ENALYZER DATA PROCESSING AGREEMENT

(Last revised and updated 22.03.2021. Click here to see the prior version until 22.03.2021).

This Addendum constitutes an integral part of the Data Processing Agreement between Enalyzer and the Customer, if the Customer enables the AI Features and accepts the Addendum within Enalyzers survey software. (Effective by 10. November 2023)

Applicable to the agreement(s) entered into by Enalyzer Software A/S and the customer regarding the use of Enalyzers services.

Please be aware, if you are a user of our other products, Enalyzer Survey Solution and Enalyzer Relations Panel, the following Data Processing Agreement also applies.

BETWEEN:

Customer hereinafter referred to as “Controller”

and

Enalyzer Software A/S, CVR-No. 32443591, having its registered office at Refshalevej 147, 1431 Copenhagen, Denmark, hereinafter referred to as "Enalyzer" or “Processor”

collectively referred to as “Parties” and individually referred to as “Party”

WHEREAS

Processor offers various online software services including among others a survey and reporting tool to Controller via Processor’s online platform (“Processor’s Services”) which include processing of “Personal Data” (as defined under clause 1.3). In that capacity, the Processor is a data processor in a legal sense.
Controller intends to use Processor’s Services. By usage of Processor’s Services, Controller may share Personal Data of its Data Subjects with Processor and is in that capacity a data controller in a legal sense.
Parties acknowledge and agree that Controller solely determines the means and purposes for the processing of Personal Data by Processor.
The purpose of the Agreement is to ensure the Parties' compliance with Article 28 (3) of the General Data Protection Regulation, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter "the GDPR") stipulating specific requirements to the content of a data processing agreement.
In this Agreement, the Parties wish to set out the subject matter and duration of the processing of Personal Data, the nature and purpose of the processing, the type of Personal Data and categories of data subjects and the obligations and rights of the Parties.
In the event of any discrepancies between this Agreement and any other agreements between the Parties, including the Main Agreement (as defined in clause 1.9), concerning a matter in relation to the processing of Personal Data, the terms of this Agreement shall prevail.

THE CONTROLLER AND THE PROCESSOR HAVE AGREED

as follows in order to ensure adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals with regard to the processing of Personal Data as specified in Appendix 1:

1. Definitions

1.1. In addition to the definitions used elsewhere in this Agreement, the definitions set out below shall apply and have the meaning set out therein.

1.2. ‘Agreement’ shall mean this data processing agreement including its appendices, which forms an integral part of the data processing agreement.

1.3. ‘Personal Data’ shall mean any information Processed by Processor in connection with the provision of the Processors’ Services under this Agreement relating to an identified or identifiable natural person ('Data Subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to his physical, physiological, genetic, mental, economic, cultural or social identity of that person.

1.4. ‘Processing’ shall mean any operation or set of operations by Processor in connection with the Agreement, which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

1.5. 'Sub-processor' shall mean any processor engaged by the Processor for the Processing of Personal Data on behalf of the Controller.

1.6. 'Third Country' shall mean countries outside the EU.

1.7. ‘Third Party’ shall mean any natural or legal person, public authority, agency or any other body other than the Data Subject, the Controller, the Processor and the persons who, under the direct authority of the Controller or the Processor, are authorized to Process the Personal Data based on the Main Agreement.

1.8. ‘Personal Data Breach’ shall mean a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.

1.9. ‘Main Agreement’ shall mean the creation of an account and/or any other agreement entered into between Controller and Processor regarding the use of Processor’s Services.

1.10. ‘Processor’s Services’ shall mean (i) the various online software services rendered by Processor pursuant to the Main Agreement, including among others provision of a survey and reporting tool and hosting of Controller's data, including Personal Data and/or (ii) support and/or education services provided by the Processor from time to time to the Controller.

1.11. ‘EU’ shall mean the European Union including the European Economic Area (EEA).

2. Scope and details of Processing and instruction to the Processor

2.1. The details of the Processing of Personal Data, and in particular the categories of Data Subjects, types of Personal Data and the purposes for which they are Processed, are specified in Appendix 1.

