder_version=”4.4.2″][et_pb_row _builder_version=”4.4.2″][et_pb_column type=”4_4″ _builder_version=”4.4.2″][et_pb_text admin_label=”Copy paste body text here” _builder_version=”4.9.4″]<\/p>\n

This Data Processing Addendum (Addendum<\/strong>) forms part of the Terms and is entered into between you (the Company<\/strong>) and the Reckon entity set out in the Order Form (us<\/strong> and we<\/strong> as applicable), together the Parties<\/strong> and each a Party<\/strong>.<\/p>\n

1. Definitions<\/strong><\/p>\n

1.1\u00a0 In this Addendum, the following terms shall have the meanings set out below and cognate terms shall be construed accordingly:<\/p>\n

(a)\u00a0 \u00a0Applicable Laws<\/strong> means (a) any Data Protection Laws applying to the Processing of any Company Personal Data ; and (b) any other law applicable to a Party;<\/p>\n

(b)\u00a0 \u00a0Company Personal Data<\/strong> means any Personal Data Processed by a Contracted Processor on your behalf including any Personal Data of your customers, employees or contractors (Users<\/strong>) pursuant to, or in connection with the Addendum;<\/p>\n

(c)\u00a0 \u00a0Contracted Processor<\/strong> means us and\/or a Subprocessor;<\/p>\n

(d)\u00a0 \u00a0Customer Agreement <\/strong>means the services agreement entered into between us and the Company for the Services (referred to as the Terms in the relevant Order);<\/p>\n

(e)\u00a0 \u00a0Data Protection Laws<\/strong> means EU Data Protection Laws and, to the extent applicable, the data protection or privacy laws of any other country;<\/p>\n

(f)\u00a0 \u00a0EEA<\/strong> means the European Economic Area;<\/p>\n

(g)\u00a0 \u00a0EU Data Protection Laws<\/strong> means EU Directive 95\/46\/EC, as transposed into domestic legislation of each Member State and as amended, replaced or superseded from time to time, including by the GDPR and laws implementing or supplementing the GDPR;<\/p>\n

(h)\u00a0 \u00a0GDPR<\/strong> means EU General Data Protection Regulation 2016\/679;<\/p>\n

(i)\u00a0 \u00a0Restricted Transfer <\/strong>means a transfer of Company Personal Data where such transfer would be prohibited by EU Data Protection Laws (or by the terms of data transfer agreements put in place to address the data transfer restrictions of Data Protection Laws) in the absence of the Standard Contractual Clauses or another lawful data transfer mechanism as set out at clause 7<\/p>\n

(j)\u00a0 \u00a0Services<\/strong> means the services and other activities to be supplied to or carried out for you by us, or on behalf of us, pursuant to the Addendum;<\/p>\n

(k)\u00a0 \u00a0Standard<\/strong> Contractual Clauses<\/strong> means the contractual clauses set out by the European Commission available at https:\/\/ec.europa.eu\/info\/law\/law-topic\/data-protection\/data-transfers-outside-eu\/model-contracts-transfer-personal-data-third-countries<\/a>, as updated or replaced from time to time;<\/p>\n

(l)\u00a0 \u00a0Subprocessor<\/strong> means any person (including any third party, but excluding our employees or our sub-contractors) appointed by or on behalf us to Process Personal Data on behalf of you; and<\/p>\n

(m)\u00a0 \u00a0You <\/strong>means the entity that accepts\/accepted the Addendum.<\/p>\n

1.2\u00a0 \u00a0 The terms, Commission, Controller, Data Subject, Member State, Personal Data, Personal Data Breach, Processor, Processing, Special Categories of Data <\/strong>and Supervisory Authority<\/strong> shall have the same meaning as in the GDPR, and their cognate terms shall be construed accordingly.<\/p>\n

1.3\u00a0 \u00a0 The word include<\/strong> shall be construed to mean include without limitation, and cognate terms shall be construed accordingly.<\/p>\n

