Data Processing Agreement
The Controller and the Processor shall also be referred to collectively as the "Parties" and individually as "Party".
- In this DPA, the following terms shall have the following meanings:
- "Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
- "Customer Content" shall mean Personal Data submitted by the Customer to the Services or stored on Customer's behalf through Customer's account in connection with Customer's use of the Services which includes electronic data, email bodies, email recipients, text, voice, video, images, sound or communication logs.
- "Customer Subscription Data" means Personal Data that relates to Customer's interactions and association with CallHippo. This shall be inclusive of the names and/or contact details of individuals authorized by the Customer to access Customer's account, along with billing information of individuals that Customer has associated with its account. Customer Subscription Data shall also include any data CallHippo may require to collect for the purpose of identity verification, amongst other legal obligations.
"Customer Usage Data" means data relating to the Customer's account activity Processed by CallHippo for the purposes of passing on Customer Content to the intended recipient. This shall include data used to identify the source and destination of Customer Content, such as (a) individual data subjects' telephone numbers, the date, time, duration and the type of communication, along with data on the location of the device generated in the context of providing the Services; and (b) communication logs used to identify the source of Service requests, improve and prevent system abuse.
- "Data Protection Laws" shall mean applicable data protection laws in connection with the Terms.
- "Data Subject" means any identified or identifiable natural person.
- "GDPR" shall mean the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
- "Model Clauses" means the standard contractual clauses for Processors as approved by the European Commission (Decision C(2010)593) and available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02010D0087-20161217 (as amended or updated from time to time).
- "Personal Data" shall mean any information relating to a Data Subject that is Processed by Processor as part of providing the services to Controller.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.
"Process" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
"Processor" means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.
"Sensitive Data" means Personal Data consisting of a Data Subject's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation. It also includes information about an individual's criminal offences or convictions, as well as any other information deemed sensitive under applicable data protection laws.
"Services" means the cloud-based telecommunication services provided by CallHippo that the Customer has subscribed to under the Terms.
2. Scope, Duration and Responsibilities
- This DPA applies to Processing of Customer Content.
- CallHippo shall Process Customer Content for the term of this DPA and only in accordance with this DPA, especially as mentioned in the respective Appendix.
- Within the scope of the Terms, each Party shall be responsible for complying with its respective obligations as Controller and Processor under Data Protection Laws.
3. Relationship of the Parties
- CallHippo as a Processor: The Parties acknowledge and agree that with regard to the Processing of Customer Content, Customer may act either as a Controller or Processor and CallHippo is a Processor.
4. Term and Termination
- This DPA becomes effective upon signature. It shall continue to be in full force and effect as long as CallHippo is Processing Customer Content pursuant to the Terms and shall terminate automatically thereafter.
- Where amendments are required to ensure compliance of this DPA or an Appendix with Data Protection Laws, the Parties shall make reasonable efforts to agree on such amendments upon request of the Controller. Where the Parties are unable to agree upon such amendments, either Party may terminate Customer's use of the Services with thirty (30) days written notice to the other Party.
5. Processing Instructions for Customer Content
- CallHippo will Process Customer Content in accordance with the Customer's instructions. This DPA contains Customer's initial instructions to CallHippo with respect to the Customer Content. The Parties agree that the Customer may communicate any change in its initial instructions to CallHippo by way of amendment to this DPA.
- For the avoidance of doubt, any instructions that would lead to Processing outside the scope of this DPA (e.g. because a new Processing purpose is introduced) will require a prior agreement between the Parties and, where applicable, shall be subject to the contract change procedure hereunder.
- CallHippo shall without undue delay inform the Controller in writing if, in CallHippo's opinion, an instruction infringes Data Protection Laws, and provide a detailed explanation of the reasons for its opinion in writing.
6. Processor Personnel
CallHippo will restrict its personnel from Processing Customer Content without authorisation. CallHippo will impose appropriate contractual obligations upon its personnel, including relevant obligations regarding confidentiality, data protection and data security.
7. Disclosure to Third Parties; Data Subjects Rights
- CallHippo will not disclose Customer Content to any government agency, court, or law enforcement except with written consent from Controller or as necessary to comply with applicable mandatory laws. If CallHippo is obliged to disclose Customer Content to a law enforcement agency CallHippo agrees to give Controller reasonable notice of the access request prior to granting such access, to allow Controller to seek a protective order or other appropriate remedy. If such notice is legally prohibited, CallHippo will take reasonable measures to protect the Customer Content from undue disclosure as if it were CallHippo's own confidential information being requested and shall inform Controller promptly as soon as possible if and when such legal prohibition ceases to apply.
- In case Controller receives any request or communication from Data Subjects which relates to the Processing of Customer Content ("Request"), CallHippo shall reasonably provide the Controller with full cooperation, information and assistance ("Assistance") in relation to any such Request where instructed by Controller.
- Where CallHippo receives a Request, CallHippo shall (i) not directly respond to such Request, (ii) forward the request to Controller within ten (10) business days of identifying the Request as being related to the Controller and (iii) provide Assistance according to further instructions from Controller.
