This Data Protection Addendum (“Addendum“) forms part of the User Terms of Service Agreement (“Agreement”) between Vesting Labs Ltd relating to TokenOps (“Provider” “we” “our” “us”) and a customer who has onboarded with us (“Customer“).
The terms used in this Addendum shall have the meanings set forth in this Addendum. Capitalised terms not otherwise defined herein shall have the meaning given to them in the Agreement. Except as specifically modified below, the terms of the Agreement shall remain in full force and effect.
In consideration of the mutual obligations set out herein, the parties hereby agree that the terms and conditions set out below shall be added as an Addendum to the Agreement and replace any existing data processing agreement or data protection addendum between the parties. Except where the context requires otherwise, references in this Addendum to the Agreement are to the Agreement as amended by, and including, this Addendum.
Definitions
1.1 In this Addendum, the following terms shall have the meanings set out below and cognate terms shall be construed accordingly:
1.1.1 “Applicable Data Protection Laws” means, as applicable, (a) the GDPR; (b) in respect of the United Kingdom, the GDPR as it forms part of the laws by virtue of section 3 of the European Union (Withdrawal Act 2018) and the Data Protection Act 2018 (“UK GDPR”); (c) any other national laws implementing or transposing the GDPR; (d) the CCPA; and (e) Swiss Federal Data Protection Act;
1.1.2 “CCPA” means the California Consumer Privacy Act of 2018, Cal. Civ. Code 1798.100et.seq., as amended and supplemented by the California Privacy Rights Act of 2020, and their implementing regulations;
1.1.3 “Contracted Processor” means Provider or a Sub-Processor;
1.1.4 “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data;
1.1.5 “Customer Data” means all permitted electronic data stored by Customer or processed through use of the Services but does not include Prohibited Information;
1.1.6 “Customer Personal Data” means any Personal Data Processed by a Contracted Processor on behalf of Customer pursuant to or in connection with the Agreement;
1.1.7 “Data Subject” means the identified or identifiable living individual to whom Personal Data relates, or which otherwise constitutes a “consumer” under Applicable Data Protection Laws;
1.1.8 “EEA” means the European Economic Area;
1.1.9 “EU Standard Contractual Clauses” or “EU SCCs” means the standard contractual clauses annexed to the European Commission’s Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries;
1.1.10 “GDPR” means EU General Data Protection Regulation 2016/679;
1.1.11 “Personal Data” means any information relating to an identified or identifiable natural person, or which otherwise constitutes “personal data” or “personal information” under Applicable Data Protection Laws;
1.1.12 “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise processed;
1.1.13 “Processing” or “Process” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
1.1.14 “Processor” means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller;
1.1.15 “Restricted Transfer” means: (i) in relation to Customer Personal Data which is subject to the GDPR, a transfer of Customer Personal Data from the EEA to a country outside of the EEA which is not subject to an adequacy determination by the European Commission; (ii) in relation to Customer Personal Data which is subject to the UK GDPR, a transfer of Customer Personal Data from the United Kingdom to any other country which is not based on adequacy regulations pursuant to Section 17A of the Data Protection Act 2018; and/or (iii) in relation to Customer Personal Data which is subject to the Swiss Federal Data Protection Act (“Swiss FADP“), a transfer of Customer Personal Data from Switzerland to any other country which is not included on the list of adequate jurisdictions published by the Swiss Federal Data Protection and Information Commissioner;
1.1.16 “Services” means the subscription services to be made available to Customer pursuant to the Agreement;
1.1.17 “Standard Contractual Clauses” means the EU Standard Contractual Clauses, or the UK or Swiss Addendum, as applicable;
1.1.18 “Sub-Processor” means any entity appointed by or on behalf of us to Process Customer Personal Data on behalf of Customer in connection with the Agreement; and
1.1.19 “UK Addendum” means the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner’s Office under section 119A(1) of the UK Data Protection Act 2018, Version B1.0, in force 21 March 2022.
