Legal Notices Data Processing Addendum.

This Data Processing Addendum (“DPA”) is between Anonomatic, Inc. (“Anonomatic”) and the customer that has entered into a governing agreement with Anonomatic, directly or through an authorized reseller (“Customer”). It is incorporated into the Anonomatic Terms of Use that Customer accepts when it activates the Anonomatic Service, or into any signed agreement that replaces them (the “Governing Agreement”). Customer accepts this DPA when it accepts the Governing Agreement. This DPA applies when Anonomatic processes Personal Data on Customer’s behalf. Capitalized terms not defined here have the meanings in the Governing Agreement.

1. How Anonomatic processes data

Anonomatic’s products run inside Customer’s own environment. Anonomatic does not receive or see the data Customer processes with them, including data held in Customer’s PII Vault. This DPA therefore covers only the limited Personal Data that Anonomatic does process: contact, account and activation data for the people who activate, administer and use the Anonomatic Service for Customer, and their support and training requests. Customer agrees not to send Anonomatic Personal Data about its own customers, patients, students or employees, other than Product Users. Annex I describes the processing.

2. Roles

Customer is the “controller” or “business”, and Anonomatic is the “processor” or “service provider”, under Data Protection Laws. Each party will comply with the obligations that apply to it under those laws.

3. Instructions

Anonomatic will process Personal Data only on Customer’s documented Instructions, which are: (a) activating, administering and supporting the Anonomatic Service as described in the Governing Agreement; (b) Customer’s configuration and use of the Anonomatic Service; and (c) other written instructions the parties agree. Customer is responsible for having the rights and permissions needed to give Product User data to Anonomatic. Anonomatic will tell Customer if it believes an Instruction would breach Data Protection Laws.

4. Personnel

Anonomatic will ensure that people who access Personal Data are bound by confidentiality obligations and are instructed in handling it properly, and will limit access to those who need it.

5. Security

Anonomatic will maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, alteration or disclosure, as described in Annex II. Anonomatic may update these measures if the update does not reduce the overall level of protection. Customer is responsible for its own systems, including the security of the environment where the Anonomatic Service is deployed and of its account credentials.

6. Sub-processors

Customer authorizes Anonomatic to use sub-processors to help provide the Anonomatic Service. Anonomatic will bind each sub-processor to data protection terms no less protective than this DPA and remains responsible for their performance. Anonomatic will provide its current sub-processor list on request and will give Customer 30 days’ notice of any new sub-processor. Customer may object on reasonable data protection grounds within that period, and the parties will work in good faith to resolve the objection.

7. Data subject requests

Anonomatic will give Customer reasonable help to respond to requests from individuals to exercise their rights under Data Protection Laws. If Anonomatic receives such a request that identifies Customer, it will not respond directly unless the law requires, and will promptly forward it to Customer.

8. Breach notification

Anonomatic will notify Customer without undue delay, and within seventy-two (72) hours, after becoming aware of a Breach. The notice will include, as available, what happened, the Personal Data involved, the steps taken in response, and other information Customer reasonably needs to meet its legal obligations. Anonomatic will cooperate in investigating and responding to the Breach. Anonomatic may delay notice only as required by law enforcement. Notice of a Breach is not an admission of fault or liability.

9. International transfers

Where Anonomatic processes Personal Data subject to the GDPR, UK GDPR or Swiss data protection law in a country without an adequacy decision, the parties will rely on the Standard Contractual Clauses approved by the European Commission (Module Two, controller to processor), the UK International Data Transfer Addendum, and the Swiss amendments, which are incorporated into this DPA by reference. Annexes I and II complete the information they require.

10. California and other US state laws

Where the California Consumer Privacy Act (as amended by the California Privacy Rights Act) or similar US state laws apply, Anonomatic acts as a service provider and will not: (a) sell or share Personal Data; (b) retain, use or disclose Personal Data for any purpose other than the business purposes in the Governing Agreement, or outside the direct business relationship with Customer; or (c) combine Personal Data with data from other sources, except as the law permits. Anonomatic will comply with these laws as they apply to it, will tell Customer if it can no longer do so, and Customer may take reasonable steps to stop and remediate unauthorized use of Personal Data.

