This Data Processing Addendum (including all Schedules attached hereto, the "DPA") is incorporated into, and is subject to the terms and conditions of, the Planship Terms of Service, or other written or electronic agreement ("Agreement") between Planship LLC (Planship) and the entity identified as "Customer" in the Agreement ("Customer"). This DPA applies to the extent Planship's Processing of Customer Personal Data is subject to the Data Protection Laws. This DPA shall be effective for the term of the Agreement.
1.1 For this DPA:
1.1.1 "CCPA" means the California Consumer Privacy Act of 2018, including as modified by the California Privacy Rights Act ("CPRA") once the CPRA takes effect, together with any implementing regulations;
1.1.2 "Controller" means the entity which determines the purposes and means of the Processing of Personal Data;
1.1.3 "Customer Personal Data" means the Personal Data described under Schedule 1 to this DPA;
1.1.4 "Data Protection Laws" means all laws and regulations applicable to Planship's Processing of Customer Personal Data, to the extent applicable under the circumstances, the Gramm-Leach Bliley Act and any binding regulations promulgated thereunder, including the "Privacy of Consumer Financial Information" Regulation (12 CFR Part 30) issued pursuant to Section 504, (b) the CCPA, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and other similar U.S. state laws, the GDPR and member state laws implementing the GDPR, the United Kingdom's Data Protection Act 2018, and applicable privacy and data protection laws of any other jurisdiction, each as amended, repealed, consolidated or replaced from time to time;
1.1.5 "Data Subjects" means the individuals identified in Schedule 1;
1.1.6 "EU SCCs" means the Standard Contractual Clauses approved with Commission Implementing Decision (EU) 2021/914 of June 4, 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as amended, supplemented, updated or replaced from time to time;
1.1.7 "GDPR" means the General Data Protection Regulation (EU) 2016/679 together with any national implementing laws in any member state of the EEA ("EU GDPR") and the EU GDPR as incorporated into the laws of the United Kingdom ("UK GDPR");
1.1.8 "Personal Data", "Personal Data Breach" and "Processing" will each have the meaning given to them in the Data Protection Laws. The term "Personal Data" includes "personal information," "personally identifiable information," and equivalent terms as such terms may be defined by the Data Protection Laws. The term "Personal Data Breach" includes equivalent terms as defined by the Data Protection Laws;
1.1.9 "Processor" means the entity which Processes Personal Data on behalf of the Controller;
1.1.10 "Sell" has the meaning given in the Data Protection Laws;
1.1.11 "UK SCCs" means the International Data Transfer Addendum to the EU Standard Contractual Clauses set forth by the European Commission under s119A(1) Data Protection Act 2018, Version B1.0, in force 21 March 2022;
1.1.12 "FADP" means the Swiss Federal Act on Data Protection;
1.2 Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement.
2.1 The parties acknowledge and agree that Customer is the Controller or Processor of Customer Personal Data and Planship is a Processor of Customer Personal Data. Planship will only Process Customer Personal Data as a Processor on behalf of and in accordance with Customer's prior written instructions, including any instructions provided through Customer's use of the Service. Planship is hereby instructed to Process Customer Personal Data to the extent necessary to provide the Service as set forth in the Agreement and this DPA. Planship shall not (1) retain, use, or disclose Customer Personal Data other than as provided for in the Agreement, as needed to provide the Service, or as otherwise permitted by Data Protection Laws; (2) combine Customer Personal Data with Personal Data Planship's receives from other customers or individuals (except as permitted by the CCPA); or (3) Sell Customer Personal Data. Planship shall notify Customer if it determines that it cannot meet its obligations under the CPRA. Upon receiving written notice from Customer that Planship has Processed Customer Personal Data without authorization, Planship will stop and remediate such Processing.
2.2 Planship will immediately inform Customer if, in its opinion, an instruction from Customer infringes the Data Protection Laws.
2.3 The details of Planship's Processing of Customer Personal Data are described in Schedule 1.
2.4 If applicable laws preclude Planship from complying with Customer's instructions, Planship will inform Customer of its inability to comply with the instructions, to the extent permitted by law.
2.5 Each of Customer and Planship will comply with their respective obligations under the Data Protection Laws.
2.6 Customer acknowledges and agrees that Processing of Customer Personal Data will occur in the United States and perhaps in other jurisdictions outside the residence of a Data Subject and Customer shall comply with all notice and consent requirements for such transfer and processing to the extent required by Data Protection Laws.
