Data Processing Addendum
Posted: October 22, 2024
This Data Processing Addendum (the “Addendum”) is an addendum to the Terms of Service (“Agreement”) between Subatomic Systems, Inc., dba Storied (as applicable, “Storied”) and the Storied customer that has executed or agreed to the Agreement (the “Customer”) for Storied services (the “Services”).
This Addendum is incorporated into the Agreement and applies to the provision of the Services to the Customer if the Processing of Customer Personal Data (as defined below) is subject to the CCPA or the GDPR, only to the extent the Customer is a Business or Data Controller of Customer Personal Data and Storied is a Service Provider or Data Processor. The Addendum is intended to satisfy the requirements of the CCPA and Article 28(3) of the GDPR. This Addendum shall be effective for the term of the Agreement.
1. Definitions
1.1. For the purposes of the Addendum:
1.1.1. “Business” shall have the meaning set forth in Section 1798.140(c) of the CCPA;
1.1.2. “CCPA” means the California Consumer Privacy Act of 2018;
1.1.3. “Customer Personal Data” means the Personal Data described under Section 2 of this Addendum, in respect of which the Customer is the Business or Data Controller;
1.1.4. “Data Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data;
1.1.5. “Data Processor” means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Data Controller;
1.1.6. “Data Protection Legislation” means the CCPA or the GDPR, as applicable, together with any national implementing laws in any Member State of the European Union or, to the extent applicable, in any other country, as amended, repealed, consolidated, or replaced from time to time;
1.1.7. “Data Subject” means the individual to whom Personal Data relates;
1.1.8. Intentionally omitted
1.1.9. “EEA” means the European Economic Area;
1.1.10. “European Data” means Customer Personal Data that is subject to Data Protection Legislation in the EEA, United Kingdom, or Switzerland.
1.1.11. “GDPR” means the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;
1.1.12. “Personal Data” shall have the meaning assigned to the terms “personal data” and/or “personal information” under applicable Data Protection Legislation;
1.1.13. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed;
1.1.14. “Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction. The terms “process”, “processes”, and “processed” will be construed accordingly;
1.1.13. “Security Incident” means any actual unauthorized disclosure of or access to Customer Data, or compromise of Storied systems that Storied determines is reasonably likely to result in such disclosure or access, caused by failure of Storied's security measures and excluding any unauthorized disclosure or access that is caused by Customer or its End Users, including Customer or its End Users’ failure to adequately secure equipment or accounts; and
1.1.14. “Service Provider” shall have the meaning set forth in Section 1798.140(v) of the CCPA.
1.2. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement.
2. Details of the Processing
2.1. Types of Personal Data; Categories of Data Subjects. Customer Personal Data includes Personal Data contained in documents or other content shared, sent or otherwise transmitted by the Customer (and as appropriate Customer’s representatives, employees or other Data Subjects as elected by the Customer) on or through Storied's platform and Services, including names and email addresses of any recipients of such documents or other content, the extent of which is determined by the Customer in its sole discretion, and information about the interaction of recipients of documents with such documents or other content (including IP address, whether or not the document or other content has been viewed and when).
2.2. Subject-Matter and Nature of the Processing. The subject-matter of Processing of Customer Personal Data is the performance of the Services that involves the Processing of Customer Personal Data. The processing activities that will be performed by Storied on behalf of Customer include analyzing, storing, and transmitting Data as necessary to deliver the Services pursuant to the Agreement.
2.3. Purpose of the Processing. Customer Personal Data will be processed by Storied for purposes of providing the Services set out into the Agreement.
2.4. Duration of The Processing. Customer Personal Data will be processed for the duration of the Agreement, subject to Section 10 of this Addendum.
3. Processing of Customer Personal Data
3.1. Roles. The parties acknowledge and agree that Customer is the Business and/or Data Controller of Customer Personal Data and Storied is the Service Provider and/or Data Processor of such Customer Personal Data.
3.2. Customer Instructions. The Agreement, this Addendum, and Customer’s use of the Services constitute Customer’s instructions to Storied to Process Customer Personal Data. Storied will use and Process Customer Data as Customer instructs in order to deliver the Services and to fulfill Storied's obligations under the Agreement and this Addendum. Notwithstanding the foregoing, Customer permits Storied to collect and use usage data regarding Customer’s use of the Services for research and development, industry analysis, benchmarking, and analytics purposes, which data will be de-identified and/or aggregated and will not identify Customer or any users of the Services. Storied will inform Customer of any legal requirement which prevents it from complying with Customer’s instructions, unless prohibited from doing so by applicable law or on important grounds of public interest. If Storied cannot process Customer Personal Data in accordance with Customer’s instructions due to a legal requirement under any applicable law, Storied will cease all Processing of the affected Customer Personal Data (other than merely storing and maintaining the security of the affected Customer Personal Data). If this provision is invoked, Storied will not be liable to the Customer under the Agreement for failure to perform the Services with respect to Processing activities relating to the affected Customer Personal Data.
3.3. Compliance with Laws. Each of the Customer and Storied will comply with their respective obligations under the Data Protection Legislation. Customer represents and warrants that its instructions relating to the Processing of Customer Personal Data will comply with the applicable law and that Customer has provided any necessary notices to Data Subjects and has obtained or will obtain all lawful bases (including consents) and rights necessary for Storied to process Customer Personal Data in accordance with this Addendum.
3.4. Data Transfers. Customer agrees that Storied and its sub-processors may transfer, store, and Process Customer Personal Data in locations other than Customer’s country. In connection with the performance of the Agreement, Customer authorizes Storied to transfer Customer Personal Data across international borders, including from the EEA, Switzerland, and/or the United Kingdom to the United States, in accordance with this Section 3.4.
3.4.1. Instructions. Customer hereby instructs Storied to process European Data in accordance with this DPA to deliver the Services. Customer acknowledges that all communications with Storied in connection with the processing of European Data will be coordinated and directed through Storied.
4. Confidentiality
4.1. Storied will ensure that any person whom Storied authorises to process Customer Personal Data on its behalf is subject to confidentiality obligations in respect of that Customer Personal Data.
5. Security Measures
5.1. Storied will use commercially reasonable efforts to implement and maintain appropriate technical and organizational measures designed to protect against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data, including encryption, measures to help ensure the ongoing confidentiality, integrity, availability, and resilience of Processing systems and services, restore timely availability and access to Customer Personal Data in the event of a physical or technical incident, and for regularly testing, assessing, and evaluating the effectiveness of the security measures.
6. Sub-Processing
6.1. Customer hereby grants Storied general written authorization to engage sub-processors to carry out specific processing activities on behalf of Customer. Storied will enter into a written agreement with each sub-processor that imposes on the sub-processor substantially similar obligations that apply to Storied under this Addendum. Storied will remain liable for all acts or omissions of its Sub-processors in connection with the Agreement and this Addendum, and for any subcontracted obligations.
7. Data Subject Rights
7.1. If Storied receives any request from Data Subjects in relation to Customer Personal Data, Storied will advise Data Subjects to submit their request to the Customer without undue delay upon verifying the request pertains to Customer Personal Data. Storied shall not respond to such requests without Customer’s prior written consent and written instructions, except to the extent required by applicable laws. Customer shall be solely responsible for responding to any Data Subjects’ requests.
7.2. Taking into account the nature of the Processing, Storied will assist the Customer by appropriate technical and organizational measures, insofar as this is possible and to the extent permitted by the law, for the fulfilment of the Customer’s obligation to respond to Data Subjects’ requests for the exercise of Data Subjects’ rights under the Data Protection Legislation.
8. Personal Data Breaches
8.1. Storied will notify the Customer without undue delay as soon as practicable after it becomes aware of any Security Incident that results in a Personal Data Breach affecting any Customer Personal Data, so long as applicable law allows this notice. Without limiting the foregoing, Storied may limit the scope of, or refrain from delivering, any disclosures to the extent reasonably necessary to avoid compromising the integrity of Storied's security, an ongoing investigation, or any Storied customer’s or end user’s data. At the Customer’s request, Storied will promptly provide the Customer with all reasonable assistance required under Data Protection Legislation to enable the Customer to notify the competent data protection authorities and/or affected Data Subjects of the Personal Data Breach, provided that Customer is required to do so under Data Protection Legislation. Customer is solely responsible for complying with Personal Data Breach notification requirements applicable to Customer and fulfilling any third-party notification obligations related to any Personal Data Breach.