Authority
2.1.
To the extent that we process Customer Personal Data pursuant to the Agreement and this Addendum, each party acknowledges that, for the purpose of Applicable Data Protection Laws, Customer is the Controller of the Customer Personal Data and we are the Processor. The scope of this DPA shall cover all Customer Personal Data processed by us that falls within the scope of Applicable Data Protection Laws. To the extent we Process Customer Personal Data and such processing is not governed by Applicable Data Protection Laws, we shall Process such Customer Personal Data in accordance with the obligations of a Processor as set forth in this Addendum.
Processing of Customer Personal Data
3.1 We shall:
3.1.1 comply with all Applicable Data Protection Laws in the Processing of Customer Personal Data to the extent applicable to our provision of Services under the Agreement;
3.1.2 not Process Customer Personal Data other than pursuant to the Agreement, this Addendum, or on the Customer’s documented instructions unless Processing is required by applicable laws to which we are subject, in which case we shall to the extent permitted by applicable laws inform the Customer of that legal requirement before the relevant Processing of that Customer Personal Data; and
3.1.3 inform Customer if, in its opinion, Customer’s instructions violate Applicable Data Protection Laws.
3.2 Customer:
3.2.1 shall comply with all Applicable Data Protection Laws in its use of the Services;
3.2.2 acknowledges and agrees that it is solely responsible for the accuracy, quality, and legality of: (i) the Customer Personal Data; (ii) the means by which Customer acquired such Customer Personal Data (including without limitation all necessary consent(s) required from Data Subjects); and (iii) the instructions it provides to us regarding the Processing of such Customer Personal Data (including without limitation ensuring that it falls within the scope of the consent provided by Data Subjects);
3.2.3 shall not provide or make available to us any Personal Data in violation of the Agreement or otherwise inappropriate for the nature of the Services;
3.2.4 to the extent that it is reasonably necessary for the provision of the Services and consistent with the Agreement, instructs us (and authorises us to instruct each Sub-Processor) to: (i) Process Customer Personal Data; and (ii) transfer Customer Personal Data to any country or territory; and
3.2.5 warrants and represents that it is and will at all relevant times: (i) comply with sections 3.2.1 to 3.2.3); and (ii) remain duly and effectively authorised to give the instruction set out in section 3.2.4.
3.3 Appendix 1 to this Addendum sets out certain information regarding the Processing of the
Customer Personal Data by us.
Personnel
4.1 Provider shall take reasonable steps designed to ensure the reliability of any employee, agent or contractor of any Contracted Processor who may have access to the Customer Personal Data, in each case limiting access to those individuals who need to know/access the relevant Customer Personal Data, as necessary for the purposes of the Agreement, and to comply with Applicable Data Protection Laws in the context of that individual’s duties to the Contracted Processor, and subjecting all such individuals to confidentiality undertakings or professional or statutory obligations of confidentiality.
Security
5.1 Provider will maintain and enforce commercially reasonable physical and logical security methods and procedures to protect Customer Personal Data. Provider will use commercially reasonable efforts to remedy any breach of security or unauthorised access, and reserves the right to suspend access to the in the event of a suspected or actual security breach. Customer acknowledges that the services and data transmitted are provided via the Internet, a publicly-available computer network, and that such networks are susceptible to failure, attack and hacking. Provider shall implement appropriate technical and operational measures to ensure a level of security appropriate to the general risks involved in the Services as required by Applicable Data Protection Laws. Notwithstanding any other provision, this section sets forth Provider’s entire obligation to protect Customer Personal Data on the Services. Customer will maintain and enforce commercially reasonable security methods and procedures to prevent misuse of the log-in information of its employees and other users. Provider shall not be liable for any damages incurred by Customer or any third party in connection with any unauthorised access resulting from the actions of Customer or its representatives.
We may also convert your personal data into statistical or aggregated form to better protect your privacy, or so that you are not identified or identifiable from it. Anonymised data cannot be linked back to you. We may use it to conduct research and analysis, including to produce statistical research and reports. For example, to help us understand the spread of our customers.
Subprocessing
6.1 Customer authorises Provider to appoint Sub-Processors in accordance with this section 6 and any restrictions in the Agreement. Each Sub-Processor is also authorised to appoint sub-processors in accordance with this section 6.
6.2 Provider may continue to use those Sub-Processors already engaged by Provider as at the date of this Addendum. Where Provider intends to make changes to the use of any of its Sub-Processors, it shall inform Customer 30 days prior to the date of the appointment of the new Sub-Processor. Where Customer objects to such a change (acting reasonably on the basis of any data protection concerns), Customer shall notify Provider prior to the appointment date of the new Sub-Processor. In such case, Provider and Customer shall meet in good faith, and if no agreement can be found, Customer shall during a reasonable timeframe be entitled to terminate the Agreement on no less than 30 days’ written notice.
6.3 On termination of the impacted services, pursuant to section 6.2, Customer shall be liable for any contracted fees or charges for the remainder of the term of the Agreement. Notwithstanding the foregoing, Customer shall not be liable for any fees or charges related to any impacted services terminated, pursuant to section 6.2, based on the ground that the appointment of the relevant Sub-Processor does not or would not comply with Applicable Data Protection Laws.
6.4 With respect to each Sub-Processor, Provider shall:
6.4.1 before the Sub-Processor first Processes Customer Personal Data (or, where relevant, in accordance with section 6.2), carry out adequate checks to ensure that the Sub- Processor is capable of providing the level of protection for Customer Personal Data required by Provider;
6.4.2 ensure that it enters into a written agreement with each Sub-Processor on terms which offer at least a similar level of protection for Customer Personal Data as those set out in this Addendum and meet the requirements of Applicable Data Protection Laws; and
6.4.3 provide to Customer for review such copies or summaries of the Provider agreement with Sub-Processors (which may be redacted to remove confidential commercial information not relevant to the requirements of this Addendum) as Customer may request from time to time.
Data Subject Rights
7.1 Provider shall promptly notify the Customer upon becoming aware of any request from a Data Subject under any Applicable Data Protection Laws in respect to Customer Personal Data. If requested by Customer, Provider shall assist by implementing appropriate technical and organisational measures to assist the Customer’s obligations to respond to requests to exercise Data Subject rights, consistent with the scope of the services and fees. Provider will use reasonable efforts to support requests, within the scope of the services. Provider may apply an additional charge or charges, distinct from any charges or fees payable by Customer under the Agreement for the provision of assistance in responding to any Data Subject request. Charge(s) shall be at Provider’s discretion; however, shall be proportionate to any level of assistance and agreed in advance.
Personal Data Breach
8.1 Provider shall notify Customer without undue delay upon Provider becoming aware of a Personal Data Breach affecting Customer Personal Data, providing Customer with sufficient information regarding such Personal Data Breach.
8.2 Provider shall cooperate with Customer and take such reasonable commercial steps to assist in the investigation, mitigation and remediation of each such Personal Data Breach.
Data Protection Impact Assessment and Prior Consultation
9.1 Provider shall provide reasonable assistance to Customer with any data protection impact assessments, and prior consultations with supervising authorities or other competent data privacy authorities, which Customer reasonably considers to be required of Customer under Applicable Data Protection Laws, in each case solely in relation to Processing of Customer Personal Data by, and taking into account the nature of the Processing and information available to, Provider.
Deletion or return of Customer Personal Data
10.1 The deletion, return or other treatment of Customer Personal Data on termination of the Agreement shall be managed in accordance with the terms of the Agreement.
10.2 Each Contracted Processor may retain Customer Personal Data to the extent required by applicable laws and only to the extent and for such period as required by applicable laws and always provided that Provider shall ensure the confidentiality of all such Customer Personal Data and shall ensure that such Customer Personal Data is only Processed as necessary for the purpose(s) specified in the applicable laws or the Agreement requiring its storage and for no other purpose.
11. Information and Audit rights
11.1 Subject to sections 11.2 to 11.3, Provider shall make available to Customer on request all infor-mation reasonably necessary to demonstrate compliance with this Addendum, and shall, at Customer’s cost, allow for and contribute to audits, including inspections, by Customer or an auditor mandated by Customer in relation to the Processing of the Customer Personal Data.
11.2 Customer undertaking an audit shall give Provider reasonable notice of any audit or inspection to be conducted under section 11.1, and may only exercise its right to audit no more than once every twelve (12) months.
11.3 Save for any disclosures required for compliance with Applicable Data Protection Laws, Customer undertakes to keep, and ensure its auditors keep, all results or findings from any audit confidential and shall indemnify Provider against any and all losses incurred by Provider as a result of any breach of this section.
12. CCPA
12.1 To the extent that Customer Personal Data includes personal information protected under the CCPA, the parties acknowledge and agree that Customer is a “Business” and Provider is a “Service Provider”, as both terms are defined in the CCPA. Provider will Process such Customer Personal Data in accordance with the CCPA insofar as it relates to the provision of the Services and will not sell, share, retain, use, or disclose such Customer Personal Data (protected under the CCPA) other than for the specific purpose of providing the Services or outside of a direct business relationship between Provider and Customer. In addition, Provider will not combine such Customer Personal Data (protected under the CCPA) it receives from, or on behalf of, Customer with Personal Data that Provider receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, except where such combination is permitted under the CCPA. Provider shall notify Customer if it becomes aware that it cannot comply with its obligations as a Service Provider under the CCPA.
13. Data Transfer
13.1 Customer acknowledges and agrees that it may be necessary for Customer Personal Data to be transferred outside of the country or territory it originates from in order to perform services pursuant to the Agreement.
13.2 To the extent that a transfer of Customer Personal Data from Customer to Provider is a Restricted Transfer, such transfer shall be subject to the appropriate Standard Contractual Clauses, which shall be deemed incorporated into and form part of this Addendum, as follows:
13.2.1 European Transfers. In relation to transfers of Customer Personal Data originating from the EEA and subject to the EU GDPR, the EU SCCs shall apply as follows:
(a) Customer is the “data exporter” and Provider is the “data importer”;
(b) Module 2 (Controller to Processor) or Module 3 (Processor to Processor) shall apply as appropriate;
(c) in clause 7, the optional docking clause shall apply;
(d) in clause 9, option 2 applies, and the time period for prior notice of Sub-Processor changes is stated in section 6 of this Addendum;
(e) in clause 11, the optional language does not apply;
(f) in clause 17, option 1 applies, the EU SCCs are governed by French law;
(g) in clause 18(b), disputes will be resolved before the courts of France; and
(h) Annex I, II and III of the EU SCCs shall be deemed completed with the information set out in Appendix I, II and III to this Addendum respectively;
13.2.2 United Kingdom Transfers. In relation to transfers of Customer Personal Data originating from the United Kingdom and subject to the UK GDPR, the UK Addendum shall apply as follows:
(a) in Table 1 of the UK Addendum, the parties’ key contact information is located in the Agreement;
(b) in Table 2 of the UK Addendum, the relevant information about the version of the EU SCCs, modules, and selected clauses which this UK Addendum is appended to is located above in section 13.2.1 (European Transfers) of this Addendum;
(c) in Table 3 of the UK Addendum,
(i) the information required for Annex 1A is located in Appendix I of this Addendum;
(ii) the information required for Annex 1B is located in Appendix I of this Addendum;
(iii) the information required for Annex II is located in Appendix II of this Addendum;
(iv) the information required for Annex III is located in Appendix III of this Addendum; and
(d) in Table 4 of the UK Addendum, neither party may end the UK Addendum.
