Data Processing Addendum

Article 28 GDPR — DM Digital as Processor

Introduction

This Data Processing Addendum (the “DPA”) applies whenever DM Digital processes personal data on behalf of a Client in the course of providing website and web-application design, development, hosting, maintenance and support services. It forms part of the DM Digital Terms & Conditions (the “Terms”) and, together with the signed Statement of Work (the “SOW”), records the parties’ obligations under Article 28 of Regulation (EU) 2016/679 (the “GDPR”) and the Data Protection Act 2018.

In this DPA, “DM Digital” means DM Digital Studios Limited, a private company limited by shares registered in Ireland, trading as DM Digital, Dublin, Ireland. Data-protection contact: info@dmdigital.ie.

Terms used in this DPA have the meanings given in Article 4 GDPR (controller, processor, personal data, processing, personal data breach, sub-processor, data subject, etc.) unless the context requires otherwise.

1.  Scope and Roles

Where DM Digital processes personal data on behalf of the Client in the course of providing website and web-application design, development, hosting, maintenance and support services (including personal data submitted by visitors through forms, comments or accounts), the Client is the data controller and DM Digital is the data processor.

The subject-matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in the SOW. By way of default and in the absence of further detail in the SOW:

(a)  Subject-matter: the provision of website and web-application design, development, hosting, maintenance and support services by DM Digital to the Client.

(b)  Duration: for the term of the engagement and for any retention period required by applicable law.

(c)  Nature and purpose: hosting and operating the Client’s website and supporting services (e.g. contact-form processing, error logging, backups, performance monitoring).

(d)  Types of personal data: identification data (name, email, phone), contact-form submissions, browsing telemetry, account credentials where applicable, and any other personal data the Client directs DM Digital to process. Special categories of personal data (Article 9 GDPR) are processed only where recorded in Schedule 3.

(e)  Categories of data subjects: visitors to and users of the Client’s website, including prospective customers, customers and any other persons whose personal data the Client submits or causes to be submitted via the website.

Domain Name System (DNS) services are not provided by DM Digital as a sub-processor. The Client owns and operates its own DNS account (with the registrar of its choice). Where DM Digital is granted administrative access to manage DNS records on the Client’s behalf, DM Digital acts as the Client’s administrative agent only, not as a processor in respect of the DNS service itself. Accordingly, the DNS registrar is not listed in Schedule 2.

2.  Processor Obligations

DM Digital will:

(a)  process personal data only on the documented instructions of the Client (including as set out in the Terms, this DPA and the SOW), except where required to do so by EU or Member State law to which it is subject;

(b)  ensure that personnel authorised to process personal data are bound by confidentiality obligations;

(c)  implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, having regard to Article 32 GDPR (including the measures set out in Schedule 1);

(d)  assist the Client, taking into account the nature of the processing and the information available, in meeting its obligations under Articles 32 to 36 GDPR; and

(e)  make available to the Client all information necessary to demonstrate compliance with Article 28 GDPR.

3.  Sub-processors

The Client gives general written authorisation for DM Digital to engage sub-processors (such as hosting providers, email-delivery providers and analytics providers). The current list of sub-processors is at Schedule 2.

DM Digital will give the Client at least thirty (30) days’ written notice of any intended addition or replacement of a sub-processor, during which the Client may object on reasonable, documented data-protection grounds. Where the Client objects, the parties will discuss the objection in good faith and, if it cannot be resolved, the Client may terminate the affected service on thirty (30) days’ notice. Notice will be given by email to the Client’s notice address and by updating Schedule 2 at dmdigital.ie/dpa. Where a sub-processor must be replaced urgently for security or service-continuity reasons, DM Digital will notify the Client as soon as practicable and the Client’s right to object applies from that notice.

DM Digital will bind each sub-processor by written terms (which may be the sub-processor’s standard data processing terms) that impose data-protection obligations meeting the requirements of Article 28(4) GDPR, and remains responsible to the Client for the performance of each sub-processor’s obligations.

4.  International Transfers

Some sub-processors process personal data outside the European Economic Area, as shown in Schedule 2. DM Digital will only make or permit such transfers where an appropriate transfer mechanism is in place: an EU adequacy decision (including the EU–US Data Privacy Framework for certified US recipients and the adequacy decision for the United Kingdom), the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism. The Client authorises DM Digital to rely on and, where necessary, enter into such mechanisms on its behalf.

Static websites are served through Google’s global content-delivery network, so visitor requests may be handled at edge locations outside the EEA. Server applications run in the EU (Google Cloud region europe-west1, Belgium) unless Schedule 2 or the SOW states otherwise. Where a managed database is used, it is hosted in London, United Kingdom, unless the SOW states otherwise.

5.  Personal Data Breach

DM Digital will notify the Client without undue delay (and in any event within forty-eight (48) hours) after becoming aware of any personal data breach affecting personal data processed under this DPA, providing the information reasonably necessary to enable the Client to meet its own breach-notification obligations under Articles 33 and 34 GDPR. Notification will be made by email to the Client’s notice address and, where urgent, by phone or WhatsApp to the Client’s nominated contact.

6.  Data Subject Rights

DM Digital will assist the Client, by appropriate technical and organisational measures, in responding to requests by data subjects to exercise their rights under Chapter III of the GDPR. Where a request is received directly by DM Digital, DM Digital will forward it to the Client without responding to the data subject (other than to acknowledge receipt and direct them to the Client).

7.  Return or Deletion

On termination or expiry of the engagement, DM Digital will, at the Client’s choice, return or securely delete all personal data processed on the Client’s behalf and certify the same in writing, except to the extent retention is required by applicable law.

8.  Audit

DM Digital will allow for and contribute to audits, including inspections, conducted by the Client or another auditor mandated by the Client, no more than once per calendar year and on no less than thirty (30) days’ written notice (except where required earlier by a regulator), at the Client’s cost. The parties may agree alternative arrangements (such as the provision of third-party audit reports or self-assessment questionnaires) to satisfy this obligation.

9.  Liability

Each party’s liability under or in connection with this DPA is subject to the Limitation of Liability provisions in §13 of the Terms, except to the extent that the relevant liability arises from a breach of obligations that cannot lawfully be limited under the GDPR or other applicable law.

10.  Order of Precedence

If there is any conflict between the Terms, this DPA and the SOW in relation to data protection matters, the DPA prevails over the Terms and the SOW. Otherwise, the Terms prevail over this DPA and the SOW.

11.  Changes to this DPA

DM Digital may update this DPA from time to time, including to reflect changes in applicable data-protection law or guidance from the Irish Data Protection Commission or European Data Protection Board. DM Digital will give the Client not less than thirty (30) days’ written notice of any material change. If the Client objects to a material change on reasonable, documented data-protection grounds, the Client may terminate the affected ongoing services on thirty (30) days’ written notice without further charge.