2.2. The Controller hereby authorises the Processor to Process the Personal Data on behalf of the Controller on the terms and conditions set out in this Agreement. The Processor shall Process the Personal Data only on documented instructions from the Controller, see Appendix 2.

2.3. The Parties agree that this Agreement shall constitute the instructions as of the date of the Agreement.

2.4. The Controller may at any time amend or specify the instructions in accordance with clause 11 of this Agreement. Notwithstanding the foregoing, clause 11 can only be amended according to written mutual agreement between the Parties.

3. Security measures

3.1. The Processor agrees to implement appropriate technical and organisational measures in such a manner that the Processing of the Personal Data will meet the requirements of the GDPR and ensure the protection of the rights of the Data Subjects.

3.2. The details of the security measures taken by Processor in this respect of the Processing of Personal Data, are specified in Appendix 2.

3.3. The Parties agree that the technical and organisational measures and level of security set out in Appendix 2 are sufficient to comply with the Processor’s obligations set lout in this clause 3 at the time of the conclusion of this Agreement.

3.4. If the Controller after the conclusion of this Agreement based on its own security and risk assessment requests that the Processor shall implement additional security measures or other technical or organisational measures than agreed to in Appendix 2, such request shall be handled in accordance with and is subject to clause 11 of this Agreement.

4. Obligations of the Controller

4.1. The Controller agrees to ensure that the Controller always collects and processes Personal Data in accordance with and do not violate the relevant provisions of the GDPR and other applicable EU and national data protection law in the Member State in which, the Controller is established.

4.2. The Controller shall immediately notify the Processor in writing after becoming aware of any possible unauthorised use of log-in information, passwords, credentials or other security breaches in the Controller’s systems, at the Controller’s premises or otherwise under the Controller’s responsibility that are or may be related to or have an impact on the Processor’s Processing of Personal Data under this Agreement.

5. Obligations of the Processor

The Processor agrees:

5.1. to Process the Personal Data in accordance with the security measures set out in Appendix 2 and any measures that may have been mutually agreed in accordance with clause 11 of this Agreement;

5.2. to Process Personal Data only in accordance with the written instructions from the Controller, cf. clause 2 of this Agreement, including with regard to transfers of Personal Data to a Third Country or an international organisation, unless required to do so by Union or Member State law to which the Processor is subject; in such a case, the Processor shall inform the Controller of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest;

5.3. where necessary and taking into account the nature of the Processing, to assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation by law to respond to requests for exercising the Data Subjects’ rights laid down in chapter III of the GDPR;

5.4. where necessary and taking into account the nature of the Processing, to assist the Controller in its compliance with an obligation to carry out a data protection impact assessment (“DPIA”) and prior consulting of supervisory authorities where required, cf. articles 35 and 36 of the GDPR;

5.5. to provide Controller upon request and within reasonable time the information necessary to demonstrate compliance with the obligations laid down in this clause 5;

5.6. to cooperate (including representatives of Processor), on the Controller’s request, with the supervisory authority in the performance of its tasks;

5.7. to allow for and contribute during normal business hours to reasonably necessary audits including inspections, conducted by an external qualified auditor mandated by the Controller, solely for the purpose of fulfilment of the Controller's obligations laid down in Article 28 of the GDPR and for accurately stipulated research questions in this connection provided that such external qualified auditor is subject to and bound by confidentiality obligations as stipulated in clause 12 of this Agreement;

5.8. to once a year make an audit report available on the Processor’s website with information indicating that the Processor complies with the Agreement. The report shall be prepared at the Processor's expense based on applicable, acknowledged audit standards, e.g. ISAE 3000 or 3402 or similar;

5.9. to notify Controller in the event of a Personal Data Breach as set out in clause 6 of this Agreement;

5.10. to notify Controller in the event that a supervisory authority contacts Processor in relation to the Processing of Personal Data, insofar as permitted by law.

6. Cost for Processor’s assistance and audits

6.1. If the Controller requires assistance from the Processor or the Processor’s Sub-processors pursuant to clauses 5.3, 5.4, 5.5, 5.6 and/or 5.7, the Processor shall be entitled to payment from the Controller for such assistance at the hourly rates and compensation of costs as set out in Appendix 3.

