Data Protection

Last Updated Date: October 20, 2021

Data Protection Addendum

 

This Data Protection Addendum (the “Addendum”) applies to the processing of Personal Data by GetGravy Ltd. (“Gravy”) including, without limitation, Personal Data relating to data subjects located in the European Economic Area (“EEA”) or Switzerland (“EU Personal Data”), the United Kingdom (“UK”) (“UK Personal Data”) and individuals located in California (“CA Personal Data”).  For this Addendum’s purposes, EU Personal Data and UK Personal Data are collectively referred to as “European Personal Data.”

 

This Addendum supplements the online Terms of Use or other signed agreement entered into between you (“Customer”) and Gravy for the provision of Gravy’s products and services (the “Services”) to Customer (the “Agreement”) and is incorporated into the Agreement. In the event of a conflict between this Addendum and any other terms in the Agreement, the terms of this Addendum will govern.

 

“Controller”, “Processor”, “data subject” and “process” have the meanings given in the relevant Data Protection Requirements (as defined below). The term “Supervisory Authority” means (a) in the context of the UK and the UK GDPR (as defined below), the UK Information Commissioner’s Office; and/or (b) in the context of the EEA and EU GDPR (as defined below), the definition of that term in Article 4(21) of the EU GDPR. “Consumer”, “business”, “sale”, and “service provider” shall have the meaning given in the CCPA (as defined below). “Personal Data” means (a) the “personal data” (as defined in GDPR) that Customer provides to Gravy for the provision of the Services and (b) any other information that Customer provides to Gravy for the provision of the Services that constitutes “personal information” under and governed by the CCPA (as defined below).  The term “Data Subject Request” means the exercise of rights by a data subject of Personal Data made under and in accordance with applicable Data Protection Requirements. The term “EU Restricted Transfer” means a transfer of EU Personal Data to any person in a Restricted Country, which would be prohibited without a legal basis therefor under Chapter V of the EU GDPR.  The term “EU Standard Contractual Clauses” means the standard contractual clauses adopted by the European Commission under Article 46 of the EU GDPR for the transfer of Personal Data from data exporters in the EEA to data importers in third countries, a copy of which is attached hereto as Attachment 2.  The term “Relevant Body” means (a) in the context of the UK and the UK GDPR, the UK Government; and/or (b) in the context of the EEA and EU GDPR, the European Commission.  The term “Restricted Country” means (a) in the context of the UK, a country or territory outside the UK; and/or (b) in the context of the EEA, means a country or territory outside the EEA, that the Relevant Body has not deemed to provide an ‘adequate’ level of protection for Personal Data pursuant to a decision made in accordance with Article 45 of the GDPR.  The term “Restricted Transfer” means (a) an EU Restricted Transfer; and or (b) a UK Restricted Transfer, as the context requires.  The term “Standard Contractual Clauses” means (a) the EU Standard Contractual Clauses; and/or (b) the UK Standard Contractual Clauses, as the context requires.  The term “UK Restricted Transfer” means a transfer of UK Personal Data to any person in a Restricted Country, which would be prohibited without a legal basis therefor under Chapter V of the UK GDPR.  The term “UK Standard Contractual Clauses” means the standard contractual clauses adopted by the UK Information Commissioner’s Office and/or the UK Government under Article 46 of the UK GDPR from time to time for the transfer of Personal Data from data exporters in the UK to data importers outside the UK which, as at the date of this Data Addendum, are as shown here.

As between the parties, with regard to European Personal Data, Customer is a Controller or Processor and Gravy may be either a Processor or a subprocessor for a Customer.

As between the parties, with regard to CA Personal Data, Customer is a business and Gravy is a service provider.

Gravy reserves the right to modify this Addendum in order to comply with applicable law and regulation.  To the extent that Gravy modifies this Addendum in order to ensure such compliance, Gravy will provide notice to Customer of the modifications, and Customer’s continued use of the Services will constitute Customer’s agreement to those modifications. Gravy may provide that notice in a variety of ways, including, among other things, sending Customer an email, posting a notice on the Service itself, or by posting the revised Addendum on Gravy’s website and revising the date at the top of this Addendum.

  1. Nature of Data Processing.

The subject matter of the data processing, including the processing operations carried out by Gravy on behalf of Customer and Customer’s data processing instructions for Gravy, will be described in the Agreement, this Addendum, and each statement of work, order form, or equivalent document where Customer orders Services from Gravy, which form integral parts of the Agreement.

