1. Definitions
Terms not otherwise defined in this DPA have the meaning outlined in the Agreement.
Controller. The natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of processing personal data.
Data Protection Laws. All applicable worldwide legislation relating to data protection and privacy that applies to the respective party in its role in the processing of the personal data in question under the Agreement.
Data Subject. The individual to whom personal data relates.
Instructions. The written or documented instructions issued by a Controller to a Processor, directing it to perform a specific or general action regarding personal data (including, but not limited to, depersonalizing, blocking, deletion, and provision of personal data).
Personal Data. Any information which, alone or in combination with other information, can be used to identify a living person and is processed by Alcatraz on behalf of the System Owner.
Personal Data Breach. A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.
Processing. Any operation or set of operations performed on personal data, including storage, use, access, and reading. The terms "Process," "Processes," and "Processed" are construed accordingly.
Processor. A natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Controller.
Sub-Processor. Any Processor engaged by Alcatraz or our Affiliates to assist in fulfilling our obligations regarding the provision of the Services under the Agreement. Sub-Processors may include third parties or Alcatraz Affiliates, but exclude any Alcatraz employee or consultant.
System Owner. The customer who enters into an Agreement with Alcatraz or an Alcatraz Partner to install, operate, and license Alcatraz's products. Depending on the relevant Agreement, this party may be referred to as Solution Owner, Client, Customer, or an equivalent term.
2. Processing
2.1 When processing personal data under System Owner Instructions, the parties acknowledge and agree that the System Owner is acting as the Controller of personal data (either as the Controller or as a Processor on behalf of another Controller) and Alcatraz is the Processor under the Agreement.
2.2 Each party will comply with its respective obligations under the applicable Data Protection Laws for the processing of the personal data and is responsible for determining the requirements of laws and regulations applicable to its activities. The System Owner will not use the Service in a manner that would violate applicable Data Protection Laws.
2.3 The parties agree that the Agreement (including this DPA), together with the System Owner's use of the Service under the Agreement, are the System Owner's complete Instructions to Alcatraz regarding the processing of personal data. If Alcatraz cannot process personal data under the System Owner's Instructions due to a legal requirement under any applicable law, Alcatraz will (i) promptly inform the System Owner about that legal requirement, to the extent allowed by applicable law, and (ii) where necessary, stop all processing (other than merely storing and maintaining the security of the affected personal data) until the System Owner issues new Instructions with which Alcatraz can comply. If this provision is invoked, the System Owner may terminate the affected Service as agreed in the applicable Agreement.
2.4 Details of the categories of Data Subjects, types of personal data, duration of processing, and the purpose, nature, and activities of processing are specified in Annex 1.1 and Annex 1.2 ("Details of Processing") for the specific Service. A DPA is not typically required for on-premise services, because Alcatraz generally does not access the System Owner's personal data. A DPA would only become relevant if the System Owner chooses to grant Alcatraz access to personal data for support purposes.
3. Technical and organizational measures
Alcatraz will implement and maintain technical and organizational measures to protect personal data from Personal Data Breaches, as described in Annex 2 to this DPA ("Technical and Organizational Measures"). Notwithstanding any provision to the contrary, Alcatraz may modify or update the security measures at its discretion, provided the modification or update does not result in a material degradation in the protection they offer.
4. Personal data breach
Alcatraz will inform the System Owner without undue delay after Alcatraz becomes aware of any Personal Data Breach, and will assist the System Owner. Alcatraz will investigate the Personal Data Breach if it occurred on Alcatraz's infrastructure or in an area of Alcatraz's responsibility.
5. Deletion or return of personal data
Alcatraz will delete or return all of the System Owner's data, including personal data (and copies of it) processed under this DPA, in line with the System Owner's Instructions, or if the System Owner discontinues use of Alcatraz's services, unless otherwise required by applicable law.
6. Data subject requests
If a Data Subject request, or other communication regarding the processing of personal data under the Agreement, is made directly to Alcatraz, Alcatraz will promptly inform the System Owner and advise the Data Subject to submit their request to the System Owner. The System Owner will be solely responsible for responding substantively to any such Data Subject requests or communications involving personal data.
7. Sub-processors
7.1 The System Owner agrees that Alcatraz may engage Sub-Processors to process personal data. Alcatraz has appointed, as Sub-Processors, the third parties and Alcatraz Affiliates listed in Annex 3 ("List of Alcatraz's Sub-Processors") to this DPA. Alcatraz will allow the System Owner to object to the engagement of new Sub-Processors on reasonable grounds relating to the protection of personal data within 30 days of receipt of notification of the change. Should the System Owner object, Alcatraz and the System Owner will discuss the System Owner's concerns in good faith to achieve a commercially reasonable resolution. If no such resolution can be reached, Alcatraz will, at its sole discretion, either not appoint the new Sub-Processor or permit the System Owner to suspend or terminate the affected Service under the termination provisions of the Agreement, without liability to either party (but without prejudice to any fees incurred by the System Owner before suspension or termination).
7.2 Alcatraz will impose data protection terms on its Sub-Processors that provide at least the same level of protection for personal data as those in this DPA, to the extent applicable to the nature of the services provided by such Sub-Processors.
8. Demonstration of compliance
8.1 Subject to confidentiality, Alcatraz will make all information reasonably necessary to demonstrate compliance with this DPA available to the System Owner, and will allow for and contribute to audits. Alcatraz will supply, on a confidential basis, recent certifications and summary audit reports to the System Owner so that the System Owner can verify Alcatraz's compliance with this DPA. Only to the extent strictly necessary, the System Owner may conduct an on-site audit during regular business hours and in a manner that causes minimal disruption to Alcatraz's business. This section will not affect the System Owner's statutory audit rights under Article 28 of the GDPR.
8.2 The System Owner will make a written request for any assistance or additional instructions referred to in this DPA. Alcatraz may charge the System Owner no more than a reasonable fee to perform such assistance or reasonable instructions. If the System Owner does not agree with the proposed charges, the parties will reasonably cooperate to find a feasible solution.
9. Data transfers and country-specific terms
9.1 Alcatraz will not transfer personal data to any country or recipient not recognized as providing an adequate level of protection for personal data (within the meaning of applicable European Data Protection Laws) unless it first takes all measures necessary to ensure the transfer complies with applicable European Data Protection Laws. To the extent that Alcatraz receives European data in the United States in connection with the performance of the Services, Alcatraz will follow the Standard Contractual Clauses. Where European Data Protection Laws require safeguards, the Standard Contractual Clauses agreed between Alcatraz and the Solution Owner, and as available on the EU Commission website, are incorporated by reference and form part of the Agreement. If Alcatraz must adopt an alternative transfer mechanism for European data, that alternative mechanism will apply automatically instead of the mechanisms described in this DPA (but only to the extent it complies with European Data Protection Laws), and the System Owner agrees to execute such other documents, or take such action, as may be reasonably necessary to give it legal effect.
9.2 Depending on the applicable Data Protection Laws, additional country-specific terms ("Country-Specific Terms") may apply.
Download all documents