Source: http://www.episerver.fi/legal/data-processing-agreement/
Timestamp: 2018-02-25 23:30:31
Document Index: 251779534

Matched Legal Cases: ['§ 3', '§ 4', '§ 5', '§ 4', '§ 42', '§ 7', '§ 7', '§ 9', '§ 8', '§ 9']

Data Processing Agreement -
As referred to in Section 7 of the Episerver End-User Services Agreement (“EUSA”), for the purposes of Article 26(2) of Directive 95/46/EC, Customers located in the European Union or the European Economic Area may enter into a Data Processing Agreement that includes the Standard Contractual Clauses adopted by the European Commission in order to further provide adequate safeguards with respect to the data processed under the Episerver EUSA. This document is the Data Processing Agreement that Episerver references in the aforementioned section.
This Episerver Data Processing Agreement (“DPA”) reflects the Parties’ agreement with respect to the terms governing the processing of Personal Data under the Episerver End-User Services Agreement (“EUSA”). This DPA is an amendment to the EUSA and is effective upon its incorporation into the EUSA, which incorporation may be specified in an MSA and/or Order or an executed amendment to the EUSA. Upon its incorporation into the EUSA, the DPA will form a part of the EUSA.
In all cases Episerver (“Processor”), or a third party acting on behalf of Processor, acts as the processor of Personal Data and you (“Controller”) remain controller of Personal Data. The term of this DPA shall follow the term of the EUSA. Terms not otherwise defined herein shall have the meaning as set forth in the EUSA.
a) Appendix 1 to the Standard Contractual Clauses, which includes specifics on the personal data transferred by the data exporter to the data importer.
b) Appendix 2 to the Standard Contractual Clauses, which includes a description of the technical and organizational security measures implemented by the data importer as referenced.
(ii) List of Processor affiliates and other third parties who are approved as Subcontractors, attached hereto as EXHIBIT 2.
(iii) Confirmation and Description of Personal Data contained within EXHIBIT 3.
(iiii) Overview of technical and Organisational Measures, attached hereto as EXHIBIT 4 (as such may be amended from time to time under this DPA).
“European Data Protection Laws” has the meaning given to that term in the EUSA.
“Personal Data” means personal data (within the meaning given to that term in European Data Protection Laws) of the type (and relating to the categories of data subject) described in EXHIBIT 3
“Processing” (and similar terms) have the meanings given to these terms in European Data Protection Laws.
“Instructions” means the written instruction, issued by Controller to Processor, and directing the same to Process Personal Data (including, but not limited to, depersonalising, blocking, deletion, making available such Personal Data). Instructions shall initially be specified in the EUSA and may, from time to time thereafter, be amended, amplified or replaced by Controller in separate written instructions (individual instructions).
“Standard Contractual Clauses” means the Standard Contractual Clauses contained within EXHIBIT 1 or such other standard data protection clauses as may be adopted by the European Commission pursuant to European data protection Laws from time to time.
Processor shall Process Personal Data on behalf of Controller in accordance with Instructions. The Controller shall be solely responsible for performing its obligations as controller under European Data Protection Laws, including (without limitation) for complying with the statutory requirements relating to data protection, in particular regarding the transfer of Personal Data to the Processor and the Processing of Personal Data (acting as “responsible body” as defined in the German Federal Data Protection Act (“BDSG”) § 3 para. 7 or a corresponding provision of the otherwise applicable national data protection law).
Based on this responsibility, Controller shall be entitled to demand the rectification, deletion, blocking and making available of Personal Data during and after the term of the EUSA in accordance with the further specifications of such agreement on return and deletion of Personal Data.
Processor shall Process Personal Data only within the scope of Controller’s Instructions. If the Processor thinks that an instruction of the Controller infringes European data Protection Laws, it shall notify the Controller without undue delay. Controller confirms that, for the purposes of this DPA, subject to compliance with European Data Protection Laws, Processor may Process Personal Data under this DPA in third countries outside the EEA, including, in particular, Vietnam, Australia and the United States of America.