3.1 With respect to Customer Personal Data originating from the European Economic Area ("EEA"), the United Kingdom ("UK") or Switzerland that is transferred from Customer to Planship, the parties agree to comply with the general clauses and with "Module Two" (Controller to Processor) of the EU SCCs, which are incorporated herein by reference, with Customer as the "data exporter" and Planship as the "data importer." The parties agree that Planship may process and store Customer Personal Data in the United States as necessary to provide services to Customer.
3.2 For purposes of the EU SCCs the parties agree that:
3.2.1 In Clause 7, the optional docking clause will not apply;
3.2.2 In Clause 9, Option 2 will apply and the time period for prior notice of Sub-Processor changes will be as set forth in Section 5.1 of this DPA;
3.2.3 In Clause 11, the optional language will not apply;
3.2.4 For the purposes of Clause 15(1)(a), Planship shall notify Customer (only) and not the Data Subject(s) in case of government access requests and Customer shall be solely responsible for promptly notifying the affected Data Subjects as necessary;
3.2.5 In Clause 17, the EU SCCs shall be governed by the laws of Ireland;
3.2.6 In Clause 18(b), the parties agree to submit to the jurisdiction of the courts of Ireland;
3.2.7 In Annex I, Section A (List of Parties), (i) the data exporter's and the data importer's identity and contact details and, where applicable, information about their respective data protection officer and/or representative in the EEA are those set forth in the Agreement or as otherwise communicated by each party to the other party; (ii) Customer is a Controller or Processor, and Planship is a Processor; (iii) the activities relevant to the data transferred under the EU SCCs relate to the provision of the Services pursuant to the Agreement; and (iv) entering into this DPA shall be treated as each party's signature of Annex I, Section A, as of the effective date of this DPA;
3.2.8 In Annex I, Section B (Description of Transfer): (i) Schedule 1 to this DPA describes Planship's Processing of Customer Personal Data; (ii) the frequency of the transfer is continuous (for as long as Customer uses the Services); (iii) Customer Personal Data will be retained in accordance with Clause 8.5 of the EU SCCs and this DPA; (iv) Planship uses sub-Processors to support the provision of the Services.
3.2.9 In Annex I, Section C (Competent Supervisory Authority), the competent supervisory authority identified in accordance with Clause 13 of the EU SCCs is the competent supervisory authority communicated by Customer to Planship. Unless and until Customer communicates a competent supervisory authority to Planship, the competent supervisory authority shall be the Irish Data Protection Commission.
3.2.10 In Annex II, data importer has implemented and will maintain appropriate technical and organizational measures to protect the security, confidentiality and integrity of Customer Personal Data as described at https://planship.io/policies/security (the "Security Page").
3.3 If the transfer of Customer Personal Data is subject to the Swiss Federal Act on Data Protection, the parties agree to rely on the EU SCCs with the following modifications: (i) the Federal Data Protection and Information Commissioner (FDPIC) will be the competent supervisory authority under Clause 13 of the EU SCCs; (ii) the parties agree to abide by the GDPR standard in relation to all Processing of Customer Personal Data that is governed by the Swiss Federal Act on Data Protection; (iii) the term ‘Member State' in the EU SCCs will not be interpreted in such a way as to exclude Data Subjects who habitually reside in Switzerland from initiating legal proceedings in Switzerland in accordance with Clause 18(c) of the EU SCCs; and (iv) references to the ‘GDPR' in the EU SCCs will be understood as references to the Swiss Federal Act on Data Protection insofar as the transfer of Customer Personal Data is subject to the Swiss Federal Act on Data Protection.
3.4 With respect to transfers from Customer to Planship of Customer Personal Data originating from the United Kingdom, the parties agree to comply with the UK SCCs, which are incorporated herein by reference. The parties agree that, for the UK SCCs: (i) Customer is the "data exporter", and Planship is the "data importer"; (ii) all references to the "Directive 95/46/EC" and its provisions shall be deemed to refer to the relevant provisions of the UK GDPR and the Data Protection Act 2018 of the United Kingdom; (iii) all references to the "Commission" shall be deemed to refer to the Information Commissioner; (iv) all references to the "European Economic Area" or the "European Union" shall be deemed to refer to the United Kingdom; (v) for Appendix 1 to the UK SCCs, information about the exporter and importer, the categories of Data Subjects, types of Personal Data and type of Processing operations are as set out in Schedule 1 to this DPA; and (vi) for Appendix 2 to the UK SCCs, the security measures are as described at the Security Page. The parties acknowledge that the Information Commissioner's Office has not yet approved new standard contractual clauses under the UK GDPR. The UK SCCs will apply only until such time as the Information Commissioner's Office issues new standard contractual clauses under the UK GDPR. If the Information Commissioner's Office approves the EU SCCs for transfers from the UK, the parties agree to adopt the EU SCCS as the mechanism to legitimize such transfers. Where necessary, the parties shall work together, in good faith, to enter into an updated version of the UK SCCs or negotiate an alternative solution to enable transfers of Customer Personal Data in compliance with Data Protection Laws.
4.1 Planship will require Planship's personnel who access Customer Personal Data to commit to protect the confidentiality of Customer Personal Data.
4.2 Planship will implement commercially reasonable technical and organizational measures, as further described at the Security Page, that are designed to protect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
4.3 To the extent required by Data Protection Laws, Planship will provide Customer with reasonable assistance as necessary for the fulfillment of Customer's obligations under Data Protection Laws to maintain the security of Customer Personal Data.
5.1 Customer agrees that Planship may engage Sub-Processors to Process Customer Personal Data on Customer's behalf. Planship has published a list of its Sub-Processors at https://planship.io/policies/subprocessors (the "Sub-Processor List"). Planship will inform Customer of any intended changes concerning the addition or replacement of Sub-Processors by updating the Sub-Processor List. Customer agrees to receive notice of such updates by subscribing through the Sub-Processor List. Customer will have an opportunity to object to such changes on reasonable grounds within seven days after being notified. If the parties are unable to resolve such objection, either party may terminate the Agreement by providing written notice to the other party.
5.2 Planship will impose on its Sub-Processors substantially the same obligations that apply to Planship under this DPA. Planship will be liable to Customer for breaches of its Sub-Processors' obligations as it would be for its own.
5.3 The parties agree that the copies of the Authorized Sub-Processor agreements that must be provided by Planship to Customer pursuant to Clause 9(c) of the EU SCCs and Clause 5 of the UK SCCs, if applicable, may have commercial information or clauses unrelated to the EU or UK SCCs removed by Planship beforehand; and, that such copies will be provided by Planship, in a manner to be determined in its discretion, only upon Customer's written request.
Planship shall reasonably assist Customer in responding to any Data Subject requests relating to Customer Personal Data ("Requests"). Planship will provide Customer with self-service functionality or other reasonable assistance to permit Customer to respond to Requests. Planship will correct Personal Data as soon as reasonably practicable upon receiving a request from Customer to correct an error or omission in the Personal Data that is in Planship's possession or under Planship's control.
Upon becoming aware of a Personal Data Breach affecting Customer Personal Data, Planship will (i) promptly take measures designed to remediate the Personal Data Breach and (ii) notify Customer without undue delay and in any event within 24 hours of becoming aware of the Personal Data Breach.
Planship's notice shall include:
Customer is solely responsible for complying with Personal Data Breach notification requirements applicable to Customer. At Customer's request, Planship will reasonably assist Customer's efforts to notify Personal Data Breaches to the competent data protection authorities and/or affected Data Subjects, if Customer is required to do so under the Data Protection Laws. Planship's notice of or response to a Personal Data Breach under this Section 7 will not be an acknowledgement or admission by Planship of any fault or liability with respect to the Personal Data Breach.
Taking into account the nature of the Processing and the information available to Planship, Planship will reasonably assist Customer in conducting data protection impact assessments and consultation with data protection authorities if Customer is required to engage in such activities under applicable Data Protection Laws and such assistance is necessary and relates to the Processing by Planship of Customer Personal Data.
Customer instructs Planship to delete Customer Personal Data within 30 days of the termination of the Agreement and delete existing copies unless applicable law requires otherwise. The parties agree that the certification of deletion described in Clause 8.5 of the EU SCCs and Clause 12 of the UK SCCs, if applicable, shall be provided only upon Customer's written request. Notwithstanding the foregoing, Planship may retain Customer Personal Data to the extent and for the period required by applicable laws provided that Planship maintains the confidentiality of all such Customer Personal Data and Processes such Customer Personal Data only as necessary for the purpose(s) specified in the applicable laws requiring its storage.
10.1 Customer may audit Planship's compliance with its obligations under this DPA up to once per year. In addition, Customer may perform more frequent audits (including inspections) in the event: (1) Planship suffers a Personal Data Breach affecting Customer Personal Data; (2) Customer has genuine, documented concerns regarding Planship's compliance with this DPA or the Data Protection Laws; or (3) where required by the Data Protection Laws, including where mandated by regulatory or governmental authorities with jurisdiction over Customer Personal Data. Planship will contribute to such audits by providing Customer or Customer's regulatory or governmental authority with the information and assistance reasonably necessary to conduct the audit, including any relevant records of Processing activities applicable to the Service, as described below.
