Data Processing Agreement – Humatica Ltd.

This Data Processing Agreement (“Agreement“) forms part of the contract for services (“Principal Agreement“ or “Service Contract”) between

Humatica Ltd., Holborn Town Hall, 193 – 197 High Holborn, London, WC1V 7BD, United Kingdom
(“Data Processor”)

and

the client of the Data Processor (“Client”) as specified in the applicable Engagement Confirmation,

together referred as the “Parties”.

WHEREAS

(A) Client acts as a Data Controller.

(B) Client wishes to retain the Data Processor to provide certain Services, which require the processing of personal data of data subjects for the purposes specified in Annex 1 (“Data Subjects / Personal Data / Processing Activities / Purposes”).

(C) The Parties seek to implement a data processing agreement that complies with the requirements of the applicable legal framework in relation to data processing.

IT IS AGREED AS FOLLOWS:

1. Definitions and Interpretation

1.1 Unless otherwise defined herein, capitalized terms and expressions used in this Agreement shall have the following meaning:

1.1.1 “Agreement” means this Data Processing Agreement and all Annexes and Schedules;

1.1.2 “Client Personal Data” means any Personal Data Processed by the Data Processor or a Subprocessor on behalf of the Client pursuant to or in connection with the Principal Agreement;

1.1.3 “Data Protection Laws” means EU and UK Data Protection Laws and, to the extent applicable, the data protection or privacy laws of any other country;

1.1.4 “EEA” means the European Economic Area;

1.1.5 “EU Data Protection Laws” means the GDPR and laws implementing or supplementing the GDPR;

1.1.6 “GDPR” means EU General Data Protection Regulation 2016/679;

1.1.7 “Data Transfer” means:

1.1.7.1 a transfer of Client Personal Data from the Data Processor to a Subprocessor; or

1.1.7.2 an onward transfer of Client Personal Data from a Subprocessor to a third party;

1.1.8 “Services” means the consulting services the Data Processor provides to Client.

1.1.9 “Subprocessor” means any person appointed by or on behalf of the Data Processor to process Personal Data on behalf of Client in connection with the Agreement.

1.2 The terms, “Commission”, “Controller”, “Data Subject”, “Member State”, “Personal Data”, “Personal Data Breach”, “Processing” and “Supervisory Authority” shall have the same meaning as in the GDPR, and their cognate terms shall be construed accordingly.

2. Processing of Client Personal Data / General Obligations

2.1 The Data Processor shall:

2.1.1 comply with all applicable Data Protection Laws in the Processing (including Data Transfer) of Client Personal Data; and

2.1.2 Process (including Data Transfer) Client Personal Data exclusively in accordance with this Agreement in conjunction with the underlying Principal Agreement and in accordance with the Client’s instructions.

2.2 Client hereby instructs the Data Processor to process Client Personal Data to provide the Services.

2.3 The Data Processor shall inform the Client immediately if, in its opinion, an instruction issued by the Client violates legal regulations. In such cases, the Data Processor shall be entitled to suspend execution of the relevant instruction until it is confirmed or changed by the Client.

2.4 The Data Processor shall assist the Client in complying with the obligations set out in Articles 32 to 36 GDPR taking into account the nature of Processing and the information available to the Data Processor.

3. Data Processor Personnel

Data Processor shall take reasonable steps to ensure the reliability of any employee, agent or contractor who may have access to Client Personal Data, ensuring in each case that access is strictly limited to those individuals who need to know / access the relevant Client Personal Data, as strictly necessary for the purposes of the Principal Agreement, and to comply with applicable Data Protection Laws in the context of that individual’s duties to the Data Processor, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.

4. Security

4.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Data Processor shall in relation to Client Personal Data implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in Article 32(1) of the GDPR.

4.2 In assessing the appropriate level of security, the Data Processor shall take account in particular the risks that are presented by Processing, in particular from a Personal Data Breach.

4.3 A summary of the security measures currently taken by the Data Processor is provided in Annex 2 to this Agreement. Any changes of the security measures will be documented by means of an addendum to this Agreement.

5. Subprocessing

5.1 The Data Processor shall not appoint (or disclose any Client Personal Data to) any Subprocessor unless required or authorized by Client.

5.2 The Data Processor currently works with the Subprocessors specified in Annex 3 and the Controller hereby agrees to their appointment. Further Subprocessors (if any) will be added by means of an addendum to this Agreement.

5.3 The Data Processor warrants to have carefully selected the Subprocessors, particularly considering the suitability of the technical and organizational measures taken by the Subprocessor.

5.4 The Data Processor warrants that the Subprocessors have been contractually bound to comply with data protection obligations comparable to those agreed to in this Agreement. Upon request, the Client shall have access to the relevant contracts between the Data Processor and the Subprocessors.

6. Data Subject Rights

6.1 Taking into account the nature of the Processing, Processor shall assist Client by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Client obligations to respond to requests to exercise Data Subject rights under the Data Protection Laws.