Categories of data subjects: Individuals who may use Gravy’s Services as provided to Customer under the Agreement.

 

Types of Personal Data processed: Personal Data provided by Customer to Gravy in connection with the Agreement, including name, surname, email address, other profile information, and content of messages sent by data subjects in connection with the Services under the Agreement.

 

  1. Compliance with Laws.

 

The parties shall each comply with their respective obligations under all applicable laws, regulations, and other legal requirements relating to (i) privacy and data security; and (ii) the use, collection, retention, storage, security, disclosure, transfer, disposal, and other processing of any Personal Data (“Privacy Laws”), including, without limitation, the California Consumer Privacy Act of 2018 (as amended) (“CCPA”). With regard to European Personal Data, the parties will comply with each of their respective obligations under (i) the European Union Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “General Data Protection Regulation” or “EU GDPR”) and any subordinate legislation and regulation implementing the EU GDPR which may apply; and (ii) the EU GDPR as it forms part of United Kingdom law by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended (“UK GDPR”) (collectively, with Privacy Laws, the “Data Protection Requirements”).  Together, the EU GDPR and UK GDPR shall be referred to as the “GDPR.”  References to “Articles” and “Chapters” of the GDPR shall be construed accordingly.

 

  1. Customer Obligations.

Customer shall:

3.1

provide instruction to Gravy and determine the purposes and general means of Gravy’s processing of Personal Data on behalf of Customer under the Agreement; and

3.2

comply with its personal data protection, data security and other obligations prescribed by Data Protection Requirements for Controllers by, without limitation, meeting its obligations under Data Protection Requirements to:

  1. establish and maintain a procedure for the exercise of the rights of the individuals whose Personal Data Gravy processes on behalf of Customer;

  2. as required by Data Protection Requirements, provide notice and obtain consent from the individuals whose Personal Data Gravy processes on behalf of Customer;

  3. establish or ensure that another party has established a legal basis for Gravy’s processing of Personal Data contemplated by this Addendum;

  4. process only data that have been lawfully and validly collected and ensure that such data will be relevant and proportionate to the respective uses; and

  5. ensure compliance with the provisions of this Addendum by its personnel and by any person accessing or using Personal Data on its behalf.

 

3.3

By entering into this Addendum, Customer instructs Gravy to process Customer Personal Data only in accordance with applicable law: (a) to provide the Services; (b) as authorised by the Agreement, including this Addendum; and (c) as further documented in any other written instructions given by Customer and acknowledged in writing by Gravy as constituting instructions for purposes of this Addendum.

  1. Gravy Obligations.

4.1

Gravy, in its capacity as a Processor or subprocessor of Personal Data, shall:

  1. process Personal Data solely for the purposes of providing the Services as described in the Agreement (which shall encompass the processing authorized by Customer’s instructions), and in compliance with the instructions received from Customer and the Agreement;

  2. not sell any CA Personal Data or retain, use or disclose CA Personal Data outside of the direct business relationship between Gravy and Customer;

  3. inform Customer immediately if, in Gravy’s opinion, an instruction from Customer violates applicable Data Protection Requirements;

  4. adopt and maintain appropriate security measures including organizational and technical measures (the “Security Measures” as set forth in Attachment 1), designed to maintain a level of security appropriate to the risks presented by processing the Personal Data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons;

  5. grant access to Personal Data only to personnel who need such access for the scope of their job duties, and are subject to appropriate confidentiality arrangements;

  6. if it intends to engage one or more third parties acting on its behalf (“subprocessor”) to help it to satisfy its obligations in accordance with this Addendum or to delegate all or part of the processing activities to such subprocessors, (i) remain responsible, and liable, to Customer for the subprocessors’ acts and omissions with regard to data protection; and (ii) enter into contractual arrangements with such subprocessors requiring them to provide a substantially similar level of data protection compliance and information security to that provided for herein. Subject to the requirements of this Section 4.1(6), Customer hereby generally authorizes the engagement of subprocessors. SPecifically, Amazon Web Services (AWS), SendGrid and others, as may be updated by Gravy from time to time. When any new subprocessor is engaged during the term of the Agreement, Gravy will notify Customer of the engagement by updating this website at least 15 days before the new subprocessor processes Personal Data.  If Customer objects to such engagement in a written notice to Gravy within 15 days of being informed thereof on reasonable grounds relating to the protection of Personal Data, Gravy and Customer will work together in good faith to find a mutually acceptable resolution to address such objection. If the parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, Customer may, as its sole and exclusive remedy, terminate the Agreement and cancel the Services by providing written notice to Gravy. If Customer does not object to Gravy’s appointment of a subprocessor during the 15-day period referred to in Section 4.1(6), Customer shall be deemed to have approved Gravy’s engagement and ongoing use of that subprocessor.