8. Technical and Organizational Measures
- CallHippo shall implement and maintain appropriate technical and organizational security measures to ensure that Customer Content is Processed according to this DPA, to provide assistance and to protect Customer Content against a Personal Data Breach ("TOMs"). Such measures shall include the measures set out in Appendix 2.
9. Assistance with Data Protection Impact Assessment
- Where a Data Protection Impact Assessment ("DPIA") is required under applicable Data Protection Laws for the Processing of Customer Content, CallHippo shall provide upon request to Customer any information and assistance reasonably required for the DPIA and assistance for any communication with data protection authorities, where required, unless the requested information or assistance is not pertaining to CallHippo's obligations under this DPA.
- The Customer shall pay the CallHippo reasonable charges for providing the assistance in this clause 9 to the extent that such assistance is not reasonably able to be accommodated within the normal provision of the Services.
10. Information Rights and Audit
- CallHippo shall, in accordance with Data Protection Laws, make available to Customer on request in a timely manner such information as is necessary to demonstrate compliance by CallHippo with its obligations under Data Protection Laws.
- CallHippo shall, upon reasonable notice, allow for and contribute to audits of the CallHippo's Processing of Customer Content, as well as the TOMs (including data Processing systems, policies, procedures and records), during regular business hours and with minimal interruption to CallHippo's business operations. Such audits shall be conducted by the Customer, its affiliates or an independent third party on Customer's behalf (which will not be a competitor of the Processor) that is subject to reasonable confidentiality obligations.
- Customer shall pay CallHippo reasonable costs of allowing or contributing to audits or inspections in accordance with clause 10 (b) where Customer wishes to conduct more than one audit or inspection every 12 months. CallHippo will immediately refer to Customer any requests received from national data protection authorities that relate to the CallHippo's Processing of Customer Content.
- CallHippo undertakes to cooperate with Controller in its dealings with national data protection authorities and with any audit requests received from national data protection authorities.
11. Personal Data Breach Notification
In respect of a Personal Data Breach (actual or reasonably suspected), CallHippo shall:
- notify Customer of a Personal Data Breach involving CallHippo or a subcontractor without undue delay and it shall be the responsibility of the Controller to inform the Supervisory Authority of such breach within 72 hours of notice by CallHippo;
- provide reasonable information, cooperation and assistance to Customer in relation to any action to be taken in response to a Personal Data Breach under Data Protection Laws, including regarding any communication of the Personal Data Breach to Data Subjects and national data protection authorities.
- Customer consents to the CallHippo engaging third-party sub-processors as indicated in Appendix 1 to Process Customer Content to fulfil its obligations under the Agreement provided that, CallHippowill provide at least fifteen (15) days' notice to the Customer's account administrator prior to the appointment or replacement of any sub-processor. Customer may object to CallHippo's appointment or replacement of a sub-processor prior to its appointment or replacement, provided such objection is based on reasonable grounds relating to data protection. In such an event, CallHippo will either not appoint or replace the sub-processor or, if this is not possible, Customer may suspend or terminate the Service(s) (without prejudice to any fees incurred by Customer prior to such suspension or termination).
- Where CallHippo, with Customer's consent, subcontracts its obligations and rights under this DPA it shall do so only by way of a binding written contract with the sub-processor which imposes essentially the same obligations according to Art. 28 GDPR especially with regard to instructions and TOMs on the sub-processor as are imposed on CallHippo under this DPA.
- Where the sub-processor fails to fulfil its data protection obligations under the subcontracting agreement, CallHippo shall remain fully liable to Customer for the fulfilment of its obligations under this DPA and for the performance of the sub-processor 's obligations.
13. International Data Transfers
CallHippo shall at all times provide an adequate level of protection for the Customer Content, wherever Processed, in accordance with the requirements of Data Protection Laws. Where CallHippo Processes Customer Content under this Agreement that originates from the EEA (including the United Kingdom) and/or Switzerland, any such processing shall be conditional on CallHippo complying with (and procuring any sub-processor comply with) the Model Clauses, which are incorporated by reference and form an integral part of this Agreement. This Agreement hereby incorporates by reference the standard contractual clauses for data Controller to data Processor transfers approved by the European Commission in decision 2010/87/EU. The Parties further agree that the standard contractual clauses will apply to Customer Content that is transferred via the Services from the European Economic Area, the United Kingdom, and/or Switzerland to outside the European Economic Area, the United Kingdom, and Switzerland, either directly or via onward transfer. Purely for the purposes of the descriptions in the Model Clauses and only as between CallHippo and the Customer, CallHippo agrees that it is a "data importer" and Customer is the "data exporter" under the Model Clauses (notwithstanding that Controller is located outside the EEA).
Further, Appendices 1 and 2 of this Agreement will take the place of Appendices 1 and 2 of the Model Clauses respectively.
14. Deletion or Return of Personal Data
Upon expiry of the Terms, CallHippo shall delete all Customer Content, including Personal Data within two (2) years. Within such retention period, Customer may export the Customer Content by writing to CallHippo at email@example.com. This requirement shall not apply to the extent that CallHippo as a Processor is required by applicable law to retain some or all of the Personal Data, in which event CallHippo shall isolate and protect the Personal Data from any further Processing except to the extent required by such law.
15. CCPA undertaking
Customer acknowledges and agrees that Customer is the Business and CallHippo the Service Provider with respect to any Personal Information of Consumers (as those terms are understood under the CCPA) forming part of Customer Content. CallHippo will not sell, retain, use, or disclose Personal Information of Consumers that CallHippo Processes on behalf of the Customer when providing the Services under the Terms for any purpose other than for the specific purpose of providing the Services in accordance with the Terms and as part of the direct relationship between CallHippo and the Customer. CallHippo certifies that it understands the restrictions in this clause 15 and will comply with such restrictions
16. Usage of Customer Content for Analytics
Customer acknowledges and grants to CallHippo the right of usage of Customer Content to collect, use, copy, store, and transmit said Customer Content, in each case solely to the extent necessary to carry out the purposes as intended by the Customer, including but not limited to carrying out analytics for machine learning.
- In case of any conflict, the provisions of this DPA shall take precedence over the provisions of any other agreement with CallHippo.
- No Party shall receive any remuneration for performing its obligations under this DPA except as explicitly set out herein or in another agreement.
- Where this DPA requires a "written notice" such notice can also be communicated per email to the other Party. Notices shall be sent to CallHippo at firstname.lastname@example.org and Customer at the email address with which they signed up.
- Any supplementary agreements or amendments to this DPA must be made in writing and signed by both Parties.
- Should individual provisions of this DPA become void, invalid or non-viable, this shall not affect the validity of the remaining conditions of this agreement.
The following Appendices forms an integral part of this DPA:
TO THE STANDARD CONTRACTUAL CLAUSES
DETAILS OF THE PROCESSING OF PERSONAL DATA
The data exporter is the Customer and the user of the Services.
The data importer is CallHippo. a business telecommunications service provider that enables communications features and allows users the ability to make, receive and forward voice calls using a phone number provided by CallHippo.
The Personal Data transferred concern the following categories of data subjects:
Data exporter's end-users. The Personal Data that the data exporter will transfer to the data importer is determined and controlled solely by the data exporter. The data importer will receive this Personal Data in the form of Customer Content that the data exporter instructs it to Process through its products and services.
Categories of data
The Personal Data transferred concern the following categories of data (please specify):
Customer Content: As defined in Section 1 ("Definitions") of this Agreement.
Special categories of data (if appropriate)
No Sensitive Data shall be transferred as part of Customer Content.
The Personal Data transferred will be subject to the following basic Processing activities (please specify):
CallHippo must Process the data collected from or for the Customer or in connection with its Services provided to the Customer solely to provide the services specified in the DPA. The duration of processing will be as designated in the DPA.
CallHippo intends to use the service of the following subcontractors for Processing of Personal Data as of the effective date of this DPA.
Name of Sub-processor
Bueno Technologies Inc
Server & Hosting
Server & Hosting
Provides integration support
Lexico Telecom LTD
- CallHippo has the following policies established, management approved, and documented. The policies shall be continually improving, reviewed at least annually, and require all CallHippo employees, contractors and interns to review and acknowledge annually. Evidence of policies is required.
- Information Security Policy
- Acceptable Use Policy
- CallHippo has the following policies established, management approved, and documented. The policies shall be continually improving and reviewed at least annually. Evidence of policies is required.
- Access Control Policy
- Change Management Policy
- Mobile Device Management Policy
- Remote / Teleworker Policy
- Security Awareness and Training Program
- CallHippo has in place a Security Awareness Program that all employees are required to complete at hire and at least annually thereafter.
- Physical Security
- CallHippo shall limit access to areas where Controller data is Processed and maintain audit logs of access.
- CallHippo shall implement security protocols.
- Asset Management
- CallHippo has in place a system to manage and track all Processor owned or managed assets
- Operating System / Software / Applications
- CallHippo has in place a method to communicate and/or push security patch updates for operating systems, software, and applications deployed in its environments.
- Critical patches and or updates are deployed within 30 days of release.
- Access Credentials
- All employees who have access to or maintain Controller data:
- Have a unique user id/account
- Do not share user id/account with other users
- Are required to authenticate with a second factor
- User accounts are required to:
- Lock a user account after 5 or less unsuccessful attempts
- Remain locked out for at least 15 minutes
- CallHippo shall use full disk encryption on all corporate managed devices.
- CallHippo shall encrypt all Controller data in transit and at rest.
- If CallHippo performs backup of Controller data:
- Backups are required to be performed and stored in a secure location.
- Backups shall be encrypted.
- Intrusion Detection and Prevention
- CallHippo has in place an intrusion detection and prevention system in all corporate and production locations.