Within Processor’s area of responsibility, Processor shall structure Processor’s internal corporate organisation to ensure compliance with the terms of this DPA and any obligations of processors under European Data Protection Laws. Processor shall take the appropriate technical and organisational measures to adequately protect Controller’s Personal Data against misuse and loss in accordance with the requirements of European Data Protection Laws. Such measures hereunder shall include, but not be limited to,
b) the prevention of Personal Data Processing systems from being used without authorisation (logical access control),
c) ensuring that persons entitled to use a Personal Data Processing system gain access only to such Personal Data as they are entitled to accessing in accordance with their access rights and Controller’s Instructions, and that, in the course of processing or use and after storage, Personal Data cannot be read, copied, modified or deleted without authorisation (data access control),
d) ensuring that Personal Data cannot be read, copied, modified or deleted without authorisation during electronic transmission, transport or storage on storage media, and that the target entities for any transfer of Personal Data by means of data transmission facilities can be established and verified (data transfer control),
f) ensuring that Personal Data Processed are Processed solely in accordance with the Instructions (control of instructions),
A measure as referred to in lit. b to d above shall be in particular, but shall not be limited to, the use of state of the art encryption technology for client access. An overview of the above listed technical and organizational measures is contained in EXHIBIT 3. Processor is entitled to change the technical and organizational measures is contained in EXHIBIT 3 by notice in writing to the Controller provided that Processor shall not be entitled to remove or reduce the levels of security without the prior written consent of Controller.
In Processing the Personal Data as processor shall:
(i) not acquire any rights in such Personal Data and, on Controller’s demand, will either return to the Company or destroy and/or permanently delete from its information systems (at the option of Controller) all copies of any such Personal Data in its possession (in any form or format whatsoever);
(ii) promptly provide Controller with such evidence as Controller reasonably requests of the technical and organisational measures in place from time to time under this Clause;
(iii) otherwise co-operate with Controller as controller to the extent required by Data Protection Law, including by the provision of information as necessary to demonstrate compliance with the requirements of European Data Protection Laws in respect of the Processing of the Personal Data under this DPA, provided that (i) Controller has instructed Processor in writing to do so, and (ii) Controller reimburses Processor for the costs arising from this co-operation; and
(iiii) upon becoming aware inform Controller of any unauthorised or unlawful Processing of such Personal Data and of any loss or destruction of or other damage to such Personal Data, and thereafter promptly: (i) provide Controller with all such information as Controller reasonably requests in connection with such incident; (ii) take such steps as Controller reasonably requires it to take to mitigate the detrimental effects of any such incident on any Data Subjects in relation to such Personal Data and/or on Controller; and (iii) otherwise co-operate with Controller in investigating and dealing with such incident and its consequences.
Additionally, for Processing German Personal Data as processor shall:
(v) Upon Controller’s request, and except where Controller is able to obtain such information directly, Processor shall provide all information necessary for compiling the overview defined by § 4g para. 2 sentence 1 BDSG or a corresponding provision of the otherwise applicable national data protection law.
(vi) Processor shall ensure that any personnel entrusted with Processing Controller’s Personal Data have undertaken to comply with the principle of data secrecy in accordance with § 5 BDSG (or a corresponding provision of the otherwise applicable national data protection law) and have been duly instructed on the protective regulations of the BDSG or the otherwise applicable national data protection law. The undertaking to secrecy shall continue after the termination of the above-entitled activities.
Controller shall retain title as to any carrier media provided to Processor as well as any copies or reproductions thereof. Processor shall store such media safely and protect them against unauthorised access by third parties. Processor shall, upon Controller’s request, provide to Controller all information on Controller’s Personal Data and information. Processor shall be obliged to securely delete any test and scrap material based on an Instruction issued by Controller on a case-by-case basis. Where Controller so decides, Processor shall hand over such material to Controller or store it on Controller’s behalf.
Processor shall be obliged to audit and verify the fulfilment of the above-entitled obligations and shall maintain an adequate documentation of such verification.
Within thirty (30) days of this DPA becoming effective, Controller shall provide Processor with a data map which details the categories of Personal Data and their locations within the database hosted within the Software or Other Software provided as part of the Software Services, such that Processor shall be able to exercise its rights and perform its obligations under this DPA. This data map shall become the basis of EXHIBIT 3. Controller shall regularly (and at least every subsequent 3 months) update the data map and provide it to Processor or confirm in writing if there have been no changes.
The Controller shall comply with its obligations as controller in relation to its Processing of the Personal Data under European Data Protection Laws, including (without limitation):
(i) maintaining the publicly available register as defined in § 4g para. 2 sentence 2 BDSG (or other corresponding provision of European Data Protection Laws); and
(ii) fulfilling the duties to inform resulting from § 42a BDSG or a corresponding provision of corresponding provision of European Data Protection Laws.
Controller shall, upon termination or expiration of the EUSA and by way of issuing an Instruction, stipulate, within a period of time set by Processor, the reasonable measures to return data carrier media or to delete stored data.
Any additional cost arising in connection with the return or deletion of Personal Data after the termination or expiration of the EUSA shall be borne by Controller.
5. Enquiries by Data Subjects to Controller
Where Controller upon European Data Protection Law, is obliged to provide information to an individual data subject concerning the Processing of Personal Data under this DPA, Processor shall, to the extent feasible, assist Controller in making this information available, provided that: (i) Controller has instructed Processor in writing to do so, and (ii) Controller reimburses Processor for the costs arising from this assistance.
Controller may, prior to the commencement of Processing, and at regular intervals thereafter, audit the technical and organisational measures taken by Processor, and shall document the resulting findings. Such audit guidelines and principles are further detailed in the end-user services agreement between the parties.
(i) obtain information from the Processor,
(ii) request Processor to submit to Controller an existing attestation or certificate by an independent professional expert, or
(iii) upon reasonable and timely advance agreement, during regular business hours and without interrupting Processor’s business operations, and at Controller’s sole cost conduct an on-site inspection of Processor’s business operations or have the same conducted by a qualified third party which shall not be a competitor of Processor.
Processor shall, upon Controller’s written request and within a reasonable period of time, provide Controller with all information necessary for such audit, except to the extent such disclosure of information would violate Episerver contracts and/or security and other related policies and procedures.
Subject to the remaining provisions of this§ 7, Processor shall be entitled to subcontract Processor’s obligations defined in the EUSA to third parties only with Controller’s written consent.
Controller consents to Processor’s subcontracting to Processor’s affiliated companies and third parties, as listed in Exhibit 2, of Processor’s contractual obligations hereunder.
If the Processor intends to instruct subcontractors other than the companies listed in Exhibit 2, the Processor must notify the Controller thereof in writing (email to the email address(es) on record in Processor’s account information for Controller is sufficient) and must give the Controller the possibility to object against the instruction of the subcontractor within 30 days after being notified. The objection must be based on reasonable grounds (e.g. if the Controller proves that significant risks for the protection of its Personal Data exist at the subcontractor). If the Processor and Controller are unable to resolve such objection, either party may terminate the EUSA by providing written notice to the other party. Controller shall receive a refund of any prepaid but unused fees for the period following the effective date of termination.
Where Processor engages subcontractors, Processor shall be obliged to pass on Processor’s contractual obligations hereunder to such subcontractors. Sentence 1 shall apply in particular, but shall not be limited to, the contractual requirements for confidentiality, data protection and data security stipulated between the parties of the EUSA.
Where a subcontractor is used, the Controller must be granted the right to monitor and inspect the subcontractor in accordance with this DPA and European Data Protection Laws (specifically for Germany-based Controllers, Section 11 BDSG in conjunction with item No 6 of the Annex to Section 9 BDSG). This also includes the right of the Controller to obtain information from the Processor, upon written request, on the substance of the contract and the implementation of the data protection obligations within the subcontract relationship, where necessary by inspecting the relevant contract documents.
The provisions of this § 7 shall apply as well if a subcontractor in a third country shall be instructed. Controller hereby authorizes Processor, to agree in the name and on behalf of the Controller with a subcontractor which processes or uses Personal Data of the Controller outside of the EEA, to enter into Standard Contractual Clauses. This applies accordingly from the date of this authorization with respect to Standard Contractual Clauses already concluded by the Processor with such subcontractors. Controller understands and agrees that Processing of Personal data by Processor’s affiliated companies and third parties, as listed in Exhibit 2, may take place outside the EEA, including, in particular, Vietnam, Australia and the United States of America.
The use of Standard contractual Clauses is without prejudice to any other grounds upon which the Processing of Personal Data in third countries outside the EEA may be permitted under European Data Protection Laws.
Where Controller’s Personal Data becomes subject to search and seizure, an attachment order, confiscation during bankruptcy or insolvency proceedings, or similar events or measures by third parties while being Processed, Processor shall inform Controller without undue delay. Processor shall, without undue delay, notify to all pertinent parties in such action, that any Personal Data affected thereby is in Controller’s sole property and area of responsibility, that Personal Data is at Controller’s sole disposition, and that Controller is the responsible body in the sense of the BDSG (or a corresponding provision of the otherwise applicable national data protection law).
With respect to updates and changes to this DPA, the terms that apply in the ‘Amendment; No Waiver’ Section 13 in the EUSA shall apply.
In case of any conflict, the regulations of this DPA shall take precedence over the regulations of the EUSA. Where individual regulations of this DPA are invalid or unenforceable, the validity and enforceability of the other regulations of this DPA shall not be affected.
The Standard Contractual Clauses in Exhibit 1 (“SCCs”) will apply to the processing of Personal Data by Processor under the EUSA. Upon the incorporation of this DPA into the EUSA, the parties indicated in § 9 below (Parties to this DPA) are agreeing to the SCCs and all appendixes attached thereto. In the event of any conflict or inconsistency between this DPA and the Standard Contractual Clauses in Exhibit 1, the SCCs shall prevail.
9. Parties to the DPA
This DPA is an amendment to and forms part of the EUSA. Upon the incorporation of this DPA into the EUSA (i) Controller and the Episerver entity that are each a party to the EUSA are also each a party to this DPA, and (ii) Episerver, Inc., Episerver AB, and Optivo GmbH are a party to this DPA, but only with respect to agreement to the SCCs pursuant to § 8 of the DPA, this section § 9 of the DPA, and to the SCCs themselves.
If Episerver, Inc., Episerver AB or Optivo GmbH is not a party to the EUSA, the section of the EUSA entitled ‘Limitation of Liability’ shall apply as between Controller and Episerver, Inc. Controller and Episerver AB, or Controller and Optivo GmbH, and in such respect any references to ‘Episerver’, ‘we’, ‘us’ or ‘our’ shall include both Episerver AB and the Episerver entity that is a party to the EUSA.
Customer, as defined in the Master Services Agreement (“MSA”) and Order(s) (the “Data Exporter”)
Episerver, as defined in the Master Services Agreement (“MSA”) and Order(s), namely one of the following entities –
Episerver AB, Episerver AB, Regeringsgatan 67, Box 7007, 103 86 Stockholm, Sverige,
Episerver Inc., 542 Amherst Street (Route 101A), Nashua, NH 03063, USA, or
Optivo GmbH., Wallstr. 16, Berlin, Deutschland
d) ‘the subprocessor’ means any processor engaged by the data importer or by any other subprocessor of the data importer who agrees to receive from the data importer or from any other subprocessor of the data importer personal data exclusively intended for processing activities to be carried out on behalf of the data exporter after the transfer in accordance with his instructions, the terms of the Clauses and the terms of the written subcontract;
f) ‘technical and organisational security measures’ means those measures aimed at protecting personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.
(i) The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party beneficiary.
(ii) The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law, as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity.
(iii) The data subject can enforce against the subprocessor this Clause, Clause 5(a) to (e) and (g), Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent, unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law as a result of which it takes on the rights and obligations of the data exporter, in which case the data subject can enforce them against such entity. Such third-party liability of the subprocessor shall be limited to its own processing operations under the Clauses.
(iiii) The parties do not object to a data subject being represented by an association or other body if the data subject so expressly wishes and if permitted by national law.
i) that, in the event of subprocessing, the processing activity is carried out in accordance with Clause 11 by a subprocessor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and
i) that the processing services by the subprocessor will be carried out in accordance with Clause 11;
2, The parties agree that the supervisory authority has the right to conduct an audit of the data importer, and of any subprocessor, which has the same scope and is subject to the same conditions as would apply to an audit of the data exporter under the applicable data protection law.
The data exporter is the Customer, as defined in the Master Services Agreement and/or Order(s).
The data importer is Episerver, as defined in the Master Services Agreement and/or Order(s), namely one of the following entities –
The personal data transferred concern personal data, entity data, navigational data (including website usage information), email data, system usage data, application integration data, and other electronic data submitted, stored, sent, or received by end users via the Software Service(s).
With respect to personal data of non-German end users as data exporters, the following provisions apply:
The Data Exporter determines the types of data they submit to the Data Importer to process on their behalf in the course of using the Data Importer’s services. The Data Importer has no direct relationship with the individuals whose information it receives from its customers or their business partners. The Data Importer does not control such information, does not select or determine the specific types of data that it processes, and does not determine the purpose for which it is processed.
In other instances, the Data Importer may collect Personal Data when performing expert services at its customers’ request, to provide customer support, in general support of its customer relationships, which may include but are not limited to marketing activities, fulfilling product orders, to improve product offerings, customer surveys, questionnaires, responses to comments, etc., to download software and/or gain access to and/or enable certain products or services, for internal business processes, such as financial processing, responding to informational requests, and to comply with applicable laws.
Personal data may be processed for the following purposes: (a) to provide the Software Service (which may include the detection, prevention and resolution of security and technical issues); (b) to respond to customer support requests; and (c) otherwise to fulfill the obligations under the Episerver End-User Services Agreement and Service Level Agreement. The Data Exporter instructs the Data Importer to process personal data in countries in which the Data Importer or its subprocessors maintain facilities as necessary for it to provide the Software Service(s).
Data processing will be for the term specified in the Episerver End-User Services Agreement. For the term of the End-User Services Agreement, and for a reasonable period of time after the expiry or termination of the Episerver End-User Services Agreement, the Data Importer will provide the Data Exporter with access to, and the ability to export, the Data Exporter’s personal data processed pursuant to the Episerver End-User Services Agreement.
For the term of the Episerver End-User Services Agreement, the Data Importer will provide the Data Exporter with the ability to delete data as detailed in the Episerver End-User Services Agreement.
For the term of the Episerver End-User Services Agreement, the Data Importer will provide the Data Exporter with the ability to correct, block, export and delete the Data Exporter’s personal data from the Software Service(s) in accordance with the Episerver End-User Services Agreement.
The Data Importer may engage subprocessors to provide parts of the Software Service. The Data Importer will ensure subprocessors only access and use the Data Exporter’s personal data to provide the Data Importer’s products and services and not for any other purpose.
Taking into account the requirements of Section 11 German Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG) on commissioned data processing, the processing activities are specified as follows:
1. Subject and duration of the commission
Personal data may be processed for the following purposes: (a) to provide the Software Service (which may include the detection, prevention and resolution of security and technical issues); (b) to respond to customer support requests; and (c) otherwise to fulfill the obligations under the Episerver End-User Services Agreement and Service Level Agreement. The Clauses have been concluded for the duration of the respective service agreement (Episerver End-User Services Agreement).
2. Extent, type and purpose of the planned collection, processing or use of data; the type of data and group of persons affected
See for the type of data and group of persons affected the descriptions included in this Appendix 1 under the headings “Categories of data” and “Data subjects”.
The purpose of the processing is: (a) to provide the Software Service (which may include the detection, prevention and resolution of security and technical issues); (b) to respond to customer support requests; and (c) otherwise to fulfill the obligations under the Episerver End-User Services Agreement.
3. Technical and organizational measures to be taken under Section 9 BDSG
4. Correction, erasure and blocking of data
5. Agent’s obligation under sub-Section 4 (of Section 11 BDSG), in particular controls to be undertaken
6. Right to issue subcontracts
See Clauses 5 (h) and 11 of the Clauses. The data exporter already agrees to subcontracting the data processors listed in Exhibit 2.
If the Data Importer intends to instruct subcontractors other than the companies listed in Exhibit 2, the Data Importer must notify the data exporter thereof in writing (email to the email address(es) on record in the Data Importer’s account information for data exporter is sufficient) and must give the data exporter the possibility to object against the instruction of the subcontractor within 30 days after being notified. The objection must be based on reasonable grounds (e.g. if the data exporter proves that significant risks for the protection of its personal data exist at the subcontractor). If the Data Importer and data exporter are unable to resolve such objection, either party may terminate the EUSA by providing written notice to the other party. data exporter shall receive a refund of any prepaid but unused fees for the period following the effective date of termination.
7. Principal’s rights of control and the agent’s corresponding obligations to tolerate and cooperate
8. Violations by the agent or persons employed by him/her of provisions to protect personal data or of terms specified in the commission which must be reported
9. Extent of the principal’s authority to issue instructions to the agent
Personal data can only be processed by the Data Importer based upon instructions of the data exporter. Except as legally required, personal data may be processed or used for another purpose, including disclosure to third parties, only with the prior written approval of the data exporter. Copies of the personal data shall not be made without consent of the data exporter, except for copies which are necessary for the processing or if required to comply with statutory retention obligations.
10. Return of data storage media and the erasure of data stored by the agent after the commission has been completed.
Data exporter shall be entitled to demand the rectification, deletion, blocking and making available of personal data during and after the term of the respective service agreement (Episerver End-User Services Agreement) in accordance with the further specifications of such agreement on return and deletion of personal data.
Episerver currently observes the security practices described in this Appendix 2. Notwithstanding any provision to the contrary otherwise agreed to by Data Exporter, Episerver may modify or update these practices at its discretion provided that such modification and update does not result in a material degradation in the protection offered by these practices. All capitalized terms not otherwise defined herein shall have the meanings as set forth in the Episerver End-User Services Agreement.
Outsourced processing: Episerver hosts its Software Services with outsourced, EU, US or Australia-based data center providers, which is the choice of Data Exporter. Additionally, Episerver maintains contractual relationships with vendors in order to provide the Software Services. Episerver relies on contractual agreements, privacy policies, and vendor compliance programs in order to assure the protection of data processed or stored by these vendors.
Physical and environmental security: Episerver hosts its product infrastructure with multi-tenant, outsourced data center providers. The outsourced data center providers’ physical and environmental security controls are audited for SOC 2 Type II and ISO 27001 compliance, among other certifications.
Authentication: Episerver implemented functions allowing Customers to implement their own password policy. Customers who interact with the products via the user interface must authenticate before accessing non-public customer data.
Authorization: Customer data is stored in multi-tenant storage systems accessible to Customers via only application user interfaces and application programming interfaces. Customers are not allowed direct access to the underlying application infrastructure. The authorization model in each of Episerver’s products is designed to ensure that only the appropriately assigned individuals can access relevant features, views, and customization options. Authorization to data sets is performed through validating the user’s permissions against the attributes associated with each data set.
Episerver implements industry standard access controls and detection capabilities for the internal networks that support its products.
Intrusion detection and prevention: Episerver implemented a Web Application Firewall (WAF) solution to protect all hosted sites as well as Episerver Service access. The WAF is designed to identify and prevent attacks against publicly available network services.
Penetration testing: Episerver maintains relationships with industry recognized penetration testing service providers for four annual penetration tests. The intent of the penetration tests is to identify and resolve foreseeable attack vectors and potential abuse scenarios.
Product access: A subset of Episerver’s employees have access to the products and to customer data via controlled interfaces. The intent of providing access to a subset of employees is to provide effective customer support, to troubleshoot potential problems, and to detect and respond to security incidents. Access is enabled through “just in time” requests for access; all such requests are logged. Employees are granted access by role, and reviews of high risk privilege grants are initiated daily. Employee roles are reviewed at least once every six months.
