Data Processing Addendum

1. Scope and order of precedence

This addendum forms part of the agreement between the customer and Automatum when the agreement refers to it, or when the customer accepts or signs it. A signed copy is available on request at hello@automatum.io. This addendum applies when Automatum processes customer personal data as a processor for the customer.

If this addendum and the agreement conflict about the processing of customer personal data, this addendum prevails. If the Standard Contractual Clauses and this addendum or the agreement conflict, the Standard Contractual Clauses prevail.

The agreement applies to matters that this addendum does not cover. These matters include liability, governing law, and the term of the agreement, except where section 9 or the Standard Contractual Clauses say otherwise.

2. Definitions

Agreement means the agreement between the customer and Automatum for the product.
Automatum means the Automatum entity that is a party to the agreement. Its contact for this addendum is hello@automatum.io.
Customer means the entity that is a party to the agreement with Automatum.
Product means the Automatum software service that the agreement describes.
Data protection law means each law on privacy or the protection of personal data that applies to the processing under the agreement. It includes, where it applies: the GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection (FADP), the Australian Privacy Act 1988, and the privacy laws of the US states, including the California Consumer Privacy Act (CCPA).
GDPR means Regulation (EU) 2016/679.
Personal data means any information about an identified or identifiable natural person. It includes “personal information” and other terms with the same meaning in data protection law.
Customer personal data means personal data that Automatum processes for the customer under the agreement. Annex 1 describes it.
Processing means any operation on personal data, such as collection, storage, use, disclosure, or deletion.
Controller and processor have the meanings in the GDPR. Under the CCPA, the controller is a “business” and the processor is a “service provider”. Under other US state laws, the terms have the meaning in that law.
Subprocessor means another processor that Automatum engages to process customer personal data.
Personal data breach means a breach of security that causes the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, customer personal data. It includes an “eligible data breach” under the Australian Privacy Act 1988 that affects customer personal data.
Standard Contractual Clauses means the clauses in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
UK Addendum means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.

3. Roles and instructions

The customer is the controller of the customer personal data. Automatum is the processor.

Automatum processes customer personal data only on the documented instructions of the customer. This includes instructions about transfers to a third country or an international organisation. The agreement, this addendum, and the customer’s use and configuration of the product are the customer’s documented instructions. The customer can give other reasonable written instructions that agree with the agreement.

If a law requires Automatum to process customer personal data in a different way, Automatum tells the customer about that requirement before it processes the data. Automatum does not tell the customer if that law prohibits the notice on important grounds of public interest.

Automatum immediately tells the customer if, in its opinion, an instruction infringes data protection law. Automatum does not have to give legal advice to the customer.

Automatum does not use customer personal data to train AI models.

4. Details of the processing

Annex 1 gives the subject matter, duration, nature, and purpose of the processing, the types of personal data, and the categories of data subjects.

5. Obligations of the customer

The customer is responsible for the lawfulness of the customer personal data and of its instructions. The customer has a legal basis for the processing, and it gives the notices and gets the consents that data protection law requires.

The product is not designed for special categories of personal data, for data about criminal convictions, or for consumer data. The customer must not send this data to the product.

6. Confidentiality

Automatum gives access to customer personal data only to the persons who need it to supply the product. Automatum makes sure that each of these persons has agreed to keep the data confidential or has a statutory duty of confidentiality.

7. Security

Automatum keeps the technical and organisational measures in Annex 2 to protect customer personal data, as Article 32 of the GDPR requires. These measures take into account the state of the art, the cost of implementation, and the nature, scope, context, and purposes of the processing, and the risks to data subjects.

Automatum can change a measure if the change does not decrease the overall level of protection.

8. Subprocessors

The customer gives a general authorisation for Automatum to engage subprocessors. The subprocessors that are in use for the product are on the subprocessors page (Annex 3).

Automatum informs the customer of each intended addition or replacement of a subprocessor before the new subprocessor processes customer personal data. Automatum sends this information by email to the customer’s account administrator at least 30 days before the change. Automatum also updates the subprocessors page.

The customer can object to the change on reasonable data protection grounds before the end of that 30-day period. If the customer objects, the parties discuss the objection in good faith. If the parties cannot resolve the objection, the customer can end only the affected service by written notice to Automatum. Automatum then refunds the prepaid fees for the affected service for the rest of the term.

Automatum engages each subprocessor through a written contract. That contract puts on the subprocessor the same data protection obligations as this addendum, in particular sufficient guarantees of appropriate technical and organisational measures. Automatum stays fully responsible to the customer for the performance of the obligations of each subprocessor.

9. International transfers

Automatum is in Australia. Automatum and its subprocessors can process customer personal data outside the country where the customer is. Automatum transfers customer personal data only in compliance with data protection law.