4.2

Gravy shall inform Customer without delay if Gravy becomes aware of:

  1. any legally binding request for disclosure of Personal Data by a law enforcement authority; or

  2. any notice, inquiry or investigation by a Supervisory Authority with respect to Personal Data.

4.3

Gravy further agrees to notify Customer of any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data in Gravy’s possession, custody or control (“Personal Data Breach”) without undue delay and in any event within 72 hours of becoming aware of a Personal Data Breach. Personal Data Breaches do not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, or other network attacks on firewalls or networked systems.

4.4

Gravy shall reasonably assist Customer regarding:

  1. any requests from data subjects in respect of access to or the rectification, erasure, restriction, portability, blocking or deletion of Personal Data. In the event that a data subject sends such a request directly to Gravy, Gravy will direct the data subject to submit such request to Customer directly, and Customer shall be responsible for responding to such requests. Where relevant, Customer acknowledges and agrees, both generally and specifically for the purpose of Clause 10(a) of Module Three of the EU Standard Contractual Clauses, that there are no circumstances in which it would be appropriate for Gravy to notify any third-party controller of any data subject request and that any such notification shall be the Customer’s responsibility;

  2. the investigation of Personal Data Breaches and the notification to the Supervisory Authority and data subjects in respect of such breaches by providing available details of the Personal Data breaches, including steps Gravy has taken to mitigate the potential risks and steps Gravys recommends Customer take to address the Information Security Incident; and

  3. the preparation of data protection impact assessments and, where applicable, carrying out consultations with any Supervisory Authority.

4.5

If Gravy is required by Data Protection Requirements to process any Personal Data other than as set forth in this Addendum, Gravy shall inform Customer of this requirement in advance of any processing, unless Gravy is legally prohibited from informing Customer of such processing.

  1. Audit; Certification.

Customer may audit Gravy’s compliance with this Addendum up to once per year and on such other occasions as may be required by Data Protection Requirements. Gravy will cooperate with the audit by providing Customer or Customer’s Supervisory Authority with the information and assistance reasonably necessary to conduct the audit. Customer will reimburse Gravy for its reasonable expenses incurred to cooperate with such an audit. The audit must be conducted during regular business hours, subject to an agreed upon audit plan and Gravy’s safety, security or other relevant policies, and may not unreasonably interfere with Gravy’s business activities. Gravy shall not be required to breach any duties of confidentiality in connection with such audit, and Customer may use the audit reports only for the purposes of meeting Customer’s regulatory audit requirements and/or confirming compliance with the requirements of this Addendum.

  1. Data Transfers.

6.1

  1. Gravy is located in the United Kingdom of Great Britain and Northern Ireland (“UK) and may store and process Personal Data in the UK or anywhere Gravy or its subprocessors maintains facilities. Accordingly, Customer acknowledges that certain Restricted Transfers may be effected under this Addendum. The provisions of this Section 6 shall apply to any such Restricted Transfers (if and as applicable, having regard to the nature of those transfers and the application or otherwise of Chapter V of the EU GDPR and/or UK GDPR).

  2. The Standard Contractual Clauses referred to in this Section 6 shall only have effect if and to the extent permitted and required under the EU GDPR and/or UK GDPR to establish a valid basis under Chapter V of the EU GDPR and/or UK GDPR (if and as applicable) in respect of the transfer to Gravy of Personal Data.

6.2

EU Restricted Transfers.

  1. To the extent that any processing of European Personal Data under this Addendum involves an EU Restricted Transfer, the parties shall comply with their respective obligations set out in the EU Standard Contractual Clauses.