6.2. If the Controller requires additional audit reporting or additional other similar documentation than what is covered and comprised by the annual audit report prepared by the Processor, see clause 5.8, the Processor shall be entitle to payment from the Controller for the preparation of such additional reporting and documentation in accordance with the hourly rates and compensation of costs as out in Appendix 3.

6.3. Notwithstanding clauses 6.1 and 6.2, Processor is not entitled to payment for assistance or additional reporting or documentation if the Controller’s request arises out of circumstances, which are attributable to Processor’s breach of security or Processor’s breach of its obligations as set out in this Agreement.

7. Personal Data breach

7.1. Processor will notify the Controller without undue delay after becoming aware of a Personal Data Breach.

7.2. The aforementioned notification shall describe the nature of the Personal Data Breach including where possible: (i) the (estimated) time of the Personal Data Breach; (ii) the likely consequences of the Personal Data Breach and (iii) reasonable measures taken or proposed by the Processor to mitigate the consequences of the Personal Data Breach.

8. Records of Processing activities

8.1. The Processor shall maintain, in written and electronic form, records of all categories of Processing activities carried out on behalf of the Controller according to the Main Agreement.

8.2. The Processor shall make the records available to the supervisory authority on request.

9. Deletion of Personal Data

9.1. Processor will give Controller access to system functionality in order for the Controller to delete and/or return (i.e. export) any and all of Controller’s data including the Personal Data during the term of the Agreement and/or upon the termination of the Agreement, see clause 14.

9.2. The process and timeframes for deletion of Controller’s data including the Personal Data are described in Appendix 4.

9.3. If Controller requests the Processor’s assistance to delete and/or return (i.e. export) the Controller’s data including the Personal Data during the term of the Agreement and/or upon the termination of the Agreement, see clause 14, such assistance shall be rendered by Processor at Controller’s expense and is charged under the conditions set out in Appendix 4.

10. Sub-processing

10.1. The Processor shall not engage a Sub-processor, unless this is approved by the Controller by (i) a general or specific authorisation according to Appendix 5 to this Agreement, or (ii) specific instruction from the Controller.

10.2. In the event that Processor engages Sub-processors for carrying out Processing activities on behalf of the Controller in accordance with Appendix 5, the same data protection obligations as set out in this Agreement shall be imposed on that Sub-processor by way of a contract or other legal act under EU or national Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the Processing will meet the requirements of this Agreement.

10.3. In the case of general written authorisation, the Processor shall inform the Controller of any intended changes concerning the addition or replacement of Sub-processors, thereby giving the Controller the opportunity to object to such changes. However, the Controller cannot object to any intended changes concerning the addition or replacement of Sub-processors if the new Sub-processor provides sufficient guarantees with respect to implementation of appropriate technical and organizational measures in such a manner that the Processing will meet the requirements of the GDPR as outlined in this Agreement. If the Controller does not object to changes concerning the addition or replacement of Sub-processors within 30 days from the Processor’s notification of the intended changes, such changes shall be deemed to be accepted by the Controller.

10.4. Processor shall remain liable to the Controller for a Sub-processor's fulfilment of its data protection obligations.

10.5. The Controller may request in writing that the Processor demonstrates its Sub-Processor’s compliance with the obligations laid down in Article 28 of the GDPR. In such case, the Processor shall be entitled to fulfil this obligation by the audit reports (or similar documentation) that the respective Sub-Processors prepare and make available for this purpose. The foregoing is on the condition that such audit reports etc. contain information stating that the Sub-Processor in question complies with the GDPR and provided that such audit report(s) or similar documentation shall be based on applicable, acknowledged audit standards, such as ISAE 3000 or 3402 or similar standards. Any additional audit reporting or additional other similar documentation requested by the Controller will be at the Controller’s cost and expenses and is charged under the conditions set out in Appendix 3.

11. Change of instructions

11.1. Prior to any change of the instructions given by the Controller, see clause 2, the Parties shall to the widest possible extent discuss in good faith, and if possible agree on, reasonable terms for the implementation of such changes, including the implementation period and the related costs.

