Data Processing Agreement

1.1Data Protection Laws means every privacy and data protection law that applies to the processing, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as it forms part of UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended ("CCPA") and other US state privacy laws, and the Australian Privacy Act 1988.

1.2Customer Personal Data means personal data that we process for you while providing MarketKloud, including the responses your forms collect and the details of the people in your workspace.

1.3Subprocessor means a third party we engage to process Customer Personal Data. Security Incident means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

1.4"Controller", "processor", "data subject", "personal data", "processing", "service provider" and "contractor" have the meanings given in the Data Protection Laws.

2.1You are the controller of Customer Personal Data, and we are your processor. If you use MarketKloud on behalf of your own clients, you are their processor and we are your subprocessor; you'll pass on to them anything this DPA requires.

2.2For data about our own relationship with you (your account login, billing and how you use our product), we are an independent controller, as described in our Privacy Policy. This DPA doesn't cover that data.

2.3The subject matter, nature, purpose and duration of the processing, and the types of data and data subjects, are set out in Annex 1.

3.1We process Customer Personal Data only on your documented instructions, unless the law requires otherwise; in that case we'll tell you first, unless the law forbids it. Your instructions are the Terms, this DPA, and the choices you make in the product, such as the questions you ask, the integrations you connect and the emails you set up.

3.2We'll tell you promptly if we believe an instruction breaks Data Protection Laws.

3.3We don't use Customer Personal Data for our own purposes: not for marketing, not to contact your respondents, and not to train AI models.

4.1You're responsible for having a lawful basis for the data your forms collect, for giving respondents the notices the law requires, and for getting any consent that's needed.

4.2You won't use MarketKloud to collect special category data (such as health information), criminal records, or government ID numbers unless you have a lawful basis and appropriate safeguards for it, and you won't knowingly collect data from children without the consent the law requires.

5.1Everyone we authorize to process Customer Personal Data is bound by confidentiality, and gets access only as far as they need it to provide, support or secure the service.

6.1We implement and maintain the technical and organizational measures in Annex 2, designed to protect Customer Personal Data to a level appropriate to the risk, as Article 32 GDPR requires.

6.2We may update these measures as technology and threats change, but never so that overall protection is reduced.

7.1You give us general authorization to engage Subprocessors. Our current Subprocessors are listed in Annex 3 and on our Subprocessors page.

7.2We'll give at least 14 days' notice before a new Subprocessor starts processing Customer Personal Data, by updating that page and emailing customers who've asked to be told. You may object on reasonable data protection grounds within that period. We'll then work with you in good faith on an alternative; if there isn't one, you may end the affected service and receive a refund of prepaid fees for the rest of the term.

7.3Each Subprocessor is bound by a written contract with data protection obligations at least as protective as this DPA. We remain responsible to you for our Subprocessors' performance.

7.4Integrations you choose to connect (for example your CRM, Google Sheets, Zapier, Make or a webhook) aren't our Subprocessors. Sending data to them is your instruction, and they process it under your own agreement with them.

8.1The product lets you find, export and delete responses yourself. Where you need more, we'll help you answer requests from data subjects exercising their rights, taking into account the nature of the processing.

8.2If a data subject contacts us directly about Customer Personal Data, we'll pass the request to you without undue delay and won't respond ourselves, except to tell them to contact you.

9.1We'll notify you of a Security Incident without undue delay, and in any case within 72 hours of becoming aware of it, by email to the workspace owner.

9.2We'll tell you what we know: what happened, the categories and approximate number of data subjects and records affected, the likely consequences, and what we're doing about it. We'll update you as we learn more, take reasonable steps to contain it, and give you the help you reasonably need to meet your own notification duties.

9.3Notifying you isn't an admission of fault.

10.1We'll give you reasonable help, with the information available to us, with data protection impact assessments and any prior consultation with a supervisory authority that relates to our processing.

11.1You can export and delete Customer Personal Data at any time in the product. When you delete your account, we delete Customer Personal Data straight away, and copies in encrypted backups are overwritten as they roll over, within 30 days.

11.2If you need an export you can't make yourself before you leave, ask us at hello@marketkloud.com and we'll provide one in a common machine-readable format.

11.3We may keep data only where the law requires us to, and then only for as long as it does, kept confidential and used for nothing else.

12.1We'll make available the information you reasonably need to show that we meet this DPA, including written answers to security questionnaires, once a year or after a Security Incident.

12.2If that isn't enough to meet a requirement of Data Protection Laws, you or an independent auditor bound by confidentiality may audit our compliance, on at least 30 days' notice, during business hours, no more than once a year (unless a supervisory authority requires it), at your cost, and in a way that doesn't disrupt the service or expose other customers' data. Our hosting and database providers are audited independently, and we'll share their reports where their terms allow.

13.1Customer Personal Data is stored in Singapore. Some Subprocessors process it in the USA and the United Kingdom (Annex 3).

13.2EU/EEA. Where Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs") are incorporated into this DPA: Module Two (controller to processor) where you are a controller, and Module Three (processor to processor) where you are a processor. You are the data exporter and we are the data importer. In the SCCs: Clause 7 (docking) applies; under Clause 9(a), Option 2 (general written authorization) applies with the notice period in section 7.2; the optional wording in Clause 11 doesn't apply; under Clause 13, the supervisory authority is the one competent for you; under Clauses 17 and 18, the SCCs are governed by Irish law and disputes go to the courts of Ireland. Annexes I and II of the SCCs are completed by Annexes 1 and 2 of this DPA, and the list of subprocessors by Annex 3.

13.3United Kingdom. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022) is incorporated. Its Tables 1 to 3 are completed by this DPA and its Annexes, and for Table 4 either party may end the Addendum as its Section 19 allows.

13.4Switzerland. For transfers subject to the FADP, the SCCs apply with references to the GDPR read as references to the FADP, the competent supervisory authority being the Federal Data Protection and Information Commissioner, and "Member State" including Switzerland so that Swiss data subjects can enforce their rights there.

13.5We make sure our Subprocessors that receive Customer Personal Data in other countries provide appropriate safeguards, such as the SCCs, for onward transfers.

14.1Where the CCPA or a similar US state law applies, we are your service provider or contractor. We won't sell or share Customer Personal Data; won't keep, use or disclose it for any purpose other than providing the service to you, or outside our direct business relationship with you; won't combine it with personal data from other sources except as those laws allow; and will give it the same level of privacy protection the law requires of you.

14.2We'll tell you if we can no longer meet these obligations, and you may then take reasonable steps to stop and remedy unauthorized use. We certify that we understand and will comply with these restrictions.

15.1Where the Australian Privacy Act 1988 applies, we'll handle Customer Personal Data in a way consistent with the Australian Privacy Principles as they apply to the service, and give you the information and help you reasonably need to assess and notify an eligible data breach under the Notifiable Data Breaches scheme.

16.1Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Laws or the SCCs don't allow liability to be limited.

16.2This DPA lasts for as long as we process Customer Personal Data for you, and the obligations that by their nature should continue (such as confidentiality and deletion) survive it.

16.3If there's a conflict, the SCCs (where they apply) prevail over this DPA, and this DPA prevails over the Terms in relation to Customer Personal Data.

16.4We may update this DPA to reflect changes in law or in our service. We won't reduce the protection it gives Customer Personal Data, and we'll tell account owners about material changes before they take effect.