Data Processing Agreement
Last Updated on September 28, 2021
BETWEEN: The Customer, specified and as defined in the Service Agreement (the “Data Controller”), whose privacy officer can be contacted as specified in the Service Agreement or ancillary documents; AND Ayla Networks, Inc., a company incorporated under the laws of Delaware, having its principal place of business at 680 N. McCarthy Blvd., Suite 100, Milpitas, CA 95035 (the “Data Processor”), whose privacy officer can be contacted at: email@example.com.
1. Subject Matter of this Data Processing Agreement
1.1. This Data Processing Agreement (“DPA”) applies exclusively to the processing of personal data that is subject to applicable data protection laws in the scope of the agreement between the parties for the provision of certain cloud platform services, hereinafter, the “Service Agreement”. A detailed description of the data processed is further described in the Miscellaneous section below.
1.2. Terms such as ‘processing’, ‘personal data’, ‘data subject’, “Data Controller” and “Data Processor” shall have the meaning ascribed to them in the EU data protection laws.
2. The Data Controller & the Data Processor
2.1. The Data Controller will determine the scope, purposes, and manner by which the personal data may be accessed or processed by the Data Processor. The Data Processor will process the personal data only as set forth in Data Controller’s written instructions.
2.2. The Data Processor will only process personal data on documented instructions of the Data Controller in such manner as and to the extent that is appropriate for the provision of the services, except as required to comply with a legal obligation to which the Data Processor is subject. In such case, the Data Processor shall inform the Data Controller of such obligation before processing, unless prohibited from furnishing such information to the Data Controller. The Data Processor shall never process personal data in a manner inconsistent with the Data Controller’s documented instructions. The Data Processor shall immediately inform the Data Controller if, in its opinion, an instruction infringes EU data protection provisions.
2.3. The parties have entered into a Service Agreement in order to benefit from the expertise of the Data Processor in securing and processing data, which may include some personal data, for the purpose of providing an IoT, machine learning or artificial intelligence solution to Data Controller through a platform as a service model. The Data Processor shall be allowed to exercise its discretion in the selection and use of such means it considers necessary to pursue those purposes, subject to the requirements of this DPA.
2.4. Data Controller warrants that it has all necessary rights to provide the personal data to Data Processor for the processing to be performed in relation to the services. To the extent required by applicable data protection law, Data Controller is responsible for ensuring that any necessary data subject consents and approvals to this processing are obtained (including the involvement of any sub-processors), and for ensuring that a record of such consents is maintained. If such consent is revoked by the data subject, Data Controller is responsible for communicating such revocation to the Data Processor, and Data Processor shall implement Data Controller’s instruction regarding the further processing of that personal data.
3.1. Without prejudice to any existing contractual arrangements between the parties, the Data Processor shall treat all personal data as strictly confidential, and it shall inform its employees, agents, and/or approved subprocessors who are engaged in processing of the confidential nature of personal data. The Data Processor shall ensure that all such persons or parties have signed an appropriate confidentiality agreement, are otherwise bound to a duty of confidentiality, or are under an appropriate statutory obligation of confidentiality.
4.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, without prejudice to any other security standards agreed upon by the parties, the Data Controller and Data Processor shall implement appropriate technical and organizational measures to ensure a level of security of the processing of personal data appropriate to the risk. These measures shall include as appropriate:
(a) measures to ensure that the personal data can be accessed only by authorized personnel for the purposes set forth in this DPA;
(b) In assessing the appropriate level of security, the parties shall consider the risks presented by processing, for example from accidental or unlawful destruction, loss, or alteration, unauthorized or unlawful storage, processing, access or disclosure of personal data;
(c) the pseudonymization and encryption of personal data;
(d) the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
(e) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
(f) a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing of personal data;
(g) measures to identify vulnerabilities with regard to the processing of personal data in systems used to provide services to the Data Controller.
4.2. The Data Processor shall have in place an appropriate written security policy with respect to the processing of personal data, outlining the measures set forth in Article 4.1.
4.3. At the request of the Data Controller, the Data Processor shall demonstrate the measures it has taken pursuant to this Article 4 and shall allow the Data Controller to audit and test such measures. Upon at least 90 days prior written notice to the Data Processor and at Data Controller’s expense, the Data Controller may audit the Data Processor´s operations as these relate to the personal data. The Data Processor shall cooperate with such audits and shall grant the Data Controller´s auditors reasonable access to any premises and devices involved with the processing of the personal data which are under the Data Processor’s control.
5. Improvements to Security
5.1. The parties acknowledge that security requirements are constantly changing and that effective security requires frequent evaluation and regular improvements of outdated security measures. The Data Processor will therefore evaluate the measures on an ongoing basis and will improve these measures in order to maintain compliance with the requirements set out in Article 4. The parties will negotiate in good faith the cost, if any, to implement material changes required by specific updated security requirements set forth in applicable data protection law or by data protection authorities of competent jurisdiction.
6. Data Transfers
6.1. The Data Processor shall notify the Data Controller of any planned transfers of personal data to a country outside of the European Economic Area (EEA) and shall only perform such transfer after obtaining authorization from the Data Controller, which may not be unreasonably withheld, or in accordance with the Standard Contractual Clauses.
6.2. To the extent that the Data Controller or the Data Processor are relying on a specific statutory mechanism to normalize international data transfers that is subsequently modified, revoked, or held in a court of competent jurisdiction to be invalid, the Data Controller and the Data Processor agree to cooperate in good faith to promptly terminate the transfer or to pursue a suitable alternate mechanism that can lawfully support the transfer.
6.3. The Standard Contractual Clauses and the terms of this section will apply to all processing of personal data by the Data Controller where the personal data is transferred from the EEA or UK to outside the EEA or UK (as applicable), either directly or via onward transfer, to any country or recipient: (a) not recognized by the European Commission or UK authorities (as applicable) as providing an adequate level of protection for personal data (as described in the data protection laws), and (b) not covered by a suitable framework recognized by the relevant authorities as providing an adequate level of protection for personal data, including Binding Corporate Rules or a valid safe harbor framework.
6.4. Where personal data is transferred from any other country or region, applicable regional laws shall apply. For data subjects located in the People’s Republic of China (PRC), any personal data will not be transferred outside of the PRC without the express consent of any applicable government authority. The data controller shall be responsible for obtaining such consent.
6.5. Data Controller is responsible for notifying Data Processor in writing if there is a change in information begin transferred to Data Controller’s systems. Such notice shall be provided in writing via email to Data Controller’s contact within Data Processor’s organization, or to firstname.lastname@example.org.
7. Incident Management & Information Obligations
7.1. When the Data Processor becomes aware of an incident that impacts the processing of personal data, it shall promptly notify the Data Controller about the incident, shall at all times cooperate with the Data Controller, and shall follow the Data Controller’s instructions regarding its personal data impacted by such incidents so that the Data Controller can perform a thorough investigation of the incident, to formulate a correct response, and to take suitable further steps.
7.2. The term “incident” used in Article 7.1 shall mean:
(a) a complaint or request with respect to the exercise of a data subject’s rights under data protection law;
(b) an investigation into or seizure of the personal data by government officials, or a specific indication that such an investigation or seizure is imminent;
(c) any unauthorized or accidental access, processing, deletion, loss or any form of unlawful processing of the personal data;
(d) any breach of the security or confidentiality as set out in Articles 3 and 4 of this DPA leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data, or any indication of such breach has occurred or is about to occur;
7.3. The Data Processor shall have in place written procedures which enable it to promptly respond to the Data Controller about an incident. Where the incident is reasonably likely to require a data breach notification by the Data Controller under applicable EU data protection law, the Data Processor shall implement its written procedures in such a way so that it can notify the Data Controller no later than 24 hours of having become aware of such an incident.
7.4. Any notifications made to the Data Controller shall be addressed to the employee(s) of the Data Controller whose contact details are provided in the Service Agreement, and shall contain:
(a) a description of the nature of the incident, including possible categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
(b) the name and contact details of the Data Processor’s data protection officer or another contact point where more information can be obtained;
(c) a description of the likely consequences of the incident; and
(d) a description of the measures taken or proposed to be taken by the Data Processor to address the incident including any measures to mitigate its possible adverse effects.
7.5. Data Controller authorizes Data Processor to perform searches of its systems in order to respond (or provide a response to Data Controller) to a data subject request. Data Processor shall notify Data Controller of a deletion request and will follow directions as specified by Data Controller. If Data Controller does not respond, Data Processor shall delete such personal data from Data Processor’s systems. If Data Controller receives a deletion request from a data subject, Data Controller has the ability to delete a data subject from the Data Processor’s system without the involvement of the Data Processor. Data Controller authorizes Data Processor to respond to deletion requests from a data subject to the extent necessary under applicable regulations.
8. Contracting with Sub-Processors
8.1. The Data Controller authorizes the Data Processor to engage subprocessors for activities related to the Service Agreement as described online at https://connection.aylanetworks.com/s/article/Ayla-Networks-Sub-Processors. Data Processor shall inform the Data Controller of any addition or replacement of such sub-processors by posting such addition or replacement at the site specified. The Data Controller shall have an opportunity to object to such changes within 15 days by contacting Data Processor at email@example.com (subject line: objection to sub-processor).
8.2. Notwithstanding any authorization by the Data Controller within the meaning of the preceding paragraph, the Data Processor shall remain fully liable vis-à-vis the Data Controller for the performance of any such subprocessor that fails to fulfill its data protection obligations.
8.3. The Data Processor shall ensure that the subprocessor is bound by substantially the same data protection obligations of the Data Processor under this Data Processing Agreement, shall supervise compliance thereof, and impose on its subprocessors the obligation to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of EU data protection law.
8.4. The Data Controller may request that the Data Processor audit a subprocessor or provide confirmation that such an audit has occurred (or, where available, obtain or assist Data Controller in obtaining an audit report concerning the subprocessor’s operations) to ensure compliance with its obligations in conformity with this DPA. Both parties agree that if a subprocessor provides third-party attestation of adherence to an approved code of conduct or certification mechanism pursuant to Article 42 of the GDPR, such attestation shall be sufficient for this audit requirement. The Data Controller is a third party beneficiary of the agreements between the Data Processor and its various subprocessors and as such, may terminate the applicable agreement and instruct Data Processor’s subprocessor to erase or return data if Data Processor is in the insolvency or similar proceedings or ceases to exist.
8.5. Data Processor provides a platform as a service and machine learning offerings using third-party cloud infrastructure providers. Such infrastructure providers are specified in the Data Processor’s list of subprocessors. Certain personal data is subject to the various data storage and data deletion policies of Data Processor’s infrastructure providers. Data Processor can provide additional information or direct inquiries upon Data Controller’s request.
9. Returning or Destruction of Personal Data
9.1. Upon termination of this DPA, upon the Data Controller’s written request, or upon fulfillment of all purposes agreed in the Service Agreement whereby no further processing is required, the Data Processor shall, at the discretion of the Data Controller, either delete, destroy or return all personal data on Data Processor’s systems to the Data Controller and destroy or return any existing copies. If Data Controller does not specify, Data Processor shall delete personal data on Data Processor’s systems in accordance with its cloud platform usage policy.
9.2. The Data Processor shall notify all subprocessors of a deletion request or the termination of the DPA and shall ensure that all such subprocessors either destroy the personal data or return the personal data to the Data Controller, at the discretion of the Data Controller.
10. Assistance to Data Controller
10.1. The Data Processor shall assist the Data Controller by appropriate technical and organizational measures, to the extent possible, in fulfilling the Data Controller’s obligation to respond to requests for exercising the data subject’s rights under the GDPR. Data Processor may provide APIs directly to Data Controller in order to respond to such requests. If APIs are provided to Data Controller, Data Processor will not be directly involved in any deletion or modification of such personal data.
10.2. The Data Processor shall assist the Data Controller in ensuring compliance with the obligations pursuant to Section 4 (Security) and prior consultations with supervisory authorities required under Article 36 of the GDPR, taking into account the nature of processing and the information available to the Data Processor.
10.3. The Data Processor shall make available to the Data Controller all information necessary to demonstrate compliance with the Data Processor’s obligations and allow for and contribute to audits, including inspections, conducted by the Data Controller.
11. Duration & Termination
11.1. This DPA shall be effective as of the effective date of the Service Agreement.
12.1. In the event of any inconsistency between the provisions of this DPA and the provisions of the Service Agreement, the provisions of this DPA shall prevail.
12.2. The following personal data is collected on a regular basis:
• User’s email address or account name, user-generated password
• IP or ethernet address (both WAN and LAN)
• Device type, browser type operating system, and application version
• Also collected, but anonymized by the product before transmission to the cloud: BSSIDs of Wi-Fi Access Points that the product can see (used for debugging purposes)
The personal data processed may also include the following, as determined by Ayla’s customer in its sole discretion: Account name, first name, last name, street address, city, state, postal code, country, phone number, country code, location of the device (derived from IP address, supplied by the user, other mechanisms), product’s MAC address, SSID of user’s Wi-Fi network, device schedules, device type, browser type, operating system, and application version and certain other device properties (e.g. status of sensors, the status of control settings, etc.), and geolocation of the mobile device associated with the connected device.
12.3. Any questions or concerns, including questions regarding notices, can be sent to firstname.lastname@example.org.
By signing or accepting the Service Agreement, the Data Controller and Data Processor have agreed to the terms of this DPA with the Standard Contractual Clauses, found at: