Data Processing Addendum of VYKIX

So that you as a service user and data controller (referred to as "Controller" or "you" or "Client") may use or continue to use our hosting services (the "Services") offered by us, VYKIX, Guimarães, Portugal and data Processor (referred to as "VYKIX" or "Processor"), you have agreed that these data processing terms ("Terms") shall apply (notwithstanding any other terms and conditions applicable to the delivery of the Services to the contrary) to address the compliance obligations imposed upon VYKIX and its Clients according to applicable Data Protection Law and in particular, Regulation (EU) 2016/679 ("GDPR") and Portugal's National Legal Order of the General Data Protection Regulation (Regulation (EU) 2016/679) on the Protection of Individuals with Regards the Processing of Personal Data and the Free Movement of Such Data ("the GDPR Implementation Law").

These Terms shall constitute a separate agreement, or they may be incorporated by reference in the relevant Services agreement, as the case may be.

1. Definitions

1.1. In this Agreement, capitalized words shall have the meaning as set out below or, as the case may be, elsewhere in this Agreement:

1.1.1. "Affiliate" means any entity that directly or indirectly controls is controlled by, or is under common control with a party from time to time during the Term.

1.1.2. "Data Protection Law" means the data privacy laws applicable to the processing in connection with the Services, including, where appropriate, the GDPR or similar law or the applicable data privacy laws of any other relevant jurisdiction.

1.1.3. "Client" means any client of VYKIX.

1.1.4. "Contractual Clauses" means the standard contractual clauses of the European Commission for the transfer of personal data across borders, as amended or replaced from time to time, or any equivalent set of contractual clauses approved for use under Data Protection Law; and

1.1.5. "Personal Data" means the personal data processed by Processor in connection with the Services on behalf of the Client during the Term and may include Personal Data and Special Categories of Data as specifically required and transferred by the Client. The processing may include activities auxiliary to VYKIX services, such as administrative and other services. This will include names and other information about data subjects included in Client materials.

1.1.6.The words "data subject," "personal data," "processing," and variations, "controller," and "processor" shall have the meaning attributed to them in Data Protection Law.

2. Appointment

2.1. VYKIX is designated by its Clients, Client Affiliates, and Business Affiliates (collectively "Instructing Parties") to provide and manage various services, including the Services on their behalf. Accordingly, Personal Data may contain personal data concerning which Client and its Instructing Parties are controllers. VYKIX confirms that it is authorized to communicate to Client any instructions or other requirements on behalf of Client regarding the processing of Personal Data connection with the Services.

2.2. Client appoints a processor to process Personal Data on behalf of Client or the Instructing Parties, as the case may be, as is necessary to provide the Services or as otherwise agreed by the parties in writing.

3. Duration

The Terms shall commence on the Effective Date. They shall continue in full force and effect until all Services have ceased and all Personal Data in the Processor's possession or within its reasonable control has been returned or destroyed (the "Term").

4. Data Protection Compliance

4.1. Concerning its processing of Personal Data, save as otherwise required by law, VYKIX agrees to:

4.1.1. Process Personal Data only as required in connection with the Services and in accordance with Client and its Instructing Parties documented lawful instructions from time to time;

4.1.2. Inform Client and its Instructing Parties if, in VYKIX opinion, an instruction infringes Data Protection Law;

4.1.3. Ensure that all personnel authorized by VYKIX to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

4.1.4. Implement appropriate technical and organizational measures to appropriately safeguard Personal Data having regard to the nature of the personal data which is to be protected and the risk of harm that might result from any Security Breach (as defined below), at a minimum, the measures set out in the Schedule;

4.1.5. Promptly inform the Client and its Instructing Parties of any data subject requests under the Data Protection Law or regulatory or law enforcement requests relating to Personal Data. VYKIX shall not acknowledge or otherwise respond to the subject access request except with Client and its Instructing Parties prior written approval, which shall not be unreasonably withheld;

4.1.6. Provide such assistance as Client and its Instructing Parties may reasonably require to ensure VYKIX compliance with Data Protection Law about data security, data breach notifications, data protection impact assessments, and prior consultations with competent authority;

4.1.7. At Client and its Instructing Parties' choice, without delay, delete or return all Personal Data to Client and its Instructing Parties, and delete existing copies of all Personal Data in the Processor's possession or within its reasonable control (including those held by a Subprocessor); and

4.1.8. Make available information to Client and its Instructing Parties reasonably necessary to demonstrate VYKIX compliance with these Terms and allow for and contribute to audits and inspections carried out by Client and its Instructing Parties.

