Data Processing Agreement (DPA)

In providing the Data Processing Services to Customer pursuant to the Agreement, Countly may Process (as defined below) Personal Data (as defined below) on behalf of Customer. Countly will comply with the provisions in this Schedule C with respect to its processing of any Personal Data.  Capitalized terms used but not defined in this Schedule C have the same meanings as set out in the Agreement. 

1. Definitions

For the purposes of this Schedule C:

(a) “Adequacy Regulation” means adequacy regulations covering a transfer of Customer Data pursuant to sub-paragraph 4(1), Part 3, Schedule 21 of the Data Protection Act 2018 (as amended) (including under any regulations issued by the UK Secretary of State pursuant to sub-paragraph 4(3), Part 3, Schedule 21 of that Act), in relation to the data protection regime of a certain non-UK country or territory.

(b) “Adequacy Decision” means a positive finding of adequacy covering an international transfer by the European Commission in relation to the data protection regime of a certain non-EEA country or territory, pursuant to Article 45 of the GDPR.

(c) "Affiliate(s)" has the same meaning ascribed to it in the Agreement and, if not defined in the Agreement, the term means any legal entity directly or indirectly controlling, controlled by or under common control with a party, where control means the ownership of a majority share of the stock, equity or voting interests of such entity.

(d) "Applicable Data Protection Law" means any applicable legislation in force from time to time relating to the protection of personal data of individuals including, where applicable, Regulation (EU) 2016/679 (the "EU GDPR" or "GDPR"), the UK GDPR (as defined in the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019) (the “UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

(e) "Controller", “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Process” and “Processing” shall each have the respective meanings given to them (and equivalent expressions) in Applicable Data Protection Law.

(f) "Customer Data" means any data, information or material originated by Customer that Customer or its members or candidates submit to the Services, collects through its use of the Services or provides to Countly in the course of using the Services, and as set out in the Description of Processing.

(g) “Description of Processing” means the description of Processing set out in Appendix A.

(h) “EU Model Clauses” means the 2021 Standard Contractual Clauses (Module 4 - EU Processor-to-Controller) located here (as updated by Countly from time to time).

(i) “Non-Adequate Country” a country, territory or jurisdiction which: (i) in the case of a transfer concerning Customer Data regulated by the UK GDPR, is not subject to a valid Adequacy Regulation; and (ii) in the case of a transfer concerning Customer Data regulated by the EU GDPR, is not subject to an Adequacy Decision.

(j) “Restricted Transfer” means a transfer of Customer Data by Countly to a Non-Adequate Country.

(k) "Subscription Services" means the analytics and marketing automation services provided by Countly to Customer under the Agreement. 

(l) “UK Addendum” means the UK Addendum located here (as may be updated by Countly from time to time).

2. Roles and Responsibilities.

2.1 Parties' Roles. The parties agree that Customer is a Controller and Countly is a Processor for the purposes of Processing Customer Data pursuant to this Agreement. In some circumstances Customer may be a Processor, in which case Customer appoints Countly as Customer's sub-processor, which shall not change the obligations of either Customer or Countly under this Schedule C, as Countly will remain a Processor with respect to Customer in such event.  

2.2 Purpose Limitation. Countly shall process Personal Data for the purposes set forth in the Agreement and only in accordance with the lawful, documented instructions of Customer, except where otherwise required by applicable law. The Agreement and this Schedule C set out Customer's complete instructions to Countly in relation to the processing of Personal Data and any processing required outside of the scope of these instructions (inclusive of the rights and obligations set forth under the Agreement) will require prior written agreement of the parties. Notwithstanding the preceding sentences, Countly shall have no obligation to comply (nor any liability for non-compliance) with any of Customer instructions which will or are likely to (in Countly’s opinion): (i) vary the provisions of this Agreement; (ii) be inconsistent with the Description of Processing; and (iii) breach any Applicable Data Protection Laws, and shall notify Customer in writing of the same.

2.3 Compliance. Customer, as Controller, shall (in connection with Customer Data and the Services):

(a) ensure it has complied, and will continue to comply, with all applicable laws relating to privacy and data protection, including Applicable Data Protection Law;

(b) ensure it has, and will continue to have, the right to transfer, or provide access to, the Customer Data to Countly for processing in accordance with the terms of the Agreement and this Schedule C;

(c) ensure that the Description of Processing at all times accurately reflects Countly’s Processing of Customer Data as a Processor for Customer in relation to the Data Processing Services. If Customer requires changes to the Description of Processing it shall provide an amended version (a “Revised Description”) to Countly. Such Revised Description shall be deemed to have replaced the Description of Processing within five (5) days of Countly’s written confirmation and this Agreement shall be deemed amended accordingly on that date. If the nature of the Processing under this Agreement changes in such a way as to change the scope of the Data Processing Services, Countly shall be entitled to amend the charges for the Data Processing Services accordingly;

(d) ensure that all instructions it issues to Countly comply with Applicable Data Protection Laws; and

(e) be and remain solely responsible for determining the legal basis and conditions for the Processing of all Customer Data under this Agreement.

3. Security.

3.1 Security. Countly shall implement appropriate technical and organizational measures designed to protect against accidental, unauthorized or unlawful destruction, loss, alteration, or disclosure of, or access to Customer Data (each a "Security Incident"). 

3.2 Confidentiality of Processing. Countly shall ensure that any person that it authorizes to Process the Customer Data (including its and its Affiliates’ staff, agents, and subcontractors) shall be subject to a duty of confidentiality (whether a contractual or a statutory duty). 

3.3 Security Incidents. Upon becoming aware of a Security Incident, Countly shall notify Customer without undue delay and pursuant to the terms of the Agreement and shall provide such timely information as Customer may reasonably require to enable Customer to fulfill any data breach reporting obligations under Applicable Data Protection Law. 

4. Sub-Processing.

4.1 Sub-processors. Customer agrees that Countly may engage Countly Affiliates and is generally authorized to engage any third party Processor to process Customer Data on Countly’s behalf (collectively, "Sub-processors"). The Sub-processors currently engaged by Countly and authorized by Customer are listed Appendix A to this Schedule C. Countly shall impose on such Sub-processors data protection terms that protect the Personal Data to the same standard provided for by this Schedule C and shall remain liable for any breach of the Schedule C caused by a Sub-processor. 

4.2 Changes to Sub-processors. Countly may, by giving no less than thirty (30) days' notice to Customer, add or make changes to the Sub-processors. Customer may object to the appointment of an additional Sub-processor within fourteen (14) calendar days of such notice on reasonable grounds relating to the protection of the Personal Data, in which case Countly shall have the right to cure the objection through one of the following options (to be selected at Countly's sole discretion): (a) Countly will cancel its plans to use the Sub-processor with regard to Personal Data or will offer an alternative to provide the Subscription Services without such Sub-processor; or (b) Countly will take the corrective steps requested by Customer in its objection (which remove Customer's objection) and proceed to use the Sub-processor with regard to Personal Data; or (c) Countly may cease to provide or Customer may agree not to use (temporarily or permanently) the particular aspect of the Subscription Services that would involve the use of such Sub-processor with regard to Personal Data, subject to a mutual agreement of the parties to adjust the remuneration for the Subscription Services considering the reduced scope of the Subscription Services. If none of the above options are reasonably available and the objection has not been resolved to the mutual satisfaction of the parties within 30 days after Countly's receipt of Customer's objection, either party may terminate the Agreement and Customer will be entitled to a pro-rata refund for prepaid fees for Subscription Services not performed as of the date of termination. 

4.3 Emergency Replacement. Countly may replace a Sub-processor if the reason for the change is beyond Countly's reasonable control. In such instance, Countly shall notify Customer of the replacement as soon as reasonably practicable, and Customer shall retain the right to object to the replacement Sub-processor pursuant to Section 4.2 above. 

5. Cooperation.

5.1 Data Subjects' Rights. Countly shall provide commercially reasonable assistance, including by appropriate technical and organizational measures as reasonably practicable, to enable Customer to respond to any inquiry, communication or request from a Data Subject seeking to exercise his or her rights under Applicable Data Protection Law, including rights of access, correction, restriction, objection, erasure or data portability, as applicable. In the event such inquiry, communication or request is made directly to Countly, Countly shall promptly inform Customer by providing the full details of the request. For the avoidance of doubt, Customer is responsible for responding to Data Subject requests for access, correction, restriction, objection, erasure or data portability of that Data Subject's Personal Data. 

5.2 Data Protection Impact Assessments and Prior Consultation. Countly shall, to the extent required by Applicable Data Protection Law, provide Customer with reasonable assistance with data protection impact assessments, security, breach notifications or prior consultations with data protection authorities that Customer is required to carry out under Applicable Data Protection Law. 

6. Security Reports and Audits.

Any provision of security attestation reports (such as SOC 2, Type II or equivalent report) or audits shall take place in accordance with Customer's rights under the Agreement. If the Agreement does not include a provision regarding security attestation reports, Countly shall provide a copy of its most current security attestation report upon Customer's written request no more than once annually. If the Agreement does not include audit rights, Countly and Customer will discuss and agree in advance on the reasonable start date, scope and duration of and security and confidentiality controls applicable to any audit; and Countly reserves the right to charge a fee (based on Countly’s reasonable costs) for any such audit. Countly will provide further details of any applicable fee and the basis of its calculation to Customer in advance of such audit.  

7. Deletion or Return of Customer Data.

Upon termination or expiration of the Agreement, Countly shall in accordance with the terms of the Agreement delete or make available to Customer for retrieval all relevant Personal Data (including copies) in Countly's possession, save to the extent that Countly is required by any applicable law to retain some or all of the Personal Data. In such event, Countly shall extend the protections of the Agreement and this Schedule C to such Personal Data and limit any further processing of such Personal Data to only those limited purposes that require the retention, for so long as Countly maintains the Personal Data.

8. International Transfers. 

8.1 Where Customer Data processed subject to the UK GDPR is transferred to a Non-Adequate Country, the following terms shall apply:

(a) if the Restricted Transfer is from Countly to Customer the UK Addendum shall be deemed signed by Customer and incorporated into this Agreement. Table 3 of the UK Addendum shall be deemed populated in accordance with the information set out in Appendix A of this Schedule C; and

(b) to the extent a conflict exists between the terms of this Schedule C and the terms of the EU Model Clauses or the UK Addendum, the terms of the EU Model Clauses and/or UK Addendum shall take precedence.

8.2 Where Customer Data processed subject to the EU GDPR is transferred to a Non-Adequate Country, the following terms shall apply:

(a) if the Restricted Transfer is from Countly to Customer, the EU Model Clauses shall be deemed signed by Customer and incorporated into this Agreement. The relevant Annexes of the EU Model Clauses shall be deemed populated in accordance with the information set out in Appendix A of this Schedule C; and

(b) to the extent a conflict exists between the terms of this Schedule C and the terms of the EU Model Clauses, the terms of the EU Model Clauses shall take precedence.

Processing of Personal Data 

Nature and Subject Matter: The nature and subject matter of the Processing of Personal Data is set out in the Agreement and in this Appendix A.

Duration: The Processing shall begin on the Effective Date and continue until the end of the Term of the Agreement.

Data Subjects

The Personal Data concerns the following categories of Data Subjects:

• Customers employees
• End users of Customer’s website and/or applications (as relevant) that the Software is deployed on.

Purposes of the Processing

The Processing is necessary for the following purposes:

• Countly shall Process Personal Data as necessary to perform its obligations as set out in the Agreement and any written instructions provided by the Customer to Countly in accordance with the Data Processing Agreement set out in this Schedule C.

Categories of Personal Data

The Personal Data that can be processed fall within the following categories:

• Randomly generated/pseudo anonymized/advertising ID
• Name
• Username
• Organization/Company
• Address
• Phone number
• Email
• Location data (country code, region, city, coordinates)
• Birth year
• Gender
• Events
• Time zone
• Time processed
• Device information (OS, OS version, screen size and density, browser, browser version, device model, device type, device manufacturer, locale, screen orientation)

Special Categories of Personal Data and/or Article 10 GDPR Personal Data (if applicable)

The Personal Data Processed falls within the following special categories of Personal Data/Article 10 data:

• N/A

Rights and Obligations of Customer

The rights and obligations of the customer where it is a controller shall be as set out in this Agreement and Applicable Data Protection Law.

Sub-Processors

The list of Sub-processors currently engaged by Countly and authorized by the customer.