11.2. The Processor shall use reasonable endeavours to comply with any legislative changes. However, the Processor shall not be obligated to implement any change of the instructions if the Parties cannot in good faith agree to reasonable terms for the implementation. If the Parties fail to agree in good faith to reasonable terms regarding change of the instructions each Party shall be entitled to terminate this Agreement with a written notice of 60 days, provided that such changes are deemed necessary to comply with the GDPR or other applicable EU or national data protection laws and regulation. The Main Agreement and any other agreement between the Parties involving Processing of Personal Data shall automatically terminate at the same time.

11.3. Unless otherwise agreed the following applies:

(i) The Processor shall without undue delay initiate implementation of agreed changes of the instructions and shall ensure that such changes are implemented without undue delay in relation to the nature and extent of the changes;

(ii) The Processor is entitled to payment of all costs directly connected with changes of the instructions, including implementation costs and increases costs for delivery of the Services;

(iii) The Controller must without undue delay be informed of the indicative estimate of the implementation period and the related costs;

(iv) Changes to the instructions are not regarded as being in force until the time when such changes have been implemented, provided that the implementation of such changes is carried out in accordance with this clause 11.2;

(v) The Processor is exempt from liability towards the Controller for failure to deliver the Services to the extent (including in terms of time) that delivery of the Services will be contrary to the changed instructions, or delivery in accordance with the changed instructions is impossible. This may be the case in the event that (i) the changes cannot be made due to technical, practical or legal reasons, (ii) the Controller explicitly states that the changes are to apply before implementation is possible, or (iii) during the period until the Parties carry through any necessary changes of the Agreement in accordance with the amendment procedures herein.

12. Confidentiality

12.1. Neither Party shall disclose any confidential information. This information includes, but is not limited to Personal Data, documents marked "confidential", information of which the confidential nature must be assumed and information that has not been made publicly available by any Party.

12.2. A Party may only disclose confidential information when obliged by applicable law or unless otherwise agreed upon, signed in writing.

12.3. Processor ensures that persons authorised by it to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

12.4. The Processor must ensure that the persons performing work for the Processor and who have access to Personal Data, only process such Personal Data as instructed by the Controller, unless processing is required under applicable EU law or national legislation.

13. Liability

13.1. The Processor is liable for damages in accordance with the general rules of Danish law subject to the terms set out in this clause 13.

13.2. Notwithstanding any limitations of the Processor’s liability set out in this clause 13, the Processor shall be liable for documented loss suffered or costs incurred by the Controller due to the Processor’s wilful misconduct or gross negligence or due to the Processor's failure to comply with its mandatory obligations towards a supervisory authority.

13.3. The Processor has taken out a Professional Indemnity & Cyber Insurance with an insurance coverage of EUR 1,250,000 per claim and in the annual aggregate (the “Insurance Policy”). In any case, the Processor’s liability is limited to the amount that is paid out in that specific case under the Insurance Policy, and if applicable, increased by the deductible.

13.4. If for whatever reason, the Insurance Policy does not entitle Processor to any payment, the Processor's liability will in any case be limited to direct damages, with a maximum amount of three (3) times the sum invoiced to Controller pursuant to the Main Agreement in the foregoing twelve (12) months after a claim was made.

13.5. The Processor shall not be liable to pay damages for any indirect, consequential or incidental loss or damages including but not limited to loss of goodwill, loss of expected profit and/or loss of operation, arising out of or in connection with the Agreement.

13.6. The Processor shall not be liable for loss or damages if caused by the Controller’s failure to comply with its obligations according to applicable EU or national data protection laws and regulations or this Agreement. Nor shall the Processor be liable for loss or damages in the event of the Controller’s breach of the Main Agreement and/or other agreement between the Parties involving Processing of Personal Data, or the Controller’s failure to comply with its obligations towards a supervisory authority.

13.7. Any claims put forward by the Controller for compensation of damages will expire 12 months after the date on which the Controller became aware of or ought to have become aware of said damage.