  2. The following modules of the EU Standard Contractual Clauses apply in the manner set out below (having regard to the Customer’s role):

    1. Module 2 of the EU Standard Contractual Clauses applies to any EU Restricted Transfer involving processing of European Personal Data in respect of which Customer is a Controller in its own right; and/or

    2. Module 3 of the EU Standard Contractual Clauses applies to any EU Restricted Transfer involving processing of European Personal Data in respect of which Customer is itself acting as a processor on behalf of any other person.

 

6.3

 

UK Restricted Transfers

 

  1. To the extent that any processing of UK Personal Data under this Addendum involves an UK Restricted Transfer, the parties shall comply with their respective obligations set out in the UK Standard Contractual Clauses, which are hereby deemed to be entered into and populated in accordance with Section 6.3.

  2. In respect of any UK Standard Contractual Clauses entered into pursuant to Section 6.3,

    1. Customer acts as “data exporter” and Gravy acts as “data importer.”

    2. The details on pages 1 to 3 of such UK Standard Contractual Clauses shall be populated with the information of the parties as set out in, or determined by, the Agreement.

    3. Clause 9 of such UK Standard Contractual Clauses shall be populated as follows: “The Clauses shall be governed by the law of the country of the United Kingdom in which the data exporter is established.”

    4. Clause 11(3) of such UK Standard Contractual Clauses shall be populated as follows: “The provisions relating to data protection aspects for sub-processing of the contract referred to in paragraph 1 shall be governed by the laws of the country of the UK where the data exporter is established.”

    5. Appendix 1 to such UK Standard Contractual Clauses shall be populated with the corresponding information set out in Section 1 of this Addendum.

    6. Appendix 2 to such UK Standard Contractual Clauses shall be populated by selecting Option 2 and including the following: “The technical and organizational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) are those established and maintained under Section 4.1 of the Addendum.

  3. In respect of any UK Restricted Transfer involving processing in respect of which Customer is itself acting as a Processor on behalf of any other person, Customer represents and warrants on an ongoing basis, and further undertakes, that it has full and sufficient authority to enter into the UK Standard Contractual Clauses for and on behalf of each such other person.

  4. To the extent that Gravy effects a UK Restricted Transfer to a subprocessor, Gravy shall (and Customer hereby authorized Gravy to) enter into the UK Standard Contractual Clauses as agent for Customer (as “data exporter”) with that subprocessor (as “data importer”). In respect of any such UK Restricted Transfer between Gravy and a subprocessor, Customer acknowledges and agrees that Gravy’s obligation to enter into the UK Standard Contractual Clauses shall be satisfied by the inclusion of the details of the Personal Data in the general description of the “personal data” referred to in any existing or future UK Standard Contractual Clauses entered into by and between Gravy and that subprocessor.

 

6.4

 

Notwithstanding the foregoing, the Standard Contractual Clauses (or obligations the same as those under the Standard Contractual Clauses) will not apply to the extent an alternative recognized compliance standard for the lawful transfer of European Personal Data outside the EEA or UK Personal Data outside the UK (e.g., binding corporate rules) applies to the transfer.

  1. Reserved

 

  1. Term

This Addendum shall remain in effect as long as Gravy carries out Personal Data processing operations on behalf of Customer or until the termination of the Agreement and all associated order forms (and all Personal Data has been returned or deleted in accordance with section 9 below).

  1. Data Return and Deletion.

The parties agree that upon the expiration or termination of the Agreement, Gravy shall securely destroy all Personal Data and, at the request of Customer, certify that it has taken such measures, unless applicable laws prevent Gravy from returning or destroying all or part of the Personal Data disclosed. In such case, Gravy agrees to preserve the confidentiality of the Personal Data retained by it and that it will only actively process such Personal Data after such date in order to comply with the laws it is subject to.

  1. Liability

The total combined liability of either party towards the other party, whether in contract, tort or any other theory of liability, under or in connection with this Addendum and the Standard Contractual Clauses (if entered into as described in Section 6 of this Addendum) combined will be limited to the liability limitations or other liability caps agreed to by the parties in the Agreement.

Notwithstanding the foregoing, nothing in this Section 10 will affect any party’s liability to data subjects under the third-party beneficiary provisions of the Standard Contractual Clauses to the extent the limitation of such rights is prohibited by Privacy Laws or Local Data Protection Laws, where applicable.