Transfers from the EEA. If the GDPR applies to a transfer of customer personal data from the customer to Automatum in a country without an adequacy decision, the Standard Contractual Clauses, Module Two (controller to processor), apply to that transfer and are incorporated into this addendum. The customer is the data exporter and Automatum is the data importer. These choices apply:

Clause 7 (docking clause) does not apply.
Clause 9(a): Option 2 (general written authorisation) applies. The time period is 30 days, as section 8 states.
Clause 11(a): the optional wording does not apply.
Clause 13: the competent supervisory authority is the authority that Clause 13(a) identifies.
Clause 17: Option 1 applies. The clauses are governed by the law of Ireland.
Clause 18(b): the courts are those of Ireland.
Annex I of the clauses: Part A is the parties to the agreement. The contact for Automatum is hello@automatum.io. The contact for the customer is its account administrator. Part B is Annex 1 of this addendum. Part C is the authority in Clause 13.
Annex II of the clauses is Annex 2 of this addendum.
Annex III of the clauses does not apply, because Clause 9(a) Option 2 applies. Annex 3 of this addendum gives the list of subprocessors.

Transfers from the UK. If the UK GDPR applies to the transfer, the UK Addendum applies and is incorporated into this addendum. Table 1 is the parties to the agreement. Table 2 is the Standard Contractual Clauses, Module Two, with the choices above. Table 3 is Annexes 1, 2, and 3 of this addendum. For Table 4, neither party may end the UK Addendum under its Section 19.

Transfers from Switzerland. If the FADP applies to the transfer, the Standard Contractual Clauses apply with these changes:

The Federal Data Protection and Information Commissioner (FDPIC) is the competent supervisory authority for transfers under the FADP.
References to the GDPR are references to the FADP to the extent that the FADP applies.
The term “Member State” does not prevent data subjects in Switzerland from bringing a claim in Switzerland, where they have their habitual residence, under Clause 18(c).

Onward transfers. When Automatum transfers customer personal data to a subprocessor in a country without an adequacy decision, Automatum uses a transfer mechanism that data protection law permits.

10. Requests from data subjects

If Automatum receives a request from a data subject about customer personal data, Automatum sends the request to the customer without undue delay. Automatum does not answer the request, unless the customer instructs it to answer or the law requires it.

Taking into account the nature of the processing, Automatum helps the customer with appropriate technical and organisational measures, as far as possible, to answer requests from data subjects to exercise their rights under data protection law.

11. Personal data breach

Automatum tells the customer without undue delay after it becomes aware of a personal data breach.

The notice gives, as far as Automatum knows them: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, and the measures that Automatum took or proposes to take. If Automatum cannot give all the information at the same time, it gives the information in phases without undue further delay.

Automatum takes reasonable steps to contain the breach and to decrease its effects. Automatum helps the customer to meet its obligations to notify supervisory authorities and data subjects. These obligations include the obligations under Articles 33 and 34 of the GDPR and the assessment and notice of eligible data breaches under Part IIIC of the Australian Privacy Act 1988.

The customer decides whether to notify a supervisory authority or a data subject. Automatum does not notify a third party about a breach of customer personal data, unless the customer agrees or the law requires it.

A notice of a breach is not an admission of fault or liability by Automatum.

12. Other assistance

Taking into account the nature of the processing and the information available to Automatum, Automatum helps the customer to meet its obligations under Articles 32 to 36 of the GDPR. This includes help with data protection impact assessments and with prior consultation of a supervisory authority.

13. Requests from public authorities

If a public authority asks Automatum for access to customer personal data, Automatum tells the customer without undue delay, unless the law prohibits the notice. Automatum examines whether the request is lawful. Automatum gives only the minimum data that the request requires, and it does so only if the law requires it to obey the request. For transfers under the Standard Contractual Clauses, Clause 15 of those clauses also applies.

14. Return and deletion

Within 30 days after the agreement ends, Automatum deletes or returns all customer personal data, as the customer selects, and deletes the existing copies. If the customer does not select, Automatum deletes the data.

Automatum can keep customer personal data if a law requires it to keep that data. Automatum then protects the data under this addendum and processes it only for the purpose that the law requires.

15. Information and audits

Automatum makes available to the customer all information that is necessary to show compliance with Article 28 of the GDPR and with this addendum. To do this, Automatum gives the customer, under a non-disclosure agreement:

its most recent SOC 2 report, and
its answers to reasonable written questions about its processing of customer personal data.