Background checks: All new Episerver employees undergo a 3rd party background check prior to being extended an employment offer, as local laws allow. All employees are required to conduct themselves in a manner consistent with company guidelines, non-disclosure requirements, and ethical standards.
In-transit: Episerver makes HTTPS encryption (also referred to as SSL or TLS) available on every one of its login interfaces and as included in specific orders on every customer site hosted on the Episerver products. Episerver’s HTTPS implementation uses industry standard algorithms and certificates.
At-rest: Episerver stores user passwords following policies that follow at least industry standard practices for security.
Detection: Episerver designed its infrastructure to log extensive information about the system behavior, traffic received, system authentication, and other application requests. Internal systems aggregated log data and alert appropriate employees of malicious, unintended, or anomalous activities. Episerver personnel, including security, operations, and support personnel, are responsive to known incidents.
Response and tracking: Episerver maintains a record of known security incidents that includes description, dates and times of relevant activities, and incident disposition through its Security Incident Management process. Suspected and confirmed security incidents are investigated by the Episerver Security Incident Response Team (SIRT); and appropriate resolution steps are identified and documented. For any confirmed incidents, Episerver will take appropriate steps to minimize product and Customer damage or unauthorized disclosure.
Communication: If Episerver becomes aware of unlawful access to Customer data stored within its products, Episerver will: 1) notify the affected Customers of the incident; 2) provide a description of the steps Episerver is taking to resolve the incident; and 3) provide status updates to the Customer contact, as Episerver deems necessary. Notification(s) of incidents, if any, will be delivered to one or more of the Customer’s contacts in a form Episerver selects, which may include via email or telephone.
The Episerver Marketing Product provides a solution for Customers to conduct their marketing and sales activities. Customers control the data types collected by and stored within their portals. Episerver never sells personal data to any third party.
Terminating Customers: Core Customer Data in active (i.e., primary) databases is purged upon a customer’s written request, or for our Software Services listed at http://www.episerver.com, 30 days after a customer terminates all agreements for such Software Services with Episerver. Marketing information stored in backups, replicas, and snapshots is not automatically purged, but instead ages out of the system as part of the data lifecycle. Episerver reserves the right to alter data purging period in order to address technical, compliance, or statutory requirements. “Core Customer Data” includes (i) the name, email address, phone number, online user name(s), telephone number, and similar information voluntarily submitted by visitors to your landing pages on the Software Service, and (ii) data related to your visitors’ social media activities to the extent such activities can be tied to an identifiable individual; and excludes (i) analytics data, (ii) Customer Materials, (iii) aggregated anonymous data, (iv) logs, archived data or back-up data files, (v) other data that is not reasonably practicable for us to delete and (v) other data that is or becomes generally known to the public without breach of any obligation owed to Customer.
Infrastructure availability: The data center providers use commercially reasonable efforts to ensure a minimum of 99.9% uptime. The providers maintain a minimum of N+1 redundancy to power, network, and HVAC services.
Episerver’s Software Services are designed to ensure redundancy and enable failover. The server instances that support the products are also architected with a goal to prevent single points of failure. This design assists Episerver operations in maintaining and updating the product applications and backend while limiting downtime.
f) Separation in Processing
Episerver’s collection of personal data from its Customers is to provide and improve our Sales and Marketing Products. Episerver does not use that data for other purposes that would require separate processing.
EXHIBIT 2 - Subcontractors
Episerver Australia Pty. Ltd.
Episerver Research and Development Ltd.
Any other wholly-owned Episerver AB and Episerver Inc. subsidiary organizations
EXHIBIT 3 - Categories of Data and Data Subjects
As described in the DPA, Controller is to provide Processor a data map of categories of personal data and data subjects within thirty (30) days of the DPA becoming effective. Such data map, and their subsequent updates are to be appended as part of Exhibit 3.
EXHIBIT 4 – Technical and Organisational Measures
Detailed technical and organisational measures to be taken under this DPA can be found here - http://www.episerver.com/about/privacy/trust-center/