6.2 Processor shall:

6.2.1 promptly notify the Client if it receives a request from a Data Subject under any Data Protection Law in respect of Client Personal Data; and

6.2.2 ensure that it does not respond to that request except on the documented instructions of the Client or as required by applicable Data Protection Laws to which the Processor is subject, in which case Processor shall to the extent permitted by applicable Data Protection Laws inform the Client of that legal requirement before responding to the request.

7. Personal Data Breach

7.1 The Data Processor shall notify the Client without undue delay upon Data Processor becoming aware of a Personal Data Breach affecting Client Personal Data, providing the Client with sufficient information to allow the Client to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Data Protection Laws.

7.2 The Data Processor shall co-operate with Client and take reasonable commercial steps as are directed by the Client to assist in the investigation, mitigation and remediation of each such Personal Data Breach.

8. Data Protection Impact Assessment and Prior Consultation

The Data Processor shall provide reasonable assistance to Client with any data protection impact assessments, and prior consultations with Supervising Authorities or other competent data privacy authorities, which Client reasonably considers to be required by article 35 or 36 of the GDPR or equivalent provisions of any other Data Protection Law, in each case solely in relation to Processing of Client Personal Data by, and taking into account the nature of the Processing and information available to, the Data Processor or the Subprocessors.

9. Deletion or return of Client Personal Data

9.1 Data Processor shall promptly and in any event within 6 months of the date of cessation of any Services involving the Processing of Client Personal Data (the “Cessation Date”), delete or return and procure the deletion (or return) of all copies of those Client Personal Data, provided that the deletion of these data does not conflict with any statutory storage obligations of the Data Processor.

9.2 The deletion in accordance with data protection and data security regulations must be documented and confirmed upon request to the Client.

10. Audit rights

10.1 Subject to this section 10, Data Processor shall make available to Client on request all information necessary to demonstrate compliance with this Agreement, and shall allow for and contribute to audits, including inspections, by Client or an auditor mandated by Client in relation to the Processing of Client Personal Data by the Data Processor.

10.2 Audits must be carried out without undue disruption to Data Processor’s business operations. Unless otherwise indicated for urgent reasons, which are to be documented by the Client, audits shall be carried out after reasonable advance notice and during the Data Processor’s business hours, and no more frequently than every 12 months.

10.3 Information and audit rights of Client only arise under section 10.1 to the extent that the Agreement does not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Law.

11. Location of processing

The Processing of the Client Personal Data shall in principle take place in the European Union / EEA. Any transfer to a third country may only take place with the prior written consent of Client and if the special requirements of Art. 44 et seqq. GDPR are fulfilled.

12. Requests by government agencies

12.1 If the Data Processor receives a request from a government agency to provide the Personal Data or access thereto, the Data Processor will only cooperate with a request to that effect if it has a statutory obligation to do so (including an obligation under foreign laws or regulations).

12.2 In order to guarantee the protection of the Personal Data, the Processor must ensure that it does not provide the government agency with more Personal Data than strictly necessary to comply with the government agency’s request. If it is possible to take legal action against a request to provide Personal Data or to obtain a prohibition on informing third parties about the request, the Processor will make full use of this possibility.

13. Costs

The costs related to the performance of this Agreement are already included in the prices and fees as agreed in the Service Contract, unless the Data Processor can demonstrate that a data breach or additional work or costs under this Agreement are the result of an act or omission of the Client.

14. Duration of the Agreement

14.1. This Agreement will be in force for as long as the Service Contract continues. On termination of the Service Contract, this Agreement will end by operation of law without any further act being required.

14.2. This Agreement cannot be terminated separately by the Data Processor or Client.

14.3. Obligations under this Agreement which by their nature are intended to continue after termination of this Agreement will continue to exist after its termination.

15. General Terms

15.1 Confidentiality. Each Party must keep this Agreement and information it receives about the other Party and its business in connection with this Agreement (“Confidential Information”) confidential and must not use or disclose that Confidential Information without the prior written consent of the other Party except to the extent that:

(a) disclosure is required by law;

(b) the relevant information is already in the public domain.

15.2 Notices. All notices and communications given under this Agreement must be in writing and will be delivered personally, sent by post or sent by email to the address or email address set out in the heading of this Agreement at such other address as notified from time to time by the Parties changing address.

15.3 In the event of any conflict between the provisions of this Agreement and the provisions of the Service Contract, the provisions of this Agreement will prevail.

15.4. The parties will renegotiate this Agreement in good faith if changes of applicable laws, in the processed Personal Data or in the reliability requirements give rise to such renegotiation.

15.5. Deviations from and additions to this Agreement are valid only if these have been expressly agreed in writing (including by exchange of email).

15.6 Should individual parts of this Agreement be invalid, this shall not affect the validity of the remaining parts of the Agreement.

16. Governing Law and Jurisdiction

16.1 This Agreement is governed by the laws of England and Wales without regard to its conflict of law provisions.

16.2 Any dispute arising in connection with this Agreement, which the Parties will not be able to resolve amicably, will be submitted to the exclusive jurisdiction of the courts of London, United Kingdom.

IN WITNESS WHEREOF, this Agreement is entered into with effect from the date set out in the applicable Engagement Confirmation.

Schedule of Annexes

Annex 1: Data Subjects / Personal Data / Processing Activities / Purposes

Annex 2: Humatica Cyber Security Readiness Measures

Annex 3: Subprocessors

Annex 1 Data Subjects / Personal Data / Processing Activities / Purposes

Data Subjects- Description of the affected data subjects

Data Subjects are Client’s employees (“Client Employees”).

Personal Data – Description of the personal data being processed

• First and last name of Client Employees
• Job title/function of Client Employees
• Full-time/Part-time (%)
• Location
• Department (or any segmentation / classification as used by the organization)
• Line Managers
• Email addresses of Line Managers, for the only purpose of sending the questionnaire

Special categories of personal data as specified in Article 9 GDPR shall not be processed under this Agreement.

Processing Activity – Description of the subject of processing

Client will provide the Data Processor with a full set of Client Employee data including cost of employees for the Client Employees in scope. The Line Managers will receive an invitation via mail to use a tool where they need to fill in information about e.g. productivity and personnel allocation for each Client Employee in scope. This will lead to insights and enables the Data Processor to provide the Services to Client.

Purposes – Description of the nature and purpose of the processing

The Data Processor performs an organizational activity assessment for the complete organization including but not limited to internal benchmarking and – if applicable – resource allocation to key processes between the different countries and locations.

Annex 2 List of security measures

Humatica Cyber Security Readiness Measures

Humatica is a specialist consulting firm. We deliver client projects and apply IT-enabled tools and data. Our primary focus is protecting sensitive client data as well as the ability to quickly restore the ability of our consulting teams to work in the event of an occurrence.

Our standard privacy notice (https://www.humatica.com/client-privacy-policy/) outlines:

• The personal data collected
• How we use the information gathered
• The basis for which we collect the data
• Time periods we store the information
• Data security policies
• What occurs in the event of a breach
• International data transfers
• Data protection principles

More specific technical and organizational measures referred to in our privacy policy include:

High-level Measures

• Humatica regularly conducts business continuity risk assessments, supported by our managed service provider En Route Solutions.
• Humatica’s internal systems are supported by an external Managed Service Provider “En Route Solutions” in conjunction with agreements with Microsoft Office 365 and Box.com.
• The data will be stored by Humatica on the secure cloud storage system Box.com with a direct contract with Box.com. Box is ISO27001 plus numerous other security certifications and government approval. (https://www.box.com/en-gb/security-compliance).
• Humatica uses the specialist survey provider Alchemer (www.alchemer.com) for altus. Alchemer is compliant with international regulations including GDPR. Detailed information on their security guidelines can be found at https://www.alchemer.com/security/ and https://www.alchemer.com/privacy/gdpr/.
• We run a formal process with full joiners and leavers forms starting an internal process within En Route Solutions to remove or apply licenses, login access and archive any relevant data as required.
• All relevant staff are regularly trained on our technical and organizational measures.

Information Security Measures

• Personal data is only collected when truly required and then held for only as long as necessary. Further details on information processing measures are outlined in our privacy notice: https://www.humatica.com/client-privacy-policy/ .
• Personal data is clearly labelled with strict file naming processes to enable deletion at the completion of the project.
• We conduct formal end-of-project reviews with standardized checklists for all our projects and delete relevant data.
• All sensitive data is only transferred via secure Box links.
• We do not link directly to client systems.

Hardware, Storage and Network Measures

• All personal data is stored on Box.com with no data being stored on the local machines.
• Data on Box.com is located in both the EU and the USA but can be located only within the EU if required.
• The data is secured via Box.com’s internal file permissions and managed by Humatica Management and En Route Solutions. All client data is separated within the cloud storage.
• The data is secured by login and HTTPS within Box.com cloud storage and is encrypted at rest with aes256 and in transit with tls1.2.
• VPN business layer access is utilized when not on trusted networks.

Access Control Measures

• We apply the least access permission model, controlled by senior managers or project leads depending on circumstances.
• Users all use unique usernames and secure passwords for data access. All aspects of Box.com data access are securely logged even to a preview level.
• User accounts are secured via two-factor authentication and secure hidden passwords via an identity management provider.
• Password measures:
• Passwords are a minimum of 8 characters requiring a mix of numbers, letters, capitals, and punctuation.
• Passwords are changed every 3 months.
• Lockout occurs after 5 incorrect attempts.
• Only our MSP partner En Route Solutions can administer our system functionality, operating systems, and servers. This is strictly controlled.
• En Route Solutions manage all patching and security of local machines.
• Any incidents are logged within En Route Solutions incident logging system and alerted to Humatica management who then in turn promptly pass any relevant details to our customers.
• All logins are monitored for unauthorized access. If this is flagged logs of all access are easily reviewed.

Disaster Recovery, Backups and Data Erasure

• Data is securely archived within Box.com or deleted depending on data and contractual requirements and following our privacy policies.
• com keeps DR and Backup copies of all data across multiple locations and data centers.
• User-deleted data can be immediately restored by the admin or the user. For older or larger data deletions, restores are completed by Box.com.
• com is a fully resilient system with 99% uptime. Humatica runs spare laptops for fast swap and restore of services. There are no other single points of failure..

Annex 3 Subprocessors