13.2.3 Swiss Transfers. In relation to transfers of Customer Personal Data originating from Switzerland and subject to the Swiss FADP, the EU SCCs as implemented under in section 13.2.1 (European Transfers) of this Addendum shall apply with the following modifications:
(a) all references in the EU SCCs to “Regulation (EU) 2016/679” will be interpreted as references to the Swiss FADP, and references to specific Articles of “Regulation (EU) 2016/679” will be replaced with the equivalent article or section of the Swiss FADP;
(b) all references to Member State will be interpreted to include Switzerland and Data Subjects in Switzerland are not excluded from enforcing their rights in their place of habitual residence in accordance with clause 18(c);
(c) in clause 13, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner;
(d) in clause 17, the EU SCCs are governed by the laws of Switzerland; and
(e) in clause 18(b), disputes will be resolved before the courts of Switzerland.
13.3 Provider shall ensure adequate data transfer mechanisms are in place for any onwards data transfers to Sub-Processors to ensure compliance with the Applicable Data Protection Laws and protection of Customer Personal Data.
14. Survival
14.1 Any provision of this Addendum that expressly or by implication is intended to come into or continue in force on or after termination or expiry of this Addendum shall remain in full force and effect.
15. General Terms
15.1 Governing Law and Jurisdiction. The parties to this Addendum hereby submit to the choice of jurisdiction stipulated in the Agreement with respect to any disputes or claims howsoever arising under this Addendum, including disputes regarding its existence, validity, termination or the consequences of its nullity and all non-contractual or other obligations arising out of or in connection with it.
15.2 Limited Liability. Nothing in this Addendum reduces Provider’s obligations under the Agreement in relation to the protection of Customer Personal Data or permits Provider to Process (or permit the Processing of) Customer Personal Data in a manner which is prohibited by the Agreement. CUSTOMER AGREES AND ACCEPTS THAT IT SHALL NOT BE ENTITLED TO BRING A CLAIM UNDER BOTH THE AGREEMENT AND THIS ADDENDUM FOR DAMAGE OR LOSS CAUSED BY THE SAME EVENT GIVING RISE TO THAT CLAIM. PROVIDER’S ENTIRE AGGREGATE LIABILITY HEREUNDER SHALL BE AS STATED IN THE LIMITATION OF LIABILITY PROVISIONS AGREED BETWEEN CUSTOMER AND PROVIDER IN THE AGREEMENT, AND PROVIDER’S (OVERALL) AGGREGATE LIABILITY EXPOSURE TOWARDS THE CUSTOMER SHALL THEREFORE NOT BE EXPANDED AS A RESULT OF ENTERING INTO THIS ADDENDUM.
15.3 Order of Precedence. Subject to section 15.2, with regard to the subject matter of this Addendum, in the event of inconsistencies between the provisions of this Addendum and any other agreements between the parties, including the Agreement and including (except where explicitly agreed otherwise in writing, signed on behalf of the parties) agreements entered into or purported to be entered into after the date of this Addendum, the provisions of this Addendum shall prevail.
15.4 Severance. Should any provision of this Addendum be invalid or unenforceable, then the remainder of this Addendum shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, while preserving the parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.
APPENDIX I
A. LIST OF PARTIES
(1) Data exporter(s):
Company Name, Address, and Contact Details: Customer as identified in the Agreement.
Role: Controller
Signature & Date: By entering into the Agreement, data exporter is deemed to have signed this Addendum and the applicable Standard Contractual Clauses incorporated herein, including their Appendices/Annexes as of the effective date of the Agreement.
(2) Data importer(s):
Company Name: Vesting Labs Limited
Address: As stated in the Agreement
Contact person’s name and contact details: security@tokenops.xyz
B. DESCRIPTION OF PROCESSING
Activities relevant to the data transferred under these clauses:
Role: Processor
Signature & Date: By entering into the Agreement, data importer is deemed to have signed this Addendum and the applicable Standard Contractual Clauses incorporated herein, including their Appendices/Annexes as of the effective date of the Agreement.
