Data processing agreement

This Data Processing Agreement (“DPA”) sets forth certain of the Parties’ obligations with respect to the protection of Personal Data, in connection with performance or receipt of the Services under the Fourwaves Terms of Service. This DPA is incorporated by reference into the Fourwaves Terms of Service.

A breach by the Parties of their covenants, representations or other undertakings in this DPA shall constitute a breach of and an event of default under the Fourwaves Terms of Service for which the Parties shall have all rights and remedies provided in the Fourwaves Terms of Service.

1. DEFINITIONS

In this DPA, the following terms shall have the meaning ascribed to them. Capitalized terms defined in the Fourwaves Terms of Service shall have the meaning ascribed to them in the Fourwaves Terms of Service.

1.1 “Account Data” means the name, email address and contact information of Fourwaves Member and other information provided by Fourwaves Members that are not associated with a specific Event.

1.2 “Affiliate” as to Customer or Fourwaves, shall mean any corporation, partnership, limited liability company, or other domestic or foreign entity (a) of which a controlling interest is owned directly or indirectly by a Party to the Fourwaves Terms of Service, or (b) controlled by, or under common control with, a Party to the Fourwaves Terms of Service.

1.3 “Data Protection Laws” means any and all applicable laws and regulations, applicable to the processing of Personal Data, as the same may be amended from time to time, including, without limitation, the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) and, for public bodies, the Act respecting Access to documents held by public bodies and the Protection of personal information (CQLR, c. A-2.1), the Personal Information Protection and Electronic Documents Act (PIPEDA), the General Data Protection Regulation (GDPR Europe and GDPR UK) and the California Consumer Privacy Act (CCPA);

1.4 “Europe” means the European Union, the European Economic Area and/or their member states, Switzerland and the United Kingdom.

1.5 “European Data” means Personal Data that is subject to the protection of European Data Protection Laws.

1.6 “European and UK Data Protection Laws” means data protection laws applicable in Europe and UK, in each case, as may be amended, superseded or replaced.

1.7 “Fourwaves Members” means individuals that have created an account on the Fourwaves Platform;

1.8 “Participant” means an individual who registers for an Event or who enters information (including by filling an electronic form) on an event website organized by a Customer either through the Fourwaves Platform or otherwise.

1.9 “Personal Data” means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, as defined in the applicable Data Protection Laws.

1.10 “Security Incident” (or “Incident”) means any unauthorized access to, use, disclosure, alteration, loss or destruction of Personal Data, or any other breach of the protection of Personal Data.

1.11 “Services” means the services provided by Fourwaves described in the Fourwaves Terms of Service;

1.12 “Subprocessor” means any third-Party appointed by a Party to process Personal Data;

1.13 “Supervisory Authority” means any regulatory authority responsible for the enforcement of Data Protection Laws.

2. ROLES OF THE PARTIES

2.1 Fourwaves will act as a separate controller in relation to Account Data.

2.2 Except with regard to Account Data, Fourwaves will act as a processor of Personal Data about Participants.

2.3 The Parties shall each comply with their respective obligations under the Data Protection Laws and as described in their respective privacy policies in respect of their processing of Personal Data.

3. PROCESSING OF PERSONAL DATA

3.1 With respect to Personal Data processed on behalf of Customer:

3.1.1 Fourwaves shall only process such Personal Data on behalf of and in accordance with Customer’s instructions and shall treat such Personal Data as Customer’s Confidential Information.

3.1.2 Customer instructs Fourwaves to process such Personal Data for the following purposes:

3.1.2.1 Processing solely and exclusively in accordance with the Fourwaves Terms of Service and Fourwaves Privacy Policy and only to the extent necessary to deliver and perform the Services; and

3.1.2.2 Processing to comply with other reasonable instructions provided by Customer from time to time where such instructions are consistent with the terms of the Fourwaves Terms of Service and this DPA.

3.1.3 Fourwaves shall promptly inform Customer if, in its reasonable opinion, it believes that any instruction given by Customer infringes the Data Protection Laws.

3.2 Fourwaves will process Account Data in accordance with applicable Data Protection Laws.

4. DATA LOCATION AND CROSS-BORDER TRANSFERS

4.1 Fourwaves hosts Customer Data, including backups, in Québec, Canada, on Amazon Web Services infrastructure.

4.2 Fourwaves communicates Personal Data outside Québec only (a) to the Subprocessors named in the List of Subprocessors, for the purposes stated there, some of which apply only when Customer enables the related feature; and (b) to Fourwaves personnel who access it from outside Québec, under the same confidentiality undertakings, access controls and security measures as personnel in Québec.

