The Data Processing Addendum (“DPA”) forms part of IDrive Inc.'s Terms of Service Agreement, another electronic agreement, or a mutually executed agreement between RemotePC and the Customer (“you” and “your”) that applies to the Customer’s use of RemotePC Services (the “Agreement”). It reflects the Parties’ agreement regarding the Processing of Customer Personal Data. Capitalised terms used but not defined in this DPA have the meanings given to them in the Agreement.
1. Purpose and Scope
In providing the RemotePC Service to the Customer under the Agreement, RemotePC will Process Customer Data on your behalf. Customer Data may include Personal Data. This DPA reflects the Parties’ agreement on the Processing of Customer Data in accordance with the requirements of Data Protection Laws and Regulations. This DPA will take precedence in the event of any conflict with the Agreement.
2. Definitions
"Data Controller" means the entity that determines the purposes and means of Processing of Personal Data.
"Data Processor" means the entity that Processes Personal Data on behalf of the Data Controller.
"Data Protection Laws and Regulations" means any applicable data protection laws and regulations applicable to the Processing of Personal Data under the Agreement, including the applicable laws and regulations of the European Union, the European Economic Area and their member states, and Switzerland.
"Data Subject" means the individual to whom Personal Data relates.
"Personal Data" means any information relating to an identifiable or identified individual.
"Processing", "Processes" or "Process" means any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organisation, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, erasure or destruction.
"Sub-processor" means RemotePC’s Affiliates or other third-party service providers that Process Customer Data for RemotePC.
3. Processing of Customer Data
Data Processing Roles. The Parties acknowledge and agree that, for the purposes of the Processing of Customer Data under the Data Protection Laws and Regulations and this DPA, the Customer is the Controller and RemotePC is the Processor. Each Party will comply with the obligations that apply to it under the Data Protection Laws and Regulations in relation to the Processing of Customer Personal Data. RemotePC has no knowledge of or control over the Personal Data that you provide for Processing. You are solely responsible for the accuracy, quality and legality of the Customer Data and the means by which you acquired it.
Data Processing Instructions. This DPA and the Agreement are your complete and final instructions to RemotePC for the Processing of Customer Data. You and RemotePC must agree on any additional or alternative instructions. RemotePC will inform you if, in its opinion, your instructions breach Data Protection Laws and Regulations. RemotePC will Process Customer Data: (1) in accordance with the Agreement (including all documents incorporated into it); and (2) to comply with any other reasonable instructions you provide to RemotePC (including by email), where those instructions are consistent with the Agreement. RemotePC will not otherwise disclose Customer Data to third parties unless required to do so by applicable law. In that case, RemotePC will inform you in advance unless prohibited from doing so. RemotePC will not Process Customer Data for any other purpose unless you instruct it to do so.
Scope and Duration of Processing. RemotePC will Process Customer Personal Data as necessary to provide the RemotePC Service under the Agreement and in accordance with this DPA. The types of Customer Personal Data and categories of Data Subjects that may be Processed under this DPA are set out in Exhibit 1 ("Scope of Processing"). RemotePC will Process Customer Personal Data for the duration of the Agreement unless the Parties agree otherwise in writing.
4. Rights of Data Subjects
Access, Rectification, Restriction and Deletion. RemotePC will enable the Customer to access, rectify, restrict the Processing of, and delete Customer Personal Data, to the extent supported by the functionality of the RemotePC Service.
Data Subject Requests. If RemotePC receives a request from a Data Subject relating to Customer Personal Data, then, to the extent legally permissible, RemotePC will advise the Data Subject to submit the request to the Customer. The Customer is responsible for responding to such requests, including, where necessary, by using the functionality of the RemotePC Service. If you cannot access, rectify, restrict or delete Customer Personal Data as required by Data Protection Laws and Regulations, you may give RemotePC written instructions to act on your behalf. RemotePC will follow your instructions to the extent that this is technically feasible and legally permissible. You will pay RemotePC’s costs of providing this assistance.
Cooperation and Assistance. RemotePC will help you address any request, complaint, notice or communication you receive from (i) a Data Subject whose Personal Data is included in the Customer Data, or (ii) an applicable data protection authority, where it relates to RemotePC’s Processing of Customer Data. RemotePC will also assist with reasonable requests for information to confirm compliance with this DPA or to conduct a privacy impact assessment. You will pay RemotePC’s costs of providing assistance if it exceeds the services provided under the Agreement.
