k. UK Addendum means the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018 currently found at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf, as may be amended, superseded, or replaced.
2. Compliance. Both parties will comply with all applicable requirements of Data Protection Laws. This schedule is in addition to, and does not relieve, remove or replace, a party's obligations or rights under Data Protection Laws.
3. Controller/Processor. The parties have determined that for the purposes of Data Protection Laws, HighLead shall process the Customer Personal Data as processor on behalf of the Customer. Customer may be either a Controller or Processor.
4. Consents. Customer will ensure that it has all necessary appropriate consents and notices in place to enable lawful transfer of Customer Personal Data to HighLead, and the lawful collection of the same by the Customer using the HighLead Services for the duration and purposes of the Agreement and DPA, and shall indemnify HighLead against all loss and damage (including fines) arising from a failure to do so.
5. Nature, Scope, Purpose of Processing, and Data Subjects. Annex A sets out the scope, nature, and purpose of Customer Personal Data Processing by HighLead, the duration of the Processing and the types of Customer Personal Data and categories of Data Subjects.
6. Customer Instructions. HighLead shall process Customer Personal Data only on the documented instructions of the Customer, unless HighLead is required by any applicable laws to otherwise process that Customer Personal Data. The Agreement and DPA are deemed to be the instructions of Customer; the parties may agree to additional instructions. HighLead shall inform the Customer if, in the opinion of HighLead, the instructions of the Customer breach Data Protection Laws;
7. HighLead Obligations. HighLead will:
a. Implement and maintain appropriate technical and organizational measures to protect Customer Personal Data from Personal Data Breaches, as described under Annex B to this DPA ("Security Measures"). Notwithstanding any provision to the contrary, HighLead may modify or update the Security Measures at HighLead’s discretion provided that such modification or update does not result in a material degradation in the protection offered by the Security Measures.
b. Ensure that any personnel engaged and authorized by HighLead to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory or common law obligation of confidentiality;
c. Assist the Customer insofar as this is reasonably possible (taking into account the nature of the Processing and the information available to HighLead), and at the Customer's cost and written request, in responding to any request from a Data Subject and in ensuring the Customer's compliance with its obligations under Data Protection Laws with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;
d. Notify the Customer without undue delay on becoming aware of a Personal Data Breach involving the Customer Personal Data;
e. At the written direction of the Customer, delete or return Customer Personal Data and copies thereof to the Customer on termination of the Agreement unless HighLead is required by any applicable law to continue to process that Customer Personal Data. For the purposes of this paragraph, Customer Personal Data shall be considered deleted where it is put beyond further use by HighLead;
f. For European Data, assist Customer in ensuring compliance with Articles 32 to 36 of the GDPR; make available all information reasonably necessary to demonstrate compliance with this DPA available to Customer and allow for
and reasonably contribute to audits, including inspections conducted by Customer to assess compliance with this DPA to the extent required by Data Protection Laws; and will make available all information reasonably necessary to demonstrate compliance with GDPR Article 28 requirements for Processors; and
g. Maintain records to demonstrate its compliance with this paragraph,
8. Service Provider. The parties agree that if the CCPA applies, Customer is a “business” and HighLead is a “service provider” as defined under the CCPA. HighLead will not retain, use, or disclose the California Personal Information it collects pursuant to the Agreement for any purposes other than to perform the Agreement or as otherwise permitted by the CCPA; and (b) HighLead will not retain, use, or disclose the California Personal Information it collects pursuant to this the Agreement outside of the direct business relationship between HighLead and Customer, unless otherwise permitted by the CCPA. HighLead will not “sell” or “share” California Personal Information as those terms are defined in the CCPA or combine the California Personal Information with personal information obtained from sources other than Customer, except to the extent necessary to perform the Agreement. From time to time, Customer may ask for, and HighLead will provide, reasonable evidence of its compliance with this Section 8.
9. Subprocessors. The Customer provides its prior, general authorization for HighLead to appoint Processors to process the Customer Personal Data, provided that HighLead shall ensure that the terms on which it appoints such processors comply with Data Protection Laws, and are consistent with the obligations imposed on HighLead in this paragraph; and shall remain responsible for the acts and omission of any such Processor as if they were the acts and omissions of HighLead. HighLead has currently appointed, as Sub-Processors, the third parties listed in Annex C to this DPA. HighLead will notify Customer if HighLead adds or replaces any Sub-Processors listed in Annex C at least 30 days prior to any such changes, if Customer opts-in to receive such emails by contacting HighLead. HighLead will include substantially the same protections for Customer Personal Data as those in the DPA.
10. European Data: Transfer Mechanisms for Data Transfers/Standard Contractual Clauses.
a. HighLead will not transfer European Data to any country or recipient not recognized as providing an adequate level of protection for Personal Data (within the meaning of applicable European Data Protection Laws), unless it first takes all such measures as are necessary to ensure the transfer is in compliance with applicable European Data Protection Laws. Such measures may include (without limitation) transferring such Personal Data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Personal Data, to a recipient that has achieved binding corporate rules authorization in accordance with European Data Protection Laws, or to a recipient that has executed appropriate standard contractual clauses in each case as adopted or approved in accordance with applicable European Data Protection Laws.
