Data Processing Agreement 

This Data Processing Agreement (“DPA”) forms part of the Terms of Use (“Agreement”) between Wicketech, LLC (“Dot5”), and the Customer accepting the Agreement. This DPA is incorporated into the Agreement by reference and does not require separate execution. It is effective upon the Customer's acceptance of the Agreement. This DPA prevails over any conflicting terms of the Agreement, but does not otherwise modify the Agreement. 

1. Definitions 

1.1 In this DPA:

( a ) “Controller”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Process/Processing”, “Processor”, and “Supervisory Authority” have the meaning given to them in the GDPR;

( b ) “Customer Personal Data” means any Personal Data, the Processing of which is subject to Data Protection Law, for which Customer is the Controller, and which is Processed by Dot5 in the context of the Services under the Agreement;

( c ) “Data Protection Law” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“EU GDPR”), the EU GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (together with the EU GDPR, the “GDPR”), the e-Privacy Directive 2002/58/EC (as amended by Directive 2009/136/EC) on Privacy and Electronic Communications and the UK Privacy and Electronic Communications (EC Directive) Regulations 2003 and their national implementations in the European Economic Area (“EEA”) and the United Kingdom (“UK”), U.S. federal and state privacy laws, including, but not limited to, the California Consumer Privacy Act (“CCPA”), each as applicable, and as may be amended or replaced from time to time;

( d ) “Data Subject Rights” means Data Subjects’ rights as set out in Data Protection Law;

( e ) “International Data Transfer” means any transfer of Customer Personal Data from the EEA, or the UK to an international organisation or to a country outside of the EEA, and the UK;

( f ) “Services” means the services provided by Dot5 to Customer under the Agreement;

( g ) “Standard Contractual Clauses” means the clauses annexed to the EU Commission Implementing Decision 2021/914 of June 4, 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as amended or replaced from time to time;

( h ) “Subprocessor” means a Processor engaged by Dot5 to Process Customer Personal Data; and

( i ) “UK Addendum” means the International Data Transfer Addendum to the Standard Contractual Clauses issued by the UK Information Commissioner’s Office, in force as of 21 March 2022, available at international-data-transfer-addendum.pdf.

1.2 Words and expressions used in this DPA shall have the same meaning as is given to them in the Agreement unless the context otherwise expressly requires.

2. Scope and applicability

2.1 This DPA applies to Processing of Customer Personal Data by Dot5 to provide the Services.

2.2 The subject matter, nature and purpose of the Processing, the types of Customer Personal Data and categories of Data Subjects are set out in Annex I.

2.3 Customer is a Controller and appoints Dot5 as a Processor on behalf of Customer. Customer is responsible for compliance with the requirements of Data Protection Law applicable to Controllers.

2.4 Customer acknowledges that Dot5 may Process Personal Data relating to the operation, support, or use of the Services for its own business purposes, such as billing, account management, data analysis, benchmarking, technical support, product development, and compliance with law. Dot5 is the Controller for such Processing and will Process such data in accordance with Data Protection Law.

3. Instructions

3.1 Dot5 will Process Customer Personal Data to provide the Services and in accordance with Customer’s documented instructions. 

3.2 The Controller’s instructions are documented in this DPA and the Agreement. Customer may reasonably issue additional instructions as necessary to comply with Data Protection Law. Dot5 may charge a reasonable fee to comply with any additional instructions.

3.3 Unless prohibited by applicable law, Dot5 will inform Customer if Dot5 is subject to a legal obligation that requires Dot5 to Process Customer Personal Data in contravention of Customer’s documented instructions.

4. Personnel

4.1 Dot5 will ensure that all personnel authorised to Process Customer Personal Data are subject to an obligation of confidentiality.

5. U.S. Privacy 

5.1 To the extent that Customer Personal Data Processed by the Processor hereunder includes Customer Personal Data about U.S. residents, in addition to the Processor’s other obligations under this DPA, the Processor will: (a) Process such Customer Personal Data solely as a Processor on the Controller’s behalf for the specific business purposes described in the Agreement; (b) be prohibited from retaining, using, or disclosing such Customer Personal Data other than for the specific business purposes described in the Agreement, including retaining, using, or disclosing such Customer Personal Data for a commercial purpose other than performing such business purposes; (c) comply with applicable U.S. and state privacy laws including by providing the same level of privacy protection as required of the Controller under such laws; (d) grant the Controller the right to take reasonable and appropriate steps to ensure that the Processor’s use of Customer Personal Data is consistent with the Controller’s obligations under this DPA and applicable U.S. state law, including by exercising its audit rights; (e) not further collect, “sell”, “share” (as such terms are defined under the CCPA) or otherwise use such Customer Personal Data except as necessary to perform its obligations under the Agreement and this DPA, and (f) not combine the Customer Personal Data that the Processor receives from or on behalf of the Controller with Personal Data that the Processor collects or receives from another person. The Controller shall have the right, upon notice to the Processor, to take reasonable and appropriate steps to stop and remediate the Processor’s unauthorised Processing of Controller’s Personal Data, and the Processor shall cooperate with the Controller in taking such steps. The Parties acknowledge and agree that the disclosure of the Controller’s Personal Data to the Processor does not form part of any monetary or other valuable consideration exchanged between the Parties. For the purposes of this DPA, in relation to U.S. residents’ Personal Data, “Controller” includes a Business and “Processor” includes a service provider each as defined under CCPA, and Data Subjects include “consumers” as defined under applicable law.

6. Security and Personal Data Breaches

6.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Dot5  will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures listed in AnnexII.

6.2 Customer acknowledges that the security measures in Annex II are appropriate in relation to the risks associated with Customer’s intended Processing, and will notify Dot5 prior to any intended Processing for which Dot5’s security measures may not be appropriate.