9. Data Protection Impact Assessment; Prior Consultation; Security
9.1. To reasonably assist Customer with its obligations under the GDPR related to security, data protection impact assessments, and prior consultation with supervisory authorities, and solely to the extent that such assistance is necessary and relates to the Processing by Storied of the Customer Personal Data, taking into account the nature of the Processing and the information available to Storied, Storied will make the following available during the Term: (a) the information contained in this Addendum and (b) any information available to Customer through the Services.
10. Return or Deletion of Customer Personal Data
10.1. Upon termination or expiration of the Agreement, Storied will promptly delete or return (at Customer’s election, such election to be made within 10 calendar days of the expiration or termination of the Agreement) all Customer Personal Data in its possession or control, except if Storied is required by applicable law to retain some or all of the Customer Personal Data (in which event Storied shall isolate and protect the relevant Customer Personal Data from any further processing except to the extent required by such law). If Customer elects to require the Customer Personal Data be returned, return will be effected by Customer’s retrieving the Customer Personal Data from Storied's systems within 15 business days as of Storied making such data available for retrieval. Once this period has expired Customer instructs Storied to destroy all Customer Personal Data. If Customer makes no such election, Storied will retain Customer Personal Data until the Customer elects to make the choice. Storied agrees to preserve the confidentiality of any retained Customer Personal Data.
11. Inspections; Audits
11.1. If Customer reasonably believes information is required and Data Protection Legislation affords Customer with an audit right, Storied will allow Customer or an independent auditor appointed by Customer, subject to appropriate confidentiality obligations, to conduct an audit or inspection to verify Storied's compliance with its obligations under this Addendum relating to Customer Personal Data, provided that such audit shall be carried out with reasonable notice during regular business hours not more often than once per year. Customer will be responsible for any fees charged by any auditor appointed by Customer to execute any such audit.
11.4. Following receipt by Storied of a request under this Section 11, the parties will agree in advance on the security and confidentiality controls applicable to any such provision of information and documentation. For Customer inspections pursuant to Section 11.3, the Parties will first mutually agree on the scope, timing, and duration of the inspection. Storied reserves the right to: (a) charge a separate fee for its reasonable costs associated with performing any of its obligations in Section 11.2 or 11.3, provided that Storied will provide an estimate of these fees to Customer prior to incurring the costs; (b) limit the scope and duration of an inspection to the extent reasonably necessary to avoid compromising the integrity of Storied security or any Storied customer’s or end user’s data; and (c) object to any Customer representative participating in an inspection on the basis that they are not qualified, are not bound by an adequate requirement to protect confidential Storied information, or are a competitor of Storied.
12. Liability
12.1. The provisions of this Addendum notwithstanding, the total combined liability of each party towards the other party under or in connection with this Addendum will be subject to the limitation of liability set forth in the Agreement. Customer agrees that any regulatory penalties incurred by Storied in relation to the Customer Personal Data that arise as a result of, or in connection with, Customer’s failure to comply with its obligations under this Addendum and the Data Protection Legislation shall count towards and reduce Storied's liability under the Agreement as if it were liability to the Customer under the Agreement.
12.2. Customer acknowledges that Storied is reliant on the Customer for direction as to the extent to which Storied is entitled to process Customer Personal Data on behalf of Customer in performance of the Services. Consequently, to the fullest extent permitted by applicable law, Storied will not be liable under the Agreement for any claim brought by a Data Subject arising from any action or omission by Storied, to the extent that such action or omission resulted directly from the Customer’s instructions or from Customer’s failure to comply with its obligations under the applicable Data Protection Legislation.
13. General Provisions
13.1. Costs. Storied may charge a reasonable fee for time spent in connection with any assistance or cooperation required by the Customer under this Addendum if such assistance or cooperation involves the commitment of significant resources over a prolonged period or significant third party costs and does not arise from any breach by Storied of the Agreement or this Addendum.
13.2. Conflict. With regard to the subject matter of this Addendum, in the event of inconsistencies between the provisions of this Addendum or any of its Exhibits and the Agreement, the provisions of this Addendum shall prevail.