11. Audits and assistance

Anonomatic will give Customer the information reasonably needed to show compliance with this DPA, including a summary of its most recent independent security audit or assessment where one is available, and will give reasonable help with Customer’s data protection impact assessments and consultations with regulators. If that information is not enough, Customer may audit Anonomatic once per calendar year, or more often if a regulator requires, with 30 days’ written notice, during business hours and without disrupting Anonomatic’s business, at Customer’s cost, and subject to confidentiality. If a regulator requires an audit, Anonomatic will give reasonable access to its documentation and systems. Unless the law prohibits it, Anonomatic will promptly tell Customer if a court or government agency demands access to Personal Data.

12. Return and deletion

After the Governing Agreement ends, Anonomatic will, at Customer’s choice, return or delete Personal Data it holds on Customer’s behalf. Customer may retrieve Personal Data for up to 30 days after the end date. Anonomatic will then delete it, including from backups in the ordinary course, unless the law requires it to keep the data.

13. Health and education data

Because Anonomatic does not receive Customer’s content, it does not expect to handle protected health information or education records. If that changes, the parties will first sign a business associate agreement or any other terms the law requires.

14. Government customers

For United States government customers, this DPA applies subject to the terms of the applicable contract and federal law.

15. Term, order of precedence and liability

This DPA takes effect when Customer accepts the Governing Agreement, and continues until the Governing Agreement ends and Anonomatic has deleted or returned Personal Data. It replaces any earlier data processing agreement between the parties. If this DPA conflicts with the Governing Agreement about the processing of Personal Data, this DPA controls. Otherwise, the Governing Agreement’s terms apply, including its limits on liability, governing law and jurisdiction. This DPA applies to a Customer’s affiliates that act as controllers of Personal Data, and Customer is responsible for them. Each party may terminate the Governing Agreement if the parties agree that this DPA conflicts with applicable law and cannot agree on an amendment.

16. Definitions

“Breach” means a security breach of Anonomatic’s systems that leads to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data that Anonomatic processes on Customer’s behalf. “Data Protection Laws” means the GDPR (Regulation (EU) 2016/679), the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended, and other privacy and data protection laws of the United States, its states, the United Kingdom and the European Union that apply to the Personal Data. “Personal Data” means information about an identified or identifiable individual, as defined in Data Protection Laws, that Anonomatic processes on Customer’s behalf. “Anonomatic Service” means the Anonomatic products and services described in the Governing Agreement. “Instructions” has the meaning in section 3.

Annex I. Details of processing

• Controller: Customer. Processor: Anonomatic, Inc., a provider of data protection and privacy technology including PolyAnonymization and PII Vault.
• Individuals concerned: Customer’s employees and contractors who activate, administer or use the Anonomatic Service (“Product Users”).
• Categories of data: name, work email, work phone, job title, organization, license and activation details, and support and training records for Product Users. Anonomatic does not receive Customer’s content or the data protected by the Anonomatic Service.
• Sensitive data: none. Customer will not send special categories of data to Anonomatic.
• Purpose and nature: activating, licensing, supporting and improving the Anonomatic Service, and responding to Customer’s requests, under Customer’s Instructions.
• Duration: the term of the Governing Agreement, plus the return and deletion period in section 12.
• Frequency: continuous while Customer uses the Anonomatic Service.

Annex II. Security measures

• Product design: the Anonomatic Service runs in Customer’s environment and does not send Customer’s data to Anonomatic. PII Vault protects identity with eight overlapping layers, including PII separation, PolyAnonymization, AES-256 database encryption, Data Sundering, role-based access control and Customer-held keys.
• Access control: access to Personal Data limited to personnel who need it, with individual accounts and role-based permissions.
• Encryption: encryption of Personal Data in transit and at rest.
• Confidentiality: written confidentiality obligations for personnel and contractors.
• Incident response: documented procedures to detect, investigate and report Breaches under section 8.
• Vendor management: data protection terms with sub-processors under section 6.
• Review: regular review of these measures, with changes under section 5.

Annex III. Sub-processors

Anonomatic’s current sub-processor list is available on request at sales@anonomatic.com.