10.2 To request an audit, Customer must submit a detailed proposed audit plan to support@planship.io at least one month in advance of the proposed audit start date. The proposed audit plan must describe the proposed scope, duration, start date of the audit, and the identity of any third party Customer intends to appoint to perform the audit. Planship will review the proposed audit plan and provide Customer with any concerns or questions (for example, Planship may object to the third party auditor as described in Section 10.3, provide an Audit Report as described in Section 10.4, or identify any requests for information that could compromise Planship confidentiality obligations or security, privacy, employment or other relevant policies). The parties will negotiate in good faith to agree on a final audit plan at least two weeks in advance of the proposed audit start date. Nothing in this Section 10 shall require Planship to breach any duties of confidentiality.
10.3 Planship may object to third party auditors that are, in Planship's reasonable opinion, not suitably qualified or independent, a competitor of Planship, or otherwise manifestly unsuitable. Customer will appoint another auditor or conduct the audit itself if the parties cannot resolve the objection after negotiating in good faith.
10.4 If the requested audit scope is addressed in an SSAE 16/ISAE 3402 Type 1, ISO, NIST or similar audit report performed by a qualified third party auditor on Planship's systems that Process Customer Personal Data ("Audit Reports") within twelve (12) months of Customer's audit request and Planship confirms there are no known material changes in the controls audited, Customer agrees to accept the Audit Report in lieu of requesting an audit of the controls covered by the Audit Report.
10.5 The audit must be conducted at a mutually agreeable time during regular business hours at the applicable facility, subject to the agreed final audit plan and Planship's health and safety or other relevant policies and may not unreasonably interfere with Planship business activities.
10.6 Any audits are at Customer's expense and Customer will promptly disclose to Planship any perceived non-compliance or security concerns discovered during the audit, together with all relevant details.
10.7 The parties agree that the audits described in Clause 8.9 of the EU SCCs and Clause 5(f) of the UK SCCs, if applicable, shall be performed in accordance with this Section 10.
Customer acknowledges and agrees that Planship may create and derive from Processing related to the Service anonymized and/or aggregated data that does not identify or relate to Customer or any Data Subject ("Analytics Data"), and use, publicize or share with third parties such Analytics Data to improve the Service and for Planship's other legitimate business purposes.
12.1 Each party's liability towards the other party under or in connection with this DPA will be limited in accordance with the provisions of the Agreement.
12.2 Customer acknowledges that Planship is reliant on Customer for direction as to the extent to which Planship is entitled to Process Customer Personal Data on behalf of Customer in performance of the Service. Consequently, Planship will not be liable under the Agreement for any claim brought by a Data Subject arising from (a) any action or omission by Planship in compliance with Customer's instructions or (b) from Customer's failure to comply with its obligations under the Data Protection Laws.
With regard to the subject matter of this DPA, in the event of inconsistencies between the provisions of this DPA and the Agreement, the provisions of this DPA shall prevail. In the event of inconsistencies between the DPA and the EU or UK SCCs, the EU OR UK SCCs will prevail.
The following includes the information required by Annex I, Annex II and Annex III of the EU SCCs, and Appendix 1 of the UK SCCs
1) The Parties.
Data Exporter
Data exporter is Customer.
Address: the Customer's address set out in the Agreement.
Contact person's name, position and contact details: the Customer's contact details as set out in the Agreement.
Activities relevant to the data transferred under these Clauses: activities necessary to provide the Services described in the Agreement.
Signature and date: Customer is deemed to have signed this Schedule 2 by accepting Planship's Terms of Use.
Role (controller/processor): Controller
Data Importer
Data importer is Planship.
Address: Seattle, WA 98122 United States of America
Contact person's name, position and contact details: Pawel Wojnarowicz, Co-Founder and Treasurer, pawel@planship.io
Role (controller/processor): Processor
Signature and date: Importer is deemed to have signed this Schedule by accepting Planship's Terms of Use.
2) Description of the Transfer. Refer to Schedule 1.
3) Competent Supervisory Authority. The supervisory authority shall be the supervisory authority of the Data Exporter, as determined in accordance with Clause 13: The Irish Data Protection Commissioner.
4) List of Sub-Processors (Modules 2 and 3 only). An updated list of authorized sub-processors can be found on at https://planship.io/policies/subprocessors
5) Description of the Technical and Organisational Security Measures implemented by the Data Importer. Information required by Annex II of the EU SCCs and Appendix 2 of the UK SCCs can be found on Planship's Security Page: https://planship.io/policies/security