4.3 Fourwaves will not move the hosting of Customer Data outside Québec without at least ninety (90) days’ prior notice to Customer, during which Customer may terminate the affected Services without penalty.

4.4 Each Party shall ensure that any transfer of Personal Data between jurisdictions is authorized by Data Protection Laws.

4.5 Fourwaves shall not transfer European and UK Data to any country or recipient not recognized as providing an adequate level of protection for Personal Data (within the meaning of applicable European and UK Data Protection Laws), unless it first takes all such measures as are necessary to ensure the transfer is in compliance with applicable European and UK Data Protection Laws. Such measures may include (without limitation) transferring such data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Data, to a recipient that has achieved binding corporate rules authorization in accordance with European and UK Data Protection Laws, or to a recipient that has executed appropriate standard contractual clauses in each case as adopted or approved in accordance with applicable European and UK Data Protection Laws.

5. SECURITY

5.1 Fourwaves shall ensure that all such persons or Parties involved in the processing of Personal Data :

a) have undertaken appropriate training in relation to the Data Protection Laws and security practices, and have been provided access to the policies and procedures comprising Fourwaves’ information security program;

b) have signed a confidentiality agreement with Fourwaves. Upon Customer’s request, Fourwaves provides one confidentiality undertaking, signed by an authorized representative of Fourwaves, covering all personnel who may access Customer’s Personal Data; and

c) are subject to user authentication and log on processes when accessing Personal Data.

5.2 Fourwaves shall keep Personal Data confidential and will instruct its staff and Subprocessors as to the confidentiality of Personal Data.

5.3 Fourwaves shall implement appropriate technical and organizational measures to ensure a level of security of the Personal Data appropriate to the risk and shall take all measures required pursuant to applicable Data Protection Law. In assessing the appropriate level of security, each Party shall take account in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored or otherwise processed.

6. SECURITY INCIDENT MANAGEMENT

6.1 Fourwaves will notify Customer of any confirmed or reasonably suspected Security Incident involving Personal Data about Participants without undue delay and, for a confirmed Security Incident, no later than 72 hours after confirmation. Upon identification of a Security Incident involving Personal Data about Participants, each Party shall:

a) Cooperate fully with the other Party in investigating and responding to the Security Incident.

b) Identify Personal Data about Participants affected.

c) Immediately take steps to contain the Security Incident and preserve evidence for any necessary investigation.

d) Complete a thorough forensic investigation of the Security Incident, consistent with industry best practices, and share with the other Party the results of all investigations, which shall include, but not be limited to: (1) a full description of the circumstances surrounding the Security Incident; (2) a description of the evidence reviewed and analysis completed; (3) identification of the Security Incident’s root cause, if determined; and (4) a determination of whether any Personal Data was accessed or acquired without authorization.

e) Cooperate with the other Party as reasonably necessary to facilitate compliance with any applicable laws and regulations.

7. SUBPROCESSING

7.1 Fourwaves may engage Subprocessors to process Personal Data under its control in accordance with the requirements of applicable Data Protection Laws. The current Subprocessors are named in the List of Subprocessors. Fourwaves will give Customer at least thirty (30) days’ notice before a new Subprocessor begins processing Customer’s Personal Data, by updating that list and by email to Customers who ask to receive these notices at privacy@fourwaves.com. Where a replacement is urgently needed to protect the security or continuity of the Services, Fourwaves will give notice as soon as possible after the change.

7.2 Customer may object to a new Subprocessor, on reasonable grounds related to the protection of Personal Data, within thirty (30) days of notice. The Parties will then discuss Customer’s concerns in good faith with a view to achieving a commercially reasonable resolution. If no such resolution can be reached, Fourwaves will, at its sole discretion, either forgo the appointment of the new Subprocessor, ensure that no Customer Data is processed by the new Subprocessor, or permit Customer to terminate the affected Services without penalty and without liability to either Party (but without prejudice to any fees incurred by Customer prior to termination).

7.3 For the purposes of Clause 9(c) of the Standard Contractual Clauses, Customer acknowledges that Subprocessor agreements may be subject to confidentiality obligations. Fourwaves shall use reasonable efforts to require any Subprocessor to permit the disclosure of the Subprocessor agreement to Customer and shall provide (on a confidential basis) all information reasonably available for disclosure.