C. COMPETENT SUPERVISORY AUTHORITY FOR THE EU SCCs
Identify the competent supervisory authority/ies in accordance with clause 13 of the EU SCCs.
The Data Protection Commission, France
APPENDIX II
TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
Provider will only use Customer Data for the purposes of fulfilling its obligations under the Agreement. Provider will maintain and enforce physical and logical security procedures with respect to its access and maintenance of Customer Data contained on Provider servers.
Provider has adopted administrative, technical, and physical safeguards that protect against any reasonably anticipated threats or hazards to the confidentiality of the Customer Data, and protect against unauthorised access, use, disclosure, alteration, or destruction of the Customer Data. These safeguards include:
Access Controls – policies, procedures, and physical and technical controls: (i) to limit physical access to its information systems and the facility or facilities in which they are housed to properly authorised persons and (ii) to authenticate and permit access only to authorised individuals. In particular, Provider has limited access to Customer Data to its engineers, this access is role-based via MongoDB Atlas, authenticated through SSO with MFA enforced.
Encryption at rest – MongoDB Atlas and Redis Cloud have default encryption at rest enabled.
Security Incident Procedures – an incident response procedure describing how Provider will detect, respond to, and otherwise address security incidents, including procedures to monitor systems and to detect actual and attempted attacks on or intrusions into Customer Data or information systems relating thereto, and procedures to identify and respond to validated security incidents, mitigate harmful effects of security incidents, and document security incidents and their outcomes, including where appropriate notification to supervisory authorities and data subjects.
Contingency Planning – policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages Customer Data or systems that contain Customer Data, including a data backup plan and a disaster recovery plan. MongoDB Atlas automated backups are configured with periodic (6 hours, daily, weekly and monthly) snapshots (with retention of these snapshots kept for a pre-defined period ranging from 2 days to 12 months retention)
Device and Media Controls – policies and procedures that govern the receipt and removal of hardware and electronic media that contain Customer Data into and out of a Provider data center, and the movement of these items within a Provider data center, including policies and procedures to address the final disposition of Customer Data.
Audit controls – hardware, software, and/or procedural mechanisms that record activity in information systems that contain or use Customer Data.
Data Integrity – policies and procedures to guard against the unauthorised disclosure, improper alteration, or unauthorised destruction of Customer Data.
Transmission Security – encryption of electronic information while in transit to guard against unauthorised access to Customer Data that is being transmitted over public communications networks. All services use https/TLS by default.
Secure Disposal – policies and procedures regarding the disposal of Customer Data, taking into account available technology that can be used to sanitise storage media.
Written Information Security Program - covering amongst other things password management, 2FA, device encryption, phishing awareness and access reviews. This will be monitored and adjusted periodically as Provider deems necessary.
Security Training – Provider shall provide annual security awareness and phishing simulation training for its employees that will have access to Customer Data.
Confidentiality – Provider shall require that all its employees who are granted access to Customer Data undergo appropriate screening, where lawfully permitted, and enter into a confidentiality agreement prior to being granted such access.
APPENDIX III
LIST OF SUB-PROCESSORS
Customer has authorised the use of the Sub-Processors as provided here: https://tokenops.xyz/service-providers.
If Provider wishes to use the services of a new Sub-Processor, it shall notify the Customer. If the Customer reasonably objects (on data protection grounds) to the appointment of the new Sub-Processor the parties shall discuss in good faith the reasons for such objection and whether measures can be undertaken to meet those reasons. If within a period of 30 days from Provider being notified of an objection the parties have been unable to agree the measures, the Customer shall be entitled to terminate the processing of the applicable Customer Personal Data within 7 days of the end of such 30 day period.
APPENDIX IV
EXCLUDED ACTIVITIES
This Addendum does not cover any Processing activities carried out by Provider in its capacity as an independent Controller, including when it Processes Personal Data for the purpose of managing the relationship with Customer and invoicing.