 <\/p>\n

2.\u00a0 \u00a0 Processing of Company Personal Data<\/strong><\/p>\n

2.1\u00a0 \u00a0 Role of Parties:<\/strong> The Parties acknowledge that for the purposes of this Addendum, we act as a Processor and you are the Controller in relation to Company Personal Data.<\/p>\n

2.2\u00a0 \u00a0 The Parties will comply with all applicable Data Protection Laws in the Processing of Company Personal Data.<\/p>\n

2.3\u00a0 \u00a0 We will only Process Company Personal Data on behalf of and in accordance with your relevant instructions and while carrying out our obligations under the Addendum, unless other processing is required by Applicable Laws to which the relevant Contracted Processor is subject, in which case the Contracted Processor will, to the extent permitted by law, immediately inform you of that legal requirement before processing that Company Personal Data.<\/p>\n

2.4\u00a0 \u00a0 Annex 1 to this Addendum sets out the following details:<\/p>\n

2.5\u00a0 \u00a0 description of the types of Processing we will carry out and the types of Company Personal Data Processed under this Addendum; and<\/p>\n

2.6\u00a0 \u00a0 the types of Data Subjects to which the Company Personal Data relates.<\/p>\n

2.7\u00a0 \u00a0 You agree to update us (as soon as practicable) if the details in Annex 1 are incorrect or change.<\/p>\n

 <\/p>\n

3. Subprocessing<\/strong><\/p>\n

3.1\u00a0 \u00a0 You authorise us to continue to use those Subprocessors already engaged by us as at the date of this Addendum (as set out in Annex 2), subject to our obligations at clause 3.<\/p>\n

3.2\u00a0 \u00a0 We shall give you prior written notice of the appointment of any new Subprocessor, including full details of the Processing to be undertaken by the Subprocessor. If, within 10 days of receipt of that notice:<\/p>\n

(a)\u00a0 \u00a0 you have not notified us in writing of any objections (on reasonable grounds) to the proposed appointment of that Subprocessor we will assume that you have consented to the appointment of that Subprocessor; or<\/p>\n

(b)\u00a0 \u00a0 if you notify us in writing of any objections (on reasonable grounds) to the proposed appointment we shall do one of the following: (i) not appoint that Subprocessor; (ii) not disclose any Company Personal Data to that Subprocessor; or (ii) not disclose any Company Personal Data to that Subprocessor until reasonable steps have been taken to address the objections you raised and you have been informed of and agreed to that Subprocessor based on the reasonable steps taken.<\/p>\n

3.3\u00a0 \u00a0 With respect to each Subprocessor we shall:<\/p>\n

(a)\u00a0 \u00a0 from time to time, carry out adequate due diligence to ensure that the Subprocessor is capable of providing the level of protection for Company Personal Data required by the Addendum and this Addendum; and<\/p>\n

(b)\u00a0 \u00a0 ensure that the arrangement between us and the relevant intermediate Subprocessor is governed by a written contract including terms which meet the requirements of Article 28(3) of the GDPR.<\/p>\n

 <\/p>\n

4. Data Subject Rights<\/strong><\/p>\n

4.1\u00a0 \u00a0We shall:<\/p>\n

(a)\u00a0 \u00a0promptly notify you if any Contracted Processor receives a request from a Data Subject under any Data Protection Law in respect of Company Personal Data;<\/p>\n

(b)\u00a0 \u00a0ensure that the Contracted Processor does not respond to that request except on your documented instructions, or as required by Applicable Laws to which the Contracted Processor is subject, in which case we shall to the extent permitted by Applicable Laws inform you of that legal requirement before the Contracted Processor responds to the request;<\/p>\n

(c)\u00a0 \u00a0implement appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of your obligations under the Data Protection Laws; and<\/p>\n

(d)\u00a0 \u00a0where you require our assistance to respond to a Data Subject request, use commercially reasonable efforts to assist you and to the extent legally permitted, and you shall be responsible for the costs arising from our assistance.<\/p>\n