5. Data Security and Confidentiality
Security Controls. RemotePC maintains appropriate administrative, technical and organisational safeguards to protect Customer Data from unauthorised or unlawful Processing, and from accidental loss, destruction or damage. As described in Exhibit 2, the Security Controls include measures to help ensure the ongoing confidentiality, integrity, availability and resilience of RemotePC’s systems and services, as well as the regular testing and effectiveness of those controls.
RemotePC Personnel. RemotePC ensures that access to Customer Data is limited to personnel who need access to Process Customer Data under the Agreement. RemotePC informs personnel involved in the Processing of Customer Data of its confidential nature. RemotePC will take appropriate steps to ensure that its employees, contractors and Sub-processors comply with the Security Controls, as applicable to their work. This includes ensuring that all persons authorised to Process Customer Data are subject to an appropriate obligation of confidentiality.
6. Sub-processors
Authorisation and Commitments. You expressly authorise RemotePC to provide specific services through Sub-processors on its behalf, enabling it to meet its obligations under the Agreement and this DPA. These services may include support services. RemotePC has written agreements with its Sub-processors that contain obligations substantially similar to its obligations under this DPA. RemotePC remains responsible for complying with this DPA and for any acts or omissions of its Sub-processors. RemotePC's current Sub-processors, including their locations and services, are listed at: http://www.remotepc.com/en-gb/authorized-sub-processor. RemotePC will continue to publish changes to its Sub-processors on this website.
Notice and Objection. You may reasonably object to RemotePC’s use of a new Sub-processor by notifying RemotePC in writing within 10 business days of the notice published by RemotePC. If you do so, RemotePC will use reasonable efforts to change the affected Software or Cloud Service, or recommend a commercially reasonable change to your configuration or use of that Software or Cloud Service, to avoid the new Sub-processor Processing Customer Data. If RemotePC cannot make or recommend such a change within a reasonable period, not exceeding 60 days, you may terminate only the Subscription Term for the Software and Cloud Service that RemotePC cannot provide without using the new Sub-processor. You must give RemotePC written notice of termination in accordance with the Agreement.
7. Audit and Reports
Reports. RemotePC uses external auditors to verify its security measures against various security and compliance control standards and certifications. RemotePC has completed the necessary audits and, on the Customer’s written request, can provide supporting documentation to demonstrate that it meets the standards defined by SSAE 16.
Audit Rights. RemotePC will provide you with any additional information reasonably necessary to demonstrate compliance with Data Protection Laws and Regulations, beyond that stated in the Report. It will also allow and contribute to audits, including inspections. You will reimburse RemotePC for the time spent on an audit or inspection at RemotePC's then-current professional service rates, which RemotePC will provide on request. You and RemotePC will agree in advance on the timing, scope, duration and reimbursement rates for any audit or inspection. The Customer must promptly notify RemotePC of any information about non-compliance discovered during the audit.
8. Incident Management and Notification.
RemotePC will notify you without undue delay after becoming aware of a breach involving your Customer Data. To the extent known, the notice will include (i) a description of the nature of the personal data breach; and (ii) the measures RemotePC is taking to address it, to the extent those measures are within RemotePC’s reasonable control, including measures to mitigate its possible adverse effects.
9. Return and Deletion of Customer Data
The RemotePC Service provides the Customer with controls to retrieve Customer Data at any time before the end of a Subscription Term. After your Subscription Term ends, RemotePC will delete your Customer Data in accordance with the Agreement.
10. Data Privacy Framework Programme and Swiss-US Privacy Framework
RemotePC aligns with the EU-U.S. Data Privacy Framework and the Swiss – U.S. Privacy Shield Framework.
The EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. Data Privacy Framework (UK Extension to the EU-U.S. DPF), and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) were established to facilitate transatlantic commerce. These frameworks provide dependable mechanisms for transferring personal data from the European Union, the European Economic Area, the United Kingdom (including Gibraltar) and Switzerland to the United States, in accordance with EU, UK and Swiss law. An organisation must self-certify its commitment to the DPF Principles with the ITA. This involves being listed on the Data Privacy Framework List, which the ITA updates annually based on organisations' annual re-certification submissions.
RemotePC aligns with the EU-U.S. Data Privacy Framework and the Swiss-U.S. Privacy Shield Framework, established by the U.S. Department of Commerce, for the collection, use and retention of personal information transferred from the European Union and Switzerland to the United States, respectively. RemotePC has certified to the Department of Commerce that it adheres to the Privacy Shield Principles.
If RemotePC determines that it can no longer meet these obligations, it will promptly notify you and cease Processing your Personal Data or take reasonable and appropriate steps to remedy the situation.