b. Customer acknowledges that in connection with the performance of the Service, HighLead is a recipient of European Data in the United States. Subject to sub-sections (c), the parties agree that the Standard Contractual Clauses will be incorporated by reference and form part of the Agreement as follows:
(1) EEA Transfers. In relation to European Data that is subject to the GDPR (i) Customer is the "data exporter" and HighLead is the "data importer"; (ii) the Module Two terms apply to the extent the Customer is a Controller of European Data and the Module Three terms apply to the extent the Customer is a Processor of European Data; (iii) in Clause 7, the optional docking clause applies; (iv) in Clause 9, Option 2 applies and changes to Sub-Processors will be notified in accordance with the ‘Sub-Processors’ section of this DPA; (v) in Clause 11, the optional language is deleted; (vi) in Clauses 17 and 18, the parties agree that the governing law and forum for disputes for the Standard Contractual Clauses will be the Republic of Ireland (without reference to conflicts of law principles); (vii) the Annexes of the Standard Contractual Clauses will be deemed completed with the information set out in the Annexes of this DPA; and (viii) if and to the extent the Standard Contractual Clauses conflict with any provision of this DPA the Standard Contractual Clauses will prevail to the extent of such conflict.
(2) UK Transfers. In relation to European Data that is subject to the UK GDPR, the Standard Contractual Clauses will apply in accordance with sub-section (1) and the following modifications (i) the Standard Contractual Clauses will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part of the Agreement; (ii) Tables 1, 2 and 3 of the UK Addendum will be deemed completed with the information set out in the Annexes of this DPA and Table 4 will be deemed completed by selecting “neither party”; and (iii) any conflict between the terms of the Standard Contractual Clauses and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum.
(3) Swiss Transfers. In relation to European Data that is subject to the Swiss DPA, the Standard Contractual Clauses will apply in accordance with sub-section (1) and the following modifications (i) references to "Regulation (EU) 2016/679" will be interpreted as references to the Swiss DPA; (ii) references to "EU", "Union" and "Member State law" will be interpreted as references to Swiss law; and (iii) references to the "competent supervisory authority" and "competent courts" will be replaced with the "the Swiss Federal Data Protection and Information Commissioner '' and the "relevant courts in Switzerland".
c. If HighLead cannot comply with its obligations under the Standard Contractual Clauses or is breach of any warranties under the Standard Contractual Clauses or UK Addendum (as applicable) for any reason, and Customer intends to suspend the transfer of European Data to HighLead or terminate the Standard Contractual Clauses, or UK Addendum, Customer agrees to provide HighLead with reasonable notice to enable HighLead to cure such non-compliance and reasonably cooperate with HighLead to identify what additional safeguards, if any, may be implemented to remedy such non-compliance. If HighLead has not or cannot cure the non-compliance, Customer may suspend or terminate the affected part of the Service in accordance with the Agreement without liability to either party (but without prejudice to any fees Customer have incurred prior to such suspension or termination).
11. Amendments. Notwithstanding anything else to the contrary in the Agreement, HighLead reserves the right to make any updates and changes to this DPA, including to address changes in Data Protection Laws and to revise the security provisions in this DPA, so long as HighLead does not materially reduce the overall security level provided to Customer Personal Data.
ANNEX A - Details of Processing
A. List of Parties Data exporter:
Name: You, as defined in HighLead’s Terms of Service
Address: Your address as specified by your Platform Account
Contact person’s name, position and contact details: Your contact details, as specified by your Platform Account
Activities relevant to the data transferred under these Clauses: Performance of the Agreement between the parties as a Controller.
Role (controller/processor): Controller or Processor
Data importer:
Name: Go High Lead, LLC.Address: 340 9th St North, Suite 83, Naples, FL 34102, USA
Contact person’s name, position and contact details: Chris Helms, Founder
Activities relevant to the data transferred under these Clauses: Performance of the Agreement between the parties.
Role (controller/processor): Processor
B. Description of Transfer:
Categories of Data Subjects whose Personal Data is Transferred: Customers and potential customers of clients.
Categories of Personal Data Transferred: The Personal Data input and collected as decided by the Customer, including name, age, date of birth, phone number, email address, social media profiles.
Sensitive Data transferred and applied restrictions or safeguards: The parties do not anticipate the transfer of sensitive data.
Frequency of the transfer: Variable during the Agreement term.
Subject Matter and Nature of the Processing: HighLead will provide the Services to the Customer under the Agreement between the parties. The Customer will use the Services to collect and process Personal Data of their customers and potential customers for the purposes of managing and carrying out marketing activities, which may be targeted to their customers and potential customers.
The Processing will involve collecting, storing, recording, contacting and managing Personal Data, in particular for the purpose of running marketing campaigns, providing marketing services, and managing marketing generally.
Purpose of the transfer and further Processing: HighLead will Process Personal Data as necessary to provide the Service pursuant to the Agreement, as further specified in an order form, and as further instructed by Customer in Customer’s use of the Service.
Period for which Personal Data will be retained: The duration of the period in which the Customer accesses and uses the HighLead platform under the Services Agreement.
C. Competent Supervisory Authority:
For the purposes of the Standard Contractual Clauses, the supervisory authority that will act as competent supervisory authority will be determined in accordance with the Transfer Mechanisms for Data Transfers section of this DPA.
ANNEX B to the Standard Contractual Clauses
Description of the technical and organizational security measures implemented by the data importer in accordance with clause 4(d) and clause 5(c) (or documents/legislation attached):
Copyright © 2022 Go High Lead LLC. All Rights Reserved.
Sales@GoHighLead.com | (888) 508-4442