8. AUDIT

8.1 Upon request, each Party shall provide the other Party with the information reasonably necessary to demonstrate its compliance with this DPA and with Data Protection Laws with respect to its processing of Personal Data on behalf of the other Party.

8.2 Except as otherwise expressly stated herein, the Parties shall have no obligation to agree to an audit by the other Party with respect to their own processing of Personal Data when acting as a controller.

8.3 Fourwaves will provide reasonable assistance to the Customer with data protection impact assessments, including privacy impact assessments required by Québec law, and dealings with supervisory authorities or other competent data privacy authorities to the extent required by Data Protection Laws. Customer acknowledges that such assistance will be provided only to the extent needed to comply with Data Protection Laws.

9. DATA SUBJECT RIGHTS

9.1 Each Party shall cooperate with the other, to the extent reasonably requested, in relation to:

a) any requests from individuals whose Personal Data is processed by either Party;

b) any other communication from a data subject or individual concerning the processing of their Personal Data; and

c) any communication from a Supervisory Authority concerning the processing of Personal Data, or compliance with the Data Protection Laws.

9.2 Fourwaves will promptly refer to Customer any inquiry regarding Personal Data except where such inquiry only concerns Account Data.

9.3 Fourwaves may respond directly to inquiries by a data subject seeking to remove his/her personal data from the Platform. Fourwaves will use reasonable efforts to notify the affected Customers.

10. DELETION OR RETURN OF PERSONAL DATA

10.1 Upon written request by Customer, Fourwaves shall, with respect to Personal Data processed as a processor for Customer:

a) return a complete copy of such Personal Data to Customer by secure file transfer or through the export features of the Platform; and/or

b) securely delete all copies of such Personal Data, including previous versions of files, from its production systems within thirty (30) days of the request, except what Fourwaves must retain under applicable law, such as payment and tax records, which is kept only for that purpose and period. Backup copies containing it are permanently deleted when they expire, no later than fourteen (14) days after the deletion from production.

Upon request, Fourwaves provides written certification that it has complied with this Section 10.

10.2 Deletion under this Section is made at Customer’s request. The end of an Event or of a paid plan does not end the Agreement: the Agreement remains in effect while Customer’s account exists, including on a free plan, and ends when Customer requests in writing the deletion of its account or data, subject to the data retention policy of the Fourwaves Terms of Service.

10.3 This Section does not apply to Account Data, which Fourwaves processes as a separate controller. Each Fourwaves Member can delete their account at any time.

11. INDEMNIFICATION

11.1 Each Party agrees to indemnify, defend and hold harmless the other Party, and its officers, directors, employees, sublicensees, and agents from and against any and all claims, losses, demands, liabilities, damages, settlements, expenses and costs (including without limitation attorneys’ fees and costs), and any and all threatened claims, losses, demands, liabilities, damages, settlements, expenses and costs, arising from or based on allegations of, (a) any Security Incident caused by the indemnifying Party’s wrongful act or negligence, (b) any breach of this DPA by the indemnifying Party or (c) any failure of the indemnifying Party to comply any applicable Data Protection Laws. Each Party’s aggregate liability under this Section 11 shall not exceed two times (2x) the fees paid or payable by Customer to Fourwaves in the twelve (12) months preceding the claim, except where applicable law does not permit such a limitation, including for intentional or gross fault. This limit replaces, for this Section, the liability limits of the Fourwaves Terms of Service.

11.2 Neither Party shall have any obligation to indemnify the other Party hereunder for a claim based on such other Party’s or such other Party’s representatives or employees’ fault or negligent action or omission.

12. MISCELLANEOUS

12.1 Any obligation imposed by this DPA in relation to the processing of Personal Data, including but not limited to indemnification hereunder, shall survive any termination or expiration of this DPA and the Fourwaves Terms of Service.

12.2 With regard to the subject matter of this DPA, in the event of inconsistencies between the provisions of this DPA and any other agreements between the Parties, including but not limited to the Fourwaves Terms of Service, the provisions of this DPA shall prevail with regard to the protection of Personal Data.

12.3 Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, while preserving the Parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.

12.4 This DPA is governed by the laws applicable to the Fourwaves Terms of Service, and disputes regarding this DPA shall be handled as set forth in the Fourwaves Terms of Service.