5. Subprocessors

5.1. Processor will sub-contract, outsource, assign, novate, or otherwise transfer obligations under these Terms or engage any subcontractors involved in processing Personal Data (each a "Sub-processor") only with Client's prior written consent and subject to subclause 5.2.

5.2. When engaging a Subprocessor, Processor will:

5.2.1. Carry out reasonable due diligence;

5.2.2. Enter into a contract on terms, as far as practicable, same as those in these Terms, and which may include Contractual Clauses to provide adequate safeguards with respect to the processing of Personal Data; and

5.2.3. Inform the Client of any intended changes concerning the addition or replacement of a Sub-processor from time to time. If the Client objects to any such change on reasonable grounds, then acting in good faith, the parties will work together to resolve such objection.

5.3. Our currently engaged Subprocessors are:
5.3.1. For services provided within the United States, we have selected QTS Realty Trust, Inc. and SBA Edge Data Centers, where we colocate our hardware.
5.3.2. For services within the European Union, we have chosen Hetzner Online Data Center Parks, where we colocate our hardware.
5.3.3 We have chosen Path Network, LLC, and DataCamp Limited for network and DDoS protection.

6. Security Incidents

6.1. "Security Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.

6.2. Processor will investigate the Security Breach and take reasonable action to identify, prevent and mitigate the effects of the Security Breach. The Processor will take further action as the Client may reasonably request to comply with Data Protection Law.

6.3. Processor may not release or publish any filing, communication, notice, press release, or report concerning any Security Breach ("Notices ") without Client's prior written approval; such approval shall not be unreasonably withheld.

6.4. VYKIX will notify Client without undue delay if VYKIX becomes aware of any Security Breach within 24 hours of discovering such Breach and provide Client with the following: 

6.4.1. A detailed description of the Security Incident; 

6.4.2. The type of data that was the subject of the Security Incident; 

6.4.3. The identity of each affected person, and 

6.4.4. The steps VYKIX takes to mitigate and remediate such Security Incidents, in each case, as soon as such information can be collected or otherwise becomes available. 

6.5. VYKIX shall use its best efforts to immediately mitigate and remedy any Security Incident and prevent any further Security Incident(s) at its sole expense. 

6.6. VYKIX agrees that Client shall have the sole right to determine (i) whether notice of the Security Incident is to be provided to any individuals, regulators, law enforcement agencies, consumer reporting agencies, or others as required by law or regulation, or otherwise in Client's discretion, (ii) the contents of such notice, and (iii) whether any remediation may be offered to affected persons, as well as the nature and extent of any such remediation. 

6.7. In the event of a Security Incident involving Personal Data in VYKIX possession or otherwise caused by or related to VYKIX acts or omissions, and without limiting Client's other rights and remedies, VYKIX will pay all costs and expenses of (i) any disclosures and notification required by applicable law or as otherwise determined as appropriate in Client's reasonable discretion, (ii) monitoring and reporting on the impacted individuals' or entities' credit records if determined in Client's reasonable discretion as reasonable to protect such individuals, and (iii) all other costs incurred by Client in responding to, remediating and mitigating damages caused by such Security Incident.

6.8. VYKIX will investigate the Security Breach and take reasonable action to identify, prevent and mitigate the effects of the Security Breach. VYKIX will take further action as the Client may reasonably request to comply with Data Protection Law.

6.9. VYKIX may not release or publish any filing, communication, notice, press release, or report concerning any Security Breach ("Notices") without Client's prior written approval; such approval shall not be unreasonably withheld.

7. Audit

7.1. Client (or its designated representatives) may, on an annual basis or more frequently as reasonably requested by Client, at Client's expense, conduct an audit to verify that VYKIX is operating in accordance with this DPA. Such audit(s) may include reviewing all aspects of VYKIX's performance, including, but not limited to, VYKIX's general controls and security practices, and procedures. VYKIX will cooperate with Client in conducting any such audit and will allow Client reasonable access, during regular business hours and upon reasonable notice, to all pertinent records, documentation, computer systems, data, personnel, and areas used to Process the Client Data areas as Client reasonably requests to complete such audit. The Client will take reasonable steps to prevent the audit from materially impacting VYKIX operations. 

7.2. VYKIX shall correct any deviations from Security Best Practices that are identified in any security audit as soon as practicable but in no event more than five days after receiving notice from the Client outlining any deviations (provided, however, that if five days is not a practicable cure period, then VYKIX may instead present a remediation plan to Client within such five day period that sets forth an achievable and reasonable timeframe, and VYKIX must after that diligently proceed to correct any deviations following such plan).

8. International Data Transfers

8.1. VYKIX will ensure that no Personal Data are transferred out of either:

8.1.1. The by the Client approved data environment; or 

8.1.2. Any territory in which restrictions are imposed on the transfer of Personal Data across borders under Data Protection Laws, 

8.1.3. Without the prior written consent of Client.

8.1.4. VYKIX will ensure that Contractual Clauses or another applicable transfer mechanism are in place to provide adequate data protection.

9. Indemnity

Notwithstanding any provisions of the relevant Services agreement to the contrary, Processor shall and now agrees to indemnify Client and Instructing Parties and their officers, employees, agents, and subcontractors (each an "Indemnified Party") from and against any claims, losses, demands, actions, liabilities, fines, penalties, reasonable expenses, damages and settlement amounts (including reasonable legal fees and costs) incurred by any Indemnified Party as a result of any gross negligence or willful Breach by Processor of these Terms.

10. Miscellaneous

10.1. Clause and other headings in these Terms are for convenience only and shall not affect the meaning or interpretation of these Terms.

10.2. To the extent of any conflict, these Terms shall prevail over any Services or other Agreement.

10.3. Nothing in these Terms will exclude or limit the liability of either party, which cannot be limited or excluded by applicable law. Subject to the preceding sentence, (i) these Terms, including any appendices, constitute the entire Agreement between the parties about the subject matter hereof and supersedes all prior agreements, understandings, negotiations, and discussions of the parties relating to its subject matter; and (ii) concerning the subject matter of these Terms neither party has relied on, and neither party will have any right or remedy based on, any statement, representation or warranty, whether made negligently or innocently, except those expressly set out in these Terms.

10.4. Client shall agree to any amendment to these Terms that may be required from time to time for us and Instructing Parties to comply with any amended Data Protection Laws.

10.5. All termination notices or Breach must be in English, in writing, and addressed to the other party's primary contact person or legal department. Notice will be treated as given on receipt, as verified by a valid receipt or electronic log. Postal notices will be deemed received 48 hours from the posting date by recorded delivery or registered post.

10.6. The provisions of these Terms are severable. Suppose any phrase, clause, or condition is invalid or unenforceable in whole or part. In that case, such invalidity or unenforceability shall affect only such phrase, clause, or provision, and the rest of these Terms shall remain in full force and effect.

10.7. The law of Portugal governs these Terms, and the parties submit to the exclusive jurisdiction of the courts of Portugal concerning any dispute (contractual or non-contractual) concerning these Terms, save that either party may apply to any court for an injunction or other relief to protect its property or confidential information.

11. SCHEDULE

11.1. Security measures

11.1.1. VYKIX represents, warrants, and undertakes that it has established, and for so long as VYKIX Processes Personal Data, it will at all times enforce an ongoing program of Security Policies, Security Procedures, and Security Technical Controls, which reasonably ensures delivery of Security Best Practices, and which includes, without limitation, the following:

11.2. Information Security

11.2.1. A privacy and security incident management program;

11.2.2. A privacy and security awareness program;

11.2.3. Business continuity and disaster recovery plans, including regular testing; and

11.2.4. Procedures to conduct periodic independent security risk evaluations to identify critical information assets, assess threats to such assets, determine potential vulnerabilities, and provide for timely and appropriate remediation.

11.3. Physical Access

11.3.1. Physical protection mechanisms for all information assets and information technology to ensure such assets and technology are stored and appropriately protected;

11.3.2. Appropriate facility and room entry controls to limit physical access to systems that store or process Client Data;

11.3.3. Processes to ensure access to facilities and rooms are monitored and restricted on a "need to know" basis; and

11.3.4. Controls to physically secure all Client Data and to securely destroy such information when it is no longer needed following this Agreement.

11.4. Logical Access

11.4.1. Appropriate mechanisms for user authentication and authorization following a "need to know" policy;

11.4.2. Controls and auditable logs to enforce and maintain rigorous access restrictions for employees and subcontractors;

11.4.3. Timely and accurate administration of user account and authentication management;

11.4.4. Processes to ensure VYKIX-supplied defaults for passwords and security parameters are appropriately managed (e.g., changed periodically, etc.);

11.4.5. Mechanisms to encrypt or hash all passwords or otherwise ensure all passwords are not stored unsecured in clear text; and

11.4.6. Processes to immediately revoke accesses of inactive accounts or terminated/transferred users.

11.5. Security Architecture and Design

11.5.1. A security architecture that reasonably ensures delivery of Security Best Practices;

11.5.2. Documented and enforced technology configuration standards;

11.5.3. Regular testing of security systems and Security Best Practices;

11.5.4. A system of effective firewall(s) and intrusion detection technologies necessary to protect Client Data; and

11.5.5. Database and application layer design processes that ensure web applications are designed to protect the information data Processed through such systems.

11.6. System and Network Management

11.6.1. Mechanisms to keep security patches current;

11.6.2. Monitor, analyze, and respond to security alerts;

11.6.3. Appropriate network security design elements that provide for segregation of data from other third-party data;

11.6.4. Use and regularly update anti-virus software; and

11.6.5. The integrity, resilience, and availability of any software or services utilized to Process the Client Data.

11.6.6. Failure by VYKIX to comply with Security Best Practices or its obligations hereunder shall constitute a breach of the Agreement.

11.7. Minimum technical measures

11.7.1. Firewalls that are properly configured and using the latest software;

11.7.2. User access control management;

11.7.3. Unique passwords of sufficient complexity and regular expiry on all devices;

11.7.4. Secure configuration on all devices;

11.7.5. Regular software updates, if appropriate, by using patch management software;

11.7.6. Timely decommissioning and secure wiping (that renders data unrecoverable) of old software and hardware;

11.7.7. Real-time protection anti-virus, anti-malware, and anti-spyware software;

11.7.8. https;

11.7.9. Encryption of all portable devices ensuring appropriate protection of the key;

11.7.10. Encryption of personal data in transit by using suitable encryption solutions;

11.7.11. Multi-factor authentication for remote access;

11.7.12.WPA-TKIP secured WiFi access;

11.7.13. Delinquent web filtering and other appropriate internet access restrictions;

11.7.14. Intrusion detection and prevention systems;

11.7.15. Appropriate and proportionate monitoring of personnel; and

11.7.16. Data backup and disaster recovery measures and procedures.

11.8. Minimal organizational measures:

11.8.1. Vet all personnel, including staff, contractors, vendors, and suppliers (including Sub-processors) continuously;

11.8.2. Non-disclosure agreements used with all personnel;

11.8.3. Regular training of all personnel on confidentiality, data processing obligations, and identification of Security Breaches and risks;

11.8.4. Apply the principle of least authority, including a restricted or strictly controlled transit of data and material outside of the office;

11.8.5. Physical security on premises, including reception or front desk, security passes, clean desk policy, storage of documents in secure cabinets, secure disposal of materials, etc.;

11.8.6. Apply appropriate policies, as appropriate.

12. Cross Border Data Transfer Mechanisms

12.1. In the event the Services are covered by more than one Transfer Mechanism, the transfer of personal data will be subject to a single Transfer Mechanism following the order of precedence: 

12.2. VYKIX binding corporate rules as outlined in this Schedule 

12.3. The applicable Standard Contractual Clauses as outlined in this Schedule 

12.4. Other applicable data Transfer Mechanisms permitted under Applicable Data Protection Law.

13. Corporate Binding Rules

13.1. The parties agree that VYKIX will process personal data within the VYKIX Services following the data protection policies that are approved by European data protection authorities after meaningful consultation with those authorities and enable multinational businesses, such as VYKIX, to make intra-organizational transfers of personal data across borders in compliance with EU data protection law. 