  1. Precedence and Application of Standard Contractual Clauses.

 

  • In the event of any conflict or inconsistency between:

  1. this Addendum and the Agreement, this Addendum shall prevail to the extent of such conflict or inconsistency; or

  2. any Standard Contractual Clauses that apply pursuant to Section 6 and this Addendum and/or the Agreement, those Standard Contractual Clauses shall prevail in the context of the Restricted Transfer(s) to which they apply to the extent of such conflict or inconsistency; provided that, in order to establish the operational clarity in relation to certain provisions of the Standard Contractual Clauses, it is agreed that the following shall apply:

    1. upon Customer’s request under Clause 5(j) of the UK Standard Contractual Clauses that Gravy provide copies of the subprocessor agreements to Customer, Gravy may remove or redact all commercial information and/or any clauses, recitals, schedules, annexes, appendices, etc., unrelated to the UK Standard Contractual Clauses beforehand;

    2. when complying with its transparency obligations under Clause 8.3 of the EU Standard Contractual Clauses, Customer agrees that it shall not provide or otherwise make available, and shall take all appropriate steps to protect, Gravy’s and its licensors trade secrets, business secrets, confidential information and/or other commercially sensitive information;

  • the audits described in Clauses 5(f) and 12(2) of the UK Standard Contractual Clauses and in Clauses 8.9(c) and 8.9(d) of the EU Standard Contractual Clauses shall be performed in accordance with Section 5 of this Addendum and shall be subject to any relevant conditions, limitations or restrictions therein;

  1. in respect of subprocessors

    1. any approval by Customer of Gravy’s appointment of a subprocessor that is given expressly or deemed given pursuant to Section 4.1 constitutes Customer’s: (A) prior written consent to Gravy’s appointment of that Ssubprocessor if and as required under Clause 5(h) of the UK Standard Contractual Clauses; and (B) documented instructions to effect onwards transfers to any relevant subprocessors if and as required under Clause 8.8 of the EU Standard Contractual Clauses;

    2. for the purposes of Clause 9(a) of the EU Standard Contractual Clauses, the Parties are deemed to have selected Option 2, and the timeframe for advance notice of intended changes is as set out in Section 4.1; and

    3. the terms and conditions of Section 4.1 apply generally to Gravy’s appointment and use of subprocessors for the purposes of both sets of Standard Contractual Clauses.

  2. certification of deletion of Personal Data as described in Clause 12(1) of the UK Standard Contractual Clauses and Clauses 8.5 and 16(d) of the EU Standard Contractual Clauses shall be provided upon Customer’s written request; and

  3. the parties agree that the provisions of Section 4.3 satisfy the requirements of the UK Standard Contractual Clauses.

 

Attachment 1

Security Measures

Gravy may update the Security Measures from time to time, provided the updated measures do not decrease the overall protection of Personal Data.

  1. Organizational management and staff responsible for the development, implementation and maintenance of the Gravy’s information security program.

  2. Audit and risk assessment procedures for the purposes of periodic review and assessment of risks to Gravy’s organization, monitoring and maintaining compliance with the Gravy’s policies and procedures, and reporting the condition of its information security and compliance to internal senior management.

  3. Data security controls which include, at a minimum, logical segregation of data, restricted (e.g. role-based) access and monitoring, and utilization of commercially available industry standard encryption technologies for Personal Data that is transmitted over public networks (i.e. the Internet) or when transmitted wirelessly or at rest or stored on portable or removable media (i.e. laptop computers, CD/DVD, USB drives, back-up tapes).

  4. Logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions, (e.g. granting access on a need-to-know and least privilege basis, use of unique IDs and passwords for all users, periodic review and revoking/changing access promptly when employment terminates or changes in job functions occur).

  5. Password controls designed to manage and control password strength, expiration and usage including prohibiting users from sharing passwords and requiring that the Gravy’s passwords that are assigned to its employees have defined complexity.

  6. System audit or event logging and related monitoring procedures to proactively record user access and system activity.

  7. Change management procedures and tracking mechanisms designed to test, approve and monitor all material changes to the Gravy’s technology and information assets.

  8. Incident management procedures designed to allow Gravy to investigate, respond to, and mitigate events related to the Gravy’s technology and information assets.

  9. Disaster recovery procedures designed to maintain service and/or recover from foreseeable emergencies or disasters.