6.3 Dot5 will notify Customer without undue delay after becoming aware of a Personal Data Breach involving Customer Personal Data. If Dot5’s notification is delayed, it will be accompanied by reasons for the delay.

7. Subprocessing

7.1 Customer hereby authorises Dot5 to engage Subprocessors.

7.2 Dot5 will enter into a written agreement with Subprocessors which imposes similar obligations as required by Data Protection Law.

7.3 Dot5 will notify Customer prior to any intended change to Subprocessors. Customer may object to the addition of a Subprocessor based on reasonable grounds relating to a potential or actual violation of Data Protection Law by providing written notice detailing the grounds of such objection within thirty (30) days following Dot5’s notification of the intended change. Customer and Dot5 will work together in good faith to address Customer’s objection. If Dot5 chooses to retain the Subprocessor, Dot5 will inform Customer at least thirty (30) days before authorising the Subprocessor to Process Customer Personal Data, and Customer may immediately discontinue using the relevant parts of the Services, and may terminate the relevant parts of the Services within thirty (30) days.

8. Assistance

8.1 Taking into account the nature of the Processing, and the information available to Dot5, Dot5 will assist Customer, including, as appropriate, by implementing technical and organisational measures, with the fulfilment of Customer’s own obligations under Data Protection Law to: comply with requests to exercise Data Subject Rights; conduct data protection impact assessments, and prior consultations with Supervisory Authorities and to notify a Personal Data Breach.

8.2 Dot5 may charge a reasonable fee for assistance under this Section 8. If Dot5 is at fault, Dot5 and Customer shall each bear their own costs related to assistance.

9. Audit

9.1 Upon reasonable request, Dot5 must make available to Customer all information necessary to demonstrate compliance with the obligations of this DPA and allow for and contribute to audits, including inspections, as mandated by a Supervisory Authority or reasonably requested no more than once a year by Customer and performed by an independent auditor as agreed upon by Customer and Dot5. The foregoing shall only extend to those documents and facilities relevant and material to the Processing of Customer Personal Data, and shall be conducted during normal business hours and in a manner that causes minimal disruption.

9.2 Dot5 will inform Customer if Dot5 believes that Customer’s instruction under Section 3 infringes Data Protection Law. Dot5 may suspend the audit or inspection, or withhold requested information until Dot5 has modified or confirmed the lawfulness of the instructions in writing.

9.3 Dot5 and Customer each bear their own costs related to an audit. Audits shall not be conducted more than once per year. 

10. International Data Transfers

10.1 Customer hereby authorises Dot5 to carry out International Data Transfers with respect to Customer Personal Data in accordance with Data Protection Law.

10.2 To the extent required under Data Protection Law for the International Data Transfer of Customer Personal Data from Customer to Dot5, by accepting this DPA, Customer and Dot5 hereby enter into Module 2 (Controller to Processor) of the Standard Contractual Clauses, which are hereby incorporated by reference and completed as follows: the “data exporter” is Customer; the “data importer” is Dot5; the optional docking clause in Clause 7 is implemented; Clause 9(a) option 2 is implemented and the time period therein is specified as thirty (30) days; the optional redress clause in Clause 11(a) is struck; Clause 17 option 1 is implemented and the governing law is the law of Ireland; the court in Clause 18(b) are the courts of Ireland; Annex 1 and 2 of the Standard Contractual Clauses are Annex I and II to this DPA respectively. 

10.3 The UK Addendum will be applicable to any International Data Transfers originating in the UK and is  completed as follows: for the purpose of table 1 of part 1, the exporter is Customer and the importer is Dot5 and the table is deemed to be completed with the information set out in Annex I. For the purpose of table 2 of part 1, the “Approved EU SCCs” which the UK Addendum is appended to are the Standard Contractual Clauses incorporated into this DPA and completed as set out in Section 10.2. For the purpose of table 3 of part 1, the information requested in Annex 1 and 2 of the Standard Contractual Clauses is provided in Annex I and II to this DPA. For the purpose of table 4 of part 1, the importer may end the UK Addendum as set out in section 19 of the UK Addendum. 

10.4 If Dot5’s compliance with Data Protection Law applicable to International Data Transfers is affected by circumstances outside of Dot5’s control, including circumstances affecting the validity of an applicable legal instrument, Dot5 and Customer will work together in good faith to reasonably resolve such non-compliance. 

11. Liability

11.1 Subject to any limitation of liability set out in the Agreement, to the extent permitted by applicable law, where Dot5 has paid damages or fines, Dot5 is entitled to claim back from Customer that part of the compensation, damages or fines, corresponding to Customer’s part of responsibility for the damages or fines.

12. Termination and return or deletion

12.1 This DPA is terminated upon the termination of the Agreement.

12.2 Customer may request return of Customer Personal Data within ninety (90) days after termination of the Agreement. Otherwise, Dot5 will delete all Customer Personal Data within one hundred eighty (180) days after termination, except where applicable law requires longer retention, in which case Dot5 will retain it only as long as required.

13. Modification of this DPA

13.1 This DPA may only be modified by a written amendment by Dot5 with notice given to the Customer.

14. Invalidity and severability

14.1 If any provision of this DPA is found by any court or administrative body of competent jurisdiction to be invalid or unenforceable, then the invalidity or unenforceability of such provision does not affect any other provision of this DPA and all provisions not affected by such invalidity or unenforceability will remain in full force and effect.

Annex I

Details of Processing

A. List of Parties

B. Description of Processing / Transfer

Annex II

Technical and Organisational Security Measures 

Dot5 has implemented the following technical and organisational measures: