Vendor Data Processing Agreement
Last Updated on September 29, 2021
BETWEEN: Ayla Networks, Inc., a company incorporated under the laws of Delaware, having its principal place of business at 680 N. McCarthy Blvd., Suite 100, Milpitas, CA 95035 (“Ayla”), whose privacy officer can be contacted at: privacy@aylanetworks.com; AND the company specified in the Service Agreement (“Vendor” or “Data Processor”), whose privacy officer can be contacted as specified in the Service Agreement or ancillary documents.
1. Subject Matter of this Data Processing Agreement
1.1. This Data Processing Agreement (“DPA”) applies exclusively to the processing of personal data that is subject to applicable data protection laws in the scope of the agreement between the parties for the provision of certain services, hereinafter, the “Service Agreement”.
1.2. Terms such as ‘processing’, ‘personal data’, ‘data subject’, “Data Controller” and “Data Processor” shall have the meaning ascribed to them in the EU data protection laws. A detailed description of the data processed is further described in the Miscellaneous section below.
2. The Data Controller and the Data Processor
2.1. In many circumstances, Ayla may be a data processor, in which case Ayla appoints the Vendor specified above as the sub-processor, which shall not change the obligations of either Ayla or the Vendor under this DPA, as the Vendor will remain the Data Processor with respect to Ayla in such event. Therefore, for the purposes of this DPA, Ayla shall be the Data Controller, and Vendor shall be the Data Processor. The Data Controller will determine the scope, purposes, and manner by which the personal data may be accessed or processed by the Data Processor. The Data Processor will process the personal data only as set forth in Data Controller’s written instructions.
2.2. The Data Processor will only process personal data on documented instructions of the Data Controller in such manner as and to the extent that is appropriate for the provision of the services, except as required to comply with a legal obligation to which the Data Processor is subject. In such case, the Data Processor shall inform the Data Controller of such obligation before processing, unless prohibited from furnishing such information to the Data Controller. The Data Processor shall never process personal data in a manner inconsistent with the Data Controller’s documented instructions. The Data Processor shall immediately inform the Data Controller if, in its opinion, an instruction infringes EU data protection provisions.
2.3. The parties have entered into a Service Agreement in order to benefit from the expertise of the Data Processor in securing and processing certain data, which may include personal data, for the purpose of providing services related to software platforms, marketing or sales services, customer or technical support services, or human resource-related services to Data Controller. The Data Processor shall be allowed to exercise its discretion in the selection and use of such means it considers necessary to pursue those purposes, subject to the requirements of this DPA.
2.4. Ayla warrants that it has obtained the necessary rights to provide the personal data to Data Processor for the processing to be performed in relation to the services. To the extent required by applicable data protection law, Ayla is responsible for ensuring that any necessary data subject consents to this processing are obtained, and for ensuring that a record of such consents is maintained. If such consent is revoked by the data subject, Data Controller shall communicate such revocation to the Data Processor, and Data Processor shall implement Ayla’s instruction regarding the further processing of that personal data.
3. Confidentiality
3.1. Without prejudice to any existing contractual arrangements between the parties, the Data Processor shall treat all personal data as strictly confidential, and it shall inform its employees, agents, and/or approved subprocessors who are engaged in the processing of the confidential nature of personal data. The Data Processor shall ensure that all such persons or parties have signed an appropriate confidentiality agreement, are otherwise bound to a duty of confidentiality, or are under an appropriate statutory obligation of confidentiality.
4. Security
4.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, without prejudice to any other security standards agreed upon by the parties, Ayla and Data Processor shall implement appropriate technical and organizational measures to ensure a level of security of the processing of personal data appropriate to the risk. These measures shall include as appropriate:
(a) measures to ensure that the personal data can be accessed only by authorized personnel for the purposes set forth in this DPA;
(b) In assessing the appropriate level of security, the parties shall consider the risks presented by processing, for example from accidental or unlawful destruction, loss, or alteration, unauthorized or unlawful storage, processing, access, or disclosure of personal data;
(c) the pseudonymization and encryption of personal data;
(d) the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
(e) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
(f) a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing of personal data;
(g) measures to identify vulnerabilities with regard to the processing of personal data in systems used to provide services to the Data Controller.
4.2. The Data Processor shall have in place an appropriate written security policy with respect to the processing of personal data, outlining the measures set forth in Article 4.1.
4.3. At the request of Ayla, the Data Processor shall demonstrate the measures it has taken pursuant to this Article 4 and shall allow Ayla to audit and test such measures. Upon at least 90 days prior written notice to the Data Processor, Ayla may audit the Data Processor´s operations as these relate to the personal data. The Data Processor shall cooperate with such audits and shall grant Ayla´s auditors reasonable access to any premises and devices involved with the processing of the personal data which are under the Data Processor’s control.
5. Improvements to Security
5.1. The parties acknowledge that security requirements are constantly changing and that effective security requires frequent evaluation and regular improvements of outdated security measures. The Data Processor will therefore evaluate the measures on an ongoing basis and will improve these measures in order to maintain compliance with the requirements set out in Article 4. The parties will negotiate in good faith the cost, if any, to implement material changes required by specific updated security requirements set forth in applicable data protection law or by data protection authorities of competent jurisdiction.
6. Data Transfers
6.1. The Data Processor shall notify the Data Controller of any planned transfers of personal data to a country outside of the European Economic Area (EEA) and shall only perform such transfer after obtaining authorization from Ayla, which may not be unreasonably withheld, or in accordance with the Standard Contractual Clauses. The Data Processor may provide such notification to privacy@aylanetworks.com.
6.2. To the extent that the Ayla or the Data Processor are relying on a specific statutory mechanism to normalize international data transfers that are subsequently modified, revoked, or held in a court of competent jurisdiction to be invalid, the Data Controller and the Data Processor agree to cooperate in good faith to promptly terminate the transfer or to pursue a suitable alternate mechanism that can lawfully support the transfer.
6.3. The Standard Contractual Clauses and the terms of this section will apply to all processing of personal data by the Data Controller where the personal data is transferred from the EEA or UK to outside the EEA or UK (as applicable), either directly or via onward transfer, to any country or recipient: (a) not recognized by the European Commission or UK authorities (as applicable) as providing an adequate level of protection for personal data (as described in the data protection laws), and (b) not covered by a suitable framework recognized by the relevant authorities as providing an adequate level of protection for personal data, including Binding Corporate Rules or a valid safe harbor framework.
6.4. Where personal data is transferred from any other country or region, applicable regional laws shall apply. For data subjects located in the People’s Republic of China (PRC), any personal data will not be transferred outside of the PRC without the express consent of any applicable government authority. The data controller shall be responsible for obtaining such consent.
6.5. Data Controller is responsible for notifying Data Processor in writing if there is a change in information begin transferred to Data Controller’s systems.
7. Incident Management & Information Obligations
7.1. When the Data Processor becomes aware of an incident that impacts the processing of personal data, it shall promptly notify the Data Controller about the incident, shall at all times cooperate with the Data Controller, and shall follow the Data Controller’s instructions regarding its personal data impacted by such incidents so that the Data Controller can perform a thorough investigation of the incident, to formulate a correct response, and to take suitable further steps.
7.2. The term “incident” used in Article 7.1 shall mean:
(a) a complaint or request with respect to the exercise of a data subject’s rights under EU data protection law;
(b) an investigation into or seizure of the personal data by government officials, or a specific indication that such an investigation or seizure is imminent;
(c) any unauthorized or accidental access, processing, deletion, loss or any form of unlawful processing of the personal data;
(d) any breach of the security or confidentiality as set out in Articles 3 and 4 of this DPA leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data, or any indication of such breach has occurred or is about to occur;
7.3. The Data Processor shall have in place written procedures that enable it to promptly respond to the Data Controller about an incident. Where the incident is reasonably likely to require a data breach notification by the Data Controller under applicable EU data protection law, the Data Processor shall implement its written procedures in such a way so that it can notify the Data Controller no later than 24 hours of having become aware of such an incident.
7.4. Any notifications made to the Data Controller shall be addressed to the employee(s) of the Data Controller whose contact details are provided in the Service Agreement, and shall contain:
(a) a description of the nature of the incident, including possible categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
(b) the name and contact details of the Data Processor’s data protection officer or another contact point where more information can be obtained;
(c) a description of the likely consequences of the incident; and
(d) a description of the measures taken or proposed to be taken by the Data Processor to address the incident including any measures to mitigate its possible adverse effects.
7.5. Data Processor shall notify the Data Controller of a deletion request and will follow directions as specified by Data Controller. Data Controller authorizes Data Processor to respond to deletion requests from a data subject to the extent necessary under applicable regulations, provided that Data Processor notifies Data Controller in writing of its response.
8. Contracting with Sub-Processors
8.1. The Data Controller authorizes the Data Processor to engage subprocessors for activities related to the Service Agreement as long as the Data Processor provides written notice of its subprocessors and respective locations and roles. Data Processor shall inform the Data Controller in writing of any addition or replacement of such sub-processors. The Data Controller shall have an opportunity to object to such changes.
8.2. Notwithstanding any authorization by the Data Controller within the meaning of the preceding paragraph, the Data Processor shall remain fully liable vis-à-vis the Data Controller for the performance of any such subprocessor that fails to fulfill its data protection obligations.
8.3. The Data Processor shall ensure that the subprocessor is bound by substantially the same data protection obligations of the Data Processor under this Data Processing Agreement, shall supervise compliance thereof, and impose on its subprocessors the obligation to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of EU data protection law.
8.4. The Data Controller may request that the Data Processor audit a subprocessor or provide confirmation that such an audit has occurred (or, where available, obtain or assist Data Controller in obtaining an audit report concerning the subprocessor’s operations) to ensure compliance with its obligations in conformity with this DPA. Both parties agree that if a subprocessor provides third-party attestation of adherence to an approved code of conduct or certification mechanism pursuant to Article 42 of the GDPR, such attestation shall be sufficient for this audit requirement. The Data Controller is a third party beneficiary of the agreements between the Data Processor and its various subprocessors and as such, may terminate the applicable agreement and instruct Data Processor’s subprocessor to erase or return data if Data Processor is in the insolvency or similar proceedings or ceases to exist or provide the contracted services.
9. Returning or Destruction of Personal Data
9.1. Upon termination of this DPA, upon the Data Controller’s written request, or upon fulfillment of all purposes agreed in the Service Agreement whereby no further processing is required, the Data Processor shall, at the discretion of the Data Controller, either delete, destroy or return all personal data to the Data Controller and destroy or return any existing copies.
9.2. The Data Processor shall notify all subprocessors of a deletion request or of the termination of the DPA and shall ensure that all such subprocessors either destroy the personal data or return the personal data to the Data Controller, at the discretion of the Data Controller.
10. Assistance to Data Controller
10.1. The Data Processor shall assist the Data Controller by appropriate technical and organizational measures, to the extent possible, in fulfilling the Data Controller’s obligation to respond to requests for exercising the data subject’s rights under the GDPR.
10.2. The Data Processor shall assist the Data Controller in ensuring compliance with the obligations pursuant to Section 4 (Security) and prior consultations with supervisory authorities required under Article 36 of the GDPR, taking into account the nature of processing and the information available to the Data Processor.
10.3. The Data Processor shall make available to the Data Controller all information necessary to demonstrate compliance with the Data Processor’s obligations and allow for and contribute to audits, including inspections, conducted by the Data Controller.
11. Duration & Termination
11.1. This DPA shall be effective as of the effective date of the Service Agreement.
12. Miscellaneous
12.1. In the event of any inconsistency between the provisions of this DPA and the provisions of the Service Agreement, the provisions of this DPA shall prevail.
12.2. Depending on the terms of the Service Agreement, the following data may be transferred from Data Controller to Data Processor:
• Email address or account name, user-generated password
• IP or ethernet address (both WAN and LAN)
• Device type, browser type operating system, and application version
• Also collected, but anonymized by the product before transmission to the cloud: BSSIDs of Wi-Fi Access Points that the product can see (used for debugging purposes
12.3. Any questions or concerns, including questions regarding notices, can be sent to privacy@aylanetworks.com.
By signing or accepting the Service Agreement, the Data Controller and Data Processor have agreed to the terms of this DPA with the Standard Contractual Clauses:
Data Processing - Vendor Standard Contractual Clauses (EU)