4.2\u00a0 \u00a0You acknowledge and agree that we may use an automated functionality within our Services to seek and document your instructions in response to a Data Subject request relating to your Company Personal Data.<\/p>\n

 <\/p>\n

5.\u00a0 \u00a0Security<\/strong><\/p>\n

5.1\u00a0 \u00a0Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we will implement appropriate technical and organisational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.<\/p>\n

5.2\u00a0 \u00a0We will take reasonable steps to ensure any of our personnel who Process the Company Personal Data, have been informed of the confidential nature of the Company Personal Data and are committed to keeping the Company Personal Data confidential.<\/p>\n

5.3\u00a0 \u00a0In assessing the appropriate level of security we shall take into account the risks that are presented by Processing, in particular from a Personal Data Breach.<\/p>\n

5.4\u00a0 \u00a0Personal Data Breach:<\/strong> We shall notify you without undue delay if we become aware of a Personal Data Breach and provide you with information to assist you to meet your obligations under the EU Data Protection Laws. On your reasonable request we shall take such reasonable commercial steps as are directed by you to assist in the investigation, mitigation and remediation of each such Personal Data Breach.<\/p>\n

 <\/p>\n

6.\u00a0 \u00a0Data Protection Impact Assessment and Prior Consultation<\/strong><\/p>\n

6.1\u00a0 \u00a0Upon your request and to the extent required by the GDPR we shall provide reasonable assistance to you where you are fulfilling your obligations under the GDPR by carrying out a data protection impact assessment, as follows:<\/p>\n

(a)\u00a0 \u00a0to the extent that the assessment you are carrying out directly relates to the Processing of Company Personal Data, you do not otherwise have access to the information and such information is available to us; and<\/p>\n

(b)\u00a0 \u00a0where you reasonably require our assistance with prior consultations with Supervising Authorities or other competent data privacy authorities.<\/p>\n

6.2\u00a0 \u00a0If you request assistance which goes beyond the scope of clause 1, we may provide you with notice of our fees and charge you for this additional assistance.<\/p>\n

 <\/p>\n

7\u00a0 \u00a0Restricted Transfers<\/strong><\/p>\n

7.1\u00a0 \u00a0Subject to clause 3, you (as data exporter<\/strong>) and each Contracted Processor, as appropriate, (as data importer<\/strong>) hereby enter into the Standard Contractual Clauses in respect of any Restricted Transfer from you to that Contracted Processor.<\/p>\n

7.2\u00a0 \u00a0The Standard Contractual Clauses shall come into effect under clause 1 on the commencement of the relevant Restricted Transfer.<\/p>\n

7.3\u00a0 \u00a0Clause 1 shall not apply to a Restricted Transfer unless its effect, together with other reasonably practicable compliance steps (which, for the avoidance of doubt, do not include obtaining consents from Data Subjects), is to allow the relevant Restricted Transfer to take place without breach of applicable Data Protection Law.<\/p>\n

 <\/p>\n

8\u00a0 \u00a0Audit<\/strong><\/p>\n

8.1\u00a0 \u00a0Subject to reasonable notice (not less than 30 days) and your reasonable request to demonstrate compliance with this Addendum we shall (subject to obligations of confidentiality):<\/p>\n

(a)\u00a0 \u00a0make available information directly relating to your Company Personal Data and necessary to demonstrate your compliance with Article 28(3) of the GDPR;<\/p>\n

(b)\u00a0 \u00a0shall allow you or an independent auditor appointed by you, to carry out audits, including inspections, in relation to the Processing of Company Personal Data by the Contracted Processors,<\/p>\n

and you agree to take all reasonable measures to limit any impact on the Contracted Processors.<\/p>\n

 <\/p>\n

9\u00a0 \u00a0Deletion or return of Company Personal Data<\/strong><\/p>\n

9.1 Following the termination or expiry of this Addendum, we shall destroy or return to you (where you make such a request), all Company Personal Data in our possession or control unless any Applicable Laws require that we retain Company Personal Data.<\/p>\n

 <\/p>\n

10\u00a0 \u00a0General Terms<\/strong><\/p>\n

10.1\u00a0 \u00a0Order of Precedence: <\/strong>In the event of any conflict or inconsistency between the agreements entered into between the Parties, the Standard Contractual Clauses shall prevail, then the Addendum, followed by the Customer Agreement.<\/p>\n

10.2\u00a0 \u00a0Obligations under the Addendum:<\/strong> Subject to clause 1, nothing in this Addendum reduces the Parties\u2019 obligations under the Customer Agreement and all clauses in the Customer Agreement will continue to apply and will apply to this Addendum unless they conflict with the Applicable Laws, including but not limited to: limitation of liability and indemnity.<\/p>\n

10.3\u00a0 \u00a0Legal effect:<\/strong> This Addendum is entered into and becomes a binding part of the Addendum with the effective date being the date you accept this Addendum.<\/p>\n

10.4\u00a0 \u00a0Severance:<\/strong> If a provision of this Addendum is held to be void, invalid, illegal or unenforceable, that provision is to be read down as narrowly as necessary to allow it to be valid or enforceable, failing which, that provision (or that part of that provision) will be severed from this Addendum without affecting the validity or enforceability of the remainder of that provision or the other provisions in this Addendum.<\/p>\n

10.5\u00a0 \u00a0Governing law: <\/strong>This Addendum is governed by the laws of New South Wales. \u00a0Each Party irrevocably and unconditionally submits to the exclusive jurisdiction of the courts operating in New South Wales and any courts entitled to hear appeals from those courts and waives any right to object to proceedings being brought in those courts.<\/p>\n

 <\/p>\n

Annex 1 details of processing of company personal data<\/strong>
This Annex 1 includes certain details of the Processing of Company Personal Data as required by Article 28(3) GDPR.
1.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/em>The subject matter and duration of the Processing of Company Personal Data<\/em>
The subject matter and duration of the Processing of Company Personal Data are set out in the Customer Agreement and this Addendum.<\/p>\n

2.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/em>The nature and purpose of the Processing of Company Personal Data<\/em>
The nature and purpose of the Processing of Company Personal Data is further specified in the Customer Agreement and as further instructed by you.<\/p>\n

 <\/p>\n

1.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/em>The types of Company Personal Data to be Processed<\/em>
The types of Company Personal Data to be Processed may include but is not limited to the following:
i.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 a Data Subject\u2019s name;
ii.\u00a0 \u00a0 \u00a0 \u00a0a Data Subject\u2019s contact details, including email address and telephone number;
iii.\u00a0 \u00a0 \u00a0 a Data Subject\u2019s role within their business;
iv.\u00a0 \u00a0 \u00a0 a Data Subject\u2019s preferences and\/or opinions including in response to any customer surveys we send to the Data Subject;
v.\u00a0 \u00a0 \u00a0 \u00a0details of products and services we have provided to a Data Subject and\/or that a Data Subject has enquired about, and our response to them (eg. a support request);
vi.\u00a0 \u00a0 \u00a0 a Data Subject\u2019s browser session and geo-location data, device and network information, statistics on page views and sessions, acquisition sources, search queries and\/or browsing behaviour;
vii.\u00a0 \u00a0 \u00a0information about a Data Subject\u2019s access and use of the Services we deliver to you, including through the use of Internet cookies, a Data Subject\u2019s communications with the Services we deliver to you, the type of browser a Data Subject is using, the type of operating system a Data Subject is using and the domain name of a Data Subject\u2019s Internet service provider;
viii.\u00a0 \u00a0 \u00a0additional personal information that a Data Subject may provide to us, directly or indirectly, through a Data Subject\u2019s use of the Services and any associated applications; and
ix.\u00a0 \u00a0 \u00a0 \u00a0any other personal information requested by us and\/or provided by you or a third party about a Data Subject.<\/p>\n