13.2. The parties further agree that, concerning the VYKIX Services, the Binding Corporate Rules will be the lawful Transfer Mechanism of Client Account Data, Client Content, and Client Usage Data from the EEA, Switzerland, or the United Kingdom to VYKIX.

14. Standard Contractual Clauses

14.1. The parties agree that the 2021 Standard contractual clauses for international transfers, 

as published and available at https://ec.europa.eu/info/law/law-topic/dataprotection/international-dimension-data-protection/standard-contractual-clausesscc/standard-contractual-clauses-international-transfers_en will apply to personal data that is transferred via the Services from the UK, European Economic Area or Switzerland, either directly or via onward transfer, to any country or recipient outside the UK, European Economic 

Area or Switzerland that is: 

14.1.1. Not recognized by the European Commission (or, in the case of transfers from Switzerland, the competent authority for Switzerland) as providing an adequate level of protection for personal data and 

14.1.2. Not covered by the above Binding Corporate Rules. For data transfers from the European Economic Area that are subject to the 2021 Standard Contractual Clauses, the 2021 Standard Contractual Clauses will be deemed entered into (and incorporated into this Addendum by this reference) and completed as follows:

14.1.2.1. Module One (Controller to Controller) of the 2021 Standard Contractual Clauses will apply where VYKIX is processing Client Account Data and 

14.1.2.2. Client is a controller of Client Usage Data, and VYKIX is processing Client Usage Data.

14.1.2.3. Module Two (Controller to Processor) of the 2021 Standard Contractual Clauses will apply where the Client is a controller of Client Content and VYKIX is processing Client Content.

14.1.2.4. Module Three (Processor to Processor) of the 2021 Standard Contractual Clauses will apply where Client is a processor of Client Content and VYKIX is processing Client Content.

14.1.2.5. Module Four (Processor to Controller) of the 2021 Standard Contractual Clauses will apply where the Client is a processor of Client Usage Data and VYKIX processes Client Usage Data.

14.1.3. For each Module, where applicable:

14.1.3.1. Data Exporter: Client.

14.1.3.2. Contact details: The email address(es) designated by Client in Client's account via its notification preferences.

14.1.3.3. Data Exporter Role: The Data Exporter's role is outlined in this Agreement.

14.1.3.4. Signature and Date: By entering into the Agreement, Data Exporter is deemed to have signed these Standard Contractual Clauses incorporated herein as of the Agreement's Effective Date.

14.1.3.5. Data Importer: VYKIX.

14.1.3.6. Contact details: VYKIX Support Team - [email protected]

14.1.3.7. Data Importer Role: The Data Importer's role is outlined in this Agreement.

14.1.3.8. Signature and Date: By entering into the Agreement, Data Importer is deemed to have signed these Standard Contractual Clauses, incorporated herein, including their Annexes, as of the Effective Date of the Agreement.

14.2. The categories of data subjects are described in this Agreement 

14.3. The Sensitive Data transferred is described in this Agreement.

14.4. The transfer frequency is continuous for the duration of the Agreement.

14.5. The nature of the processing is described in this Agreement.

14.6. The purpose of the processing is described in this Agreement.

14.7. The period for which the personal data will be retained in this Agreement.

14.8. The Supervisory Authority shall be the CNPD - Portuguese National Data Protection Commission.

14.9. For transfers to sub-processors, the subject matter, nature, and duration of the processing are set forth below.

14.10. The Schedule Security Measures of this Agreement serves as an Annex of the Standard Contractual Clauses.

14.11. Conflict. To the extent there is any conflict between the Standard Contractual Clauses and any other terms in this Agreement or the Privacy Policy, the provisions of the Standard Contractual Clauses will prevail.