14. Term and Termination of the Agreement

14.1. The commencement date of the Agreement is the same date as the commencement date of the Main Agreement.

14.2. The termination of the Agreement does not affect provisions relating to confidentiality and those provisions, which by nature are intended to survive the termination.

14.3. This Agreement forms an integral part of the Main Agreement, and consequently terminates simultaneously with the termination of the Main Agreement.

14.4. A Party may terminate the Main Agreement in the event of the other Party’s material breach of this Agreement. Where such breach is capable of being remedied, a Party may only terminate the Main Agreement if the breaching Party has not remedied such breach within 30 days after giving written notice of such breach and the consequences of failure to remedy the breach.

14.5. Notwithstanding termination of this Agreement according to this clause 14, the Agreement shall be force for as long as the Processor Processes Personal Data on behalf of the Controller, for example in respect of the deletion processes described in Appendix 4.

15. Governing Law and amendments

15.1. The legal relationship between Controller and Processor is exclusively governed by the laws of Denmark without regard to its principles of conflicts of law. Disputes between the Parties will, in the first instance, be exclusively resolved by and subject to the District Court of Copenhagen, Denmark as venue.

15.2. In the event that Parties agree to amend the Agreement, said amendments shall be attached to the Agreement in an additional Appendix 6. Amendments to the Agreement are only valid if the provisions concerned in the Agreement are explicitly referred to (when applicable) and explicitly derogated from; and only if the appendix is signed and dated by both Parties.

Appendix 1 Details of Processing of Personal Data

This Appendix forms part of the Agreement.

1. Description of the activities by the Processor relevant to the Processing of Controller’s Personal Data:

1.1. Depending on the scope and nature of the Main Agreement, the activities to be performed by the Processor under this Agreement relevant to the Processing of Personal Data may include the following:

1.1.1. Provision of various online data processing Services including among others a survey and reporting tool via software solutions and platform made available from enalyzer.com.

1.1.2. Hosting of Personal Data.

1.1.3. Provision of support and/or education Services.

2. Third Party Integration Services

2.1. As part of the Main Agreement, when using Enalyzer the Controller can choose to connect to various integration services and/or applications using third party software (“Third Party Integration Services). Some of these Third Party Integration Services are made available to the Controller by the Processor’s Sub-processors (see Appendix 5), whereas other Third Party Integration Services are offered to the Controller by independent service providers that are not Sub-processors of the Processor. In such case, the Controller must enter into a separate agreement with the third party service provider.

3. Data Subjects

3.1. The Controller will import Personal Data to the Services for Processing by Processor that may concern any of the following categories of Data Subjects, including but not limited to:

3.1.1. Controller’s employees, board members and officers

3.1.2. Controller’s customers, clients and other business partners

3.1.3. Citizens of Controller

3.1.4. Students, pupils and other users of public and private institutions

3.1.5. Children

3.1.6. Patients and relatives

3.1.7. Private users

3.1.8. Business Users

3.1.9. Members of foundations, unions, associations and/or
political originations

4. Categories of data

4.1. The Personal Data Processed may fall within any of the following categories of data:

4.1.1. Personal Data covered by GDPR article 6 including but not limited to contact information such as name, address, phone and/or mobile, gender, age, date of birth, preferences, employment position, family status etc.;

4.1.2. national identification number;

4.1.3. Personal Data covered by GDPR article 9)*;

4.1.4. Personal Data relating to criminal convictions and offences (cf. GDPR art. 10).

*GDPR art. 9 includes: data revealing racial or ethnic origin, political opinions, religious and/or philosophical beliefs, trade union membership, processing of genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health and/or data concerning a natural person's sex life or sexual orientation.

For the processing of Personal Data covered by art. 9 the Controller must obtain explicit consent from the Data Subjects.

Appendix 2

INSTRUCTIONS RE PROCESSING OF PERSONAL DATA

This Appendix forms part of the Agreement.

A. Security of Processing

1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Controller and the Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:

(a) encryption of Personal Data when transmitted via public networks and in connection with remote access to Controller’s systems;

(b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of Processing systems and Services;

(c) the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;

(d) a process for testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the Processing.

2. In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by Processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed.