If this information is not sufficient to show compliance, or if a supervisory authority requires it, Automatum allows for and contributes to audits, including inspections, by the customer or by an independent auditor that the customer mandates. The auditor must be bound by a duty of confidentiality and must not be a competitor of Automatum. The customer first uses the SOC 2 report and the written answers. The customer can do an audit at most once a year. This limit does not apply to an audit that a supervisory authority requires. The customer gives reasonable advance written notice, and the parties agree the scope, the timing, and the duration of the audit in advance. An audit must not cause unreasonable disruption to the product or give access to the data of other customers. The customer pays the costs of an audit.

For the Standard Contractual Clauses, the customer agrees that this section describes how Automatum meets Clauses 8.9(c) and 8.9(d). This section does not limit those clauses.

16. US state privacy laws

This section applies when the CCPA or another US state privacy law applies to customer personal data. Automatum processes customer personal data as a service provider or processor, for the business purpose of supplying the product that Annex 1 describes. Automatum:

does not sell or share customer personal data, as the CCPA defines these terms;
does not keep, use, or disclose customer personal data for a purpose other than the business purpose in Annex 1, or outside the direct business relationship with the customer, except as the CCPA permits;
does not combine customer personal data with personal data that it receives from or for another person, or that it collects from its own interaction with a consumer, except as the CCPA permits;
obeys the obligations that apply to it under the CCPA and gives the same level of privacy protection that the CCPA requires;
tells the customer if it decides that it can no longer meet its obligations under the CCPA;
helps the customer to answer consumer requests under section 10; and
engages subprocessors only under section 8, with a written contract that has the same obligations as this section.

The customer can take reasonable and appropriate steps to make sure that Automatum uses customer personal data in a manner that agrees with the customer’s obligations under the CCPA. These steps include the audits in section 15. If the customer reasonably believes that Automatum uses customer personal data without authorisation, the customer can tell Automatum, and Automatum works with the customer to stop and correct that use.

17. Australian Privacy Act

This section applies to the extent that the Australian Privacy Act 1988 applies to customer personal data. Automatum handles customer personal data only to supply the product to the customer. Automatum takes reasonable steps to protect it from misuse, interference, and loss, and from unauthorised access, change, or disclosure, as Australian Privacy Principle 11 describes. This section applies whether or not Automatum is itself an APP entity under the Privacy Act 1988.

Automatum does not handle customer personal data in a manner that would breach the Australian Privacy Principles if the customer did it. This applies also when Automatum or a subprocessor handles the data outside Australia. This section helps the customer to meet Australian Privacy Principle 8. It does not change the customer’s accountability under section 16C of the Privacy Act 1988.

18. Liability, duration, and changes

The liability of each party under this addendum follows the liability terms of the agreement.

This addendum applies while Automatum processes customer personal data. Sections 6, 7, 11, 13, and 14 continue to apply after the agreement ends, until Automatum has deleted or returned all customer personal data.

If a change in data protection law, or a decision of a court or a supervisory authority, makes a change to this addendum necessary, the parties agree in good faith on the change.

Annex 1. Details of the processing

Subject matter and purpose: the supply of the product to the customer. The product manages the customer’s marketplace listings, private offers, co-sell opportunities, usage metering, and CRM synchronisation on AWS Marketplace, Microsoft Azure Marketplace, and Google Cloud Marketplace. It also includes the AI features of the product, support, and the security of the product.
Nature of the processing: collection, storage, organisation, synchronisation with the systems that the customer connects, analysis with the AI features, transmission to the cloud marketplaces and partner portals on the customer’s instruction, and deletion.
Duration: the term of the agreement, and after that the period until Automatum deletes or returns the customer personal data under section 14.
Frequency of transfers: continuous, for the duration of the processing.
Categories of data subjects: the staff of the customer; the staff of the customer’s buyers and prospective buyers; the staff of the cloud providers; and the staff of the customer’s partners.
Types of personal data: business contact details (name, work email, job title, employer); and deal records, such as private offers, co-sell opportunities, and the contacts and notes on them. The account, sign-in, and activity records of the users of the product are not in scope. Automatum processes those records under its privacy policy.
Special categories of data: none. Section 5 applies.
Location: on Amazon Web Services, and by Automatum from Australia.
Retention: as section 14 states.

Annex 2. Technical and organisational measures

The technical and organisational measures are the controls that the security page describes as in effect, and the controls that Automatum’s SOC 2 report describes. These controls include encryption in transit and at rest, tenant isolation, authentication and role-based access, logging and monitoring, incident response, backups, and staff security training.

The measures on the security page that apply only to a specific plan or condition apply only when that plan or condition applies.

Annex 3. Subprocessors

The subprocessors of customer personal data are the companies on the subprocessors page for the product. The companies that the page lists for the website only are not subprocessors of customer personal data. The systems that the customer connects to the product are suppliers of the customer, not subprocessors of Automatum.

Data processing addendum.