3. The Processor hosts the data, including Personal Data, of the Controller via Microsoft Cloud Azure. The online hosting Services are delivered from data centres solely situated within EU, in Ireland and the Netherlands.

4. The particular security measures to be taken out by the Processor under this Agreement are specified in more detail on www.enalyzer.com (Processor's Security and Privacy Protection Policies). The Controller hereby agrees that in respect of the Processor’s Processing of the Controller’s Personal Data under this Agreement the foregoing security measures constitute appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

B. Third Party Integration Services

1. If the Controller uses integration services and/or applications using third party software(“Third Party Integration Services”) where the Controller must enter into a separate agreement with the independent third party service provider, see Appendix 1, clause 2, the Controller hereby authorises and instructs the Processor to perform the following Processing on behalf of the Controller:

i) provide, transmit or transfer the data, including Personal Data, of the Controller to the third party provider of the relevant Third Party Integration Service, provided and only to the extent this is necessary for the performance and use by Controller of the said integration services and/or applications, and

ii) Process data, including Personal Data, of the Controller that are transferred from the third party provider of the relevant Third Party Integration Service to the Controller’s Services with Processor.

2. It is the sole responsibility and liability of the Controller to ensure the necessary basis of lawful Processing for the transfer of the Controller’s Personal Data to and from any third party provider of a Third Party Integration Service that is used by the Controller via Enalyzer.

3. Enalyzer shall not be responsible or liable for the Processing by any third party provider of the Controller’s Personal Data in this respect.

C. Processing location

1. Processing of the Personal Data is performed by Enalyzer at the location set out below:

Refshalevej 147, 1432 Copenhagen, Denmark - by Enalyzer A/S

2. Processing of Personal Data performed by Sub-Processor’s is done at the locations set out in Appendix 5.

Appendix 3 Costs for assistance and audits

This Appendix forms part of the Agreement.

1. In the event that Controller requires assistance from the Processor or any of the Sub-processors pursuant to this Agreement, such assistance is charged as follows:

1.1. payment for time spend per person, including preparation, at an hourly rate of € 150,- excluding VAT (if applicable), and

1.2. payment of reasonable costs and expenses incurred during the course of providing a task or otherwise as a necessary part of such task or other assistance.

2. Notwithstanding clause 1.1, in the event that the applicable hourly rate charged by a Sub-processor for the required assistance exceeds the hourly rate of € 150, Enalyzer shall be entitled to payment of the difference between the hourly rate set out in clause 1.1 and the rate charged by the Sub-Processor.

3. All costs and expenses of audits or inspections required and conducted by the Controller or its representatives in respect of the Processor’s or the Processor’s Sub-processors’ compliance with article 28 of the GDPR shall be borne solely by Controller unless otherwise specifically follows from the Agreement.

Appendix 4 Deletion of data

This Appendix forms part of the Agreement.

Data deletion

The processes and time frames for deletion of the Controller’s data including Personal Data is described below.

Notwithstanding the termination of the Agreement, the Processor's Processing of the Controller’s Personal Data during the deletion periods set out below is to be regarded as taking place according to the Controller’s instructions, see also clause 14 of the Agreement.

It is the sole responsibility of the Controller that its data including the Personal Data is deleted in compliance with the GDPR.

I. The Controller’s deletion of data during the term of the Agreement

During the term of the Agreement, the Controller can delete or export its data including the Personal Data at any time by using the system functionality for deletion/export.

Upon deletion of the data by the Controller, the Processor will automatically delete the data within a period of up to 90 days, depending on the type of data (e.g. data concerning respondents will be deleted in 10 days and a whole survey project will be deleted in 90 days).

If the Controller deletes an organization, the Processor will automatically delete all data after 110 days.

In all cases, backups of data are in any case kept by the Processor for thirty (30) days after the automatic deletion has been made, where after the backups will be deleted by the Processer, unless Union or Member State law requires storage of the Personal Data.

II. Deletion or export of data upon Controller’s request

The Controller may at any time request the Processor’s assistance to perform deletion of or to export data including Personal Data subject to separate payment for these services at an hourly rate of 150 Euro.

Upon receipt of such written request from the Controller, the Processor will within a maximum of five (5) working days immediately delete or export Controller’s data in accordance with the Controller’s instructions.

Backups of all data are in any case kept by the Processor for thirty (30) days after deletion where after the backups will be deleted by the Processer, unless Union or Member State law requires storage of the Personal Data.

III. Deletion of data after the Controller’s deletion of an account

In the event that the Controller deletes its Enalyzer account, the Main Agreement will automatically terminate. In such case a grace period of twenty (20) days will take effect. The grace period is provided in case the Controller’s deletion of the account was due to a mistake.

Unless prior to the expiry of the grace period (i) the Controller informs the Processor in writing that the Controller’s deletion of the account was a mistake, or (ii) the Parties otherwise agree to continue the Main Agreement, the deletion process will automatically initiate after the expiry of the grace period and the Controller’s data including the Personal Data will be automatically deleted after ninety (90) days by the Processor.

Backups of all data are in any case kept by the Processor for thirty (30) days after deletion where after the backups will be deleted by the Processer, unless Union or Member State law requires storage of the Personal Data.

Appendix 5

Sub-processors and transfer to third countries outside EU

This Appendix forms part of the Agreement.

Sub-processors

1. The Controller hereby gives the Processor its prior general authorisation to use Sub-processors. A list of Sub-processors currently used by the Controller is set out in the table set out below.

Required Sub-Processor

Microsoft Azure is the underlying infrastructure for the entire Enalyzer software platform including hosting, database and backup storage. All data is kept within EU and provided by highly secure and scalable hosting centres in Ireland and the Netherlands. For more information on Microsoft Azure visit www.enalyzer.com.

Name	Corporate Address	Processing Location	Hosting Platform	Description of processing activity
Microsoft Corporation	1 Microsoft Way Redmond, WA 98052 USA	Dublin, Ireland (EU) Amsterdam, The Netherlands (EU)	Microsoft Azure	Hosting Enalyzer Platform

Optional-Sub-Processors

Certain features or services within the platform, can be chosen by the user. In these cases, the following sub-processors apply.

For more information on these visit www.enalyzer.com.

Name	Corporate Address	Processing Location	Hosting Platform	Description of processing activity
MailJet (Mailgun Technologies Inc.)	112 E Pecan St. #1135 San Antonio, TX 78205 USA	Frankfurt, Germany (EU) Saint-Ghislain, Belgium (EU)	Google Cloud	Sending of e-mails. E.g. invitations to surveys and reports. Mailjet is hosting the e-mail engine.
SendGrid (Twilio Inc.)	375 Beale St. #300 San Francisco, CA 94105 USA	Herndon, VA (USA) Las Vegas NV (USA) Chicago, IL (USA)	Amazon Web Services	Sending of e-mails. E.g. invitations to surveys and reports. Sendgrid is hosting the e-mail engine.
Zendesk	989 Market St San Francisco, CA 94103 USA	Frankfurt, Germany (EU) Dublin, Ireland (EU)	Amazon Web Services	Support system. E.g. when users request support through a ticket within Enalyzer or by sending a mail to support@enalyzer.com.

Transfer of Personal Data to third countries outside EU

1. Controller hereby authorizes the Processor to transfer Personal Data for processing by its Sub-Processors at their processing locations in the third countries or territories outside EU, that are specified in above table. Processor must ensure that the transfer of the Personal Data to the third countries mentioned in the above table is lawful, including i.e. that, there is legal basis ensuring an adequate level of protection of the transferred Personal Data.

2. The legal basis for such transfer may be in the form of:

· The Commission’s decision in accordance with Art. 45(3) of the GDPR that the third countries in question ensures an adequate level of protection; or

· Standard Contractual Clauses (SCC) (Controller-Processor)

Controller hereby authorises Processor to enter into Standard Contractual Clauses (SCC) (Controller-Processor) on behalf of the Controller for the transfer to Sub-Processors outside EU in order to provide for a legal basis of transfer including such other appropriate safeguards as is required in order to ensure the lawful processing of the Personal Data in compliance with the GDPR.