Exhibit 1: European Data Processing Addendum for Teamwork Services
(“European DPA Addendum”)
This European DPA Addendum supplements the Data Processing Agreement to include additional Processor terms applicable to the Processing of Personal Information subject to Applicable European Data Protection Law.
Except as expressly stated otherwise in the Data Processing Agreement, the Services Agreement, this European DPA Addendum or the Teamwork Processor Code, in the event of any conflict between these documents, the following order of precedence applies (in descending order): (i) the Teamwork Processor Code; (ii) this European DPA Addendum; (iii) the body of the Data Processing Agreement; and (iv) the Services Agreement.
2. Cross-Border Data Transfers – Teamwork Processor Code
2.1 The Teamwork Processor Code (Standard Contractual Clauses) applies to the Processing of Personal Information by Teamwork on Your behalf in its role as a Processor as part of the provision of Services under the Services Agreement and this European DPA Addendum, where such Personal Information is:
(i) subject to any data transfer restrictions under Applicable European Data Protection Law; and (ii) processed by Teamwork or an Teamwork Affiliate in a country outside Europe.
2.2 Transfers to Third Party Sub-processors shall be subject to security and data privacy requirements consistent with the Teamwork Processor Code, the Data Processing Agreement and the Services Agreement.
3. Description of Processing
3.1 Duration of processing activities. Teamwork may Process Personal Information during the term of the Services Agreement and to perform its obligations under Section 9 of the Data Processing Agreement, unless otherwise required by applicable law.
3.2 Processing activities. Teamwork may Process Personal Information as necessary to perform the Services, including where applicable for hosting and storage; backup and disaster recovery; service change management; issue resolution; applying new product or system versions, patches, updates and upgrades; monitoring and testing system use and performance; IT security purposes including incident management; maintenance and performance of technical support systems and IT infrastructure; and migration, implementation, configuration and performance testing.
3.3 Categories of Personal Information. In order to perform the Services and depending on the Services You have ordered, Teamwork may Process some or all of the following categories of Personal Information: personal contact information such as name, home address, home telephone or mobile number, fax number, email address, and passwords; information concerning family, lifestyle and social circumstances including age, date of birth, marital status, number of children and name(s) of spouse and/or children; employment details including employer name, job title and function, identification numbers, and business contact details; financial details; goods and services provided; unique IDs collected from mobile devices, network carriers or data providers; IP addresses and online behavior and interest data.
3.4 Categories of Data Subjects. Categories of Data Subjects whose Personal Information may be Processed in order to perform the Services may include, among others, Your representatives and end users, such as Your employees, job applicants, contractors, collaborators, partners, suppliers, customers and clients.
3.5 Additional or more specific descriptions of Processing activities, categories of Personal Information and Data Subjects may be described in the Services Agreement.
4. Your Instructions
4.1 Your right to provide instructions to Teamwork as specified in Section 2 of the Data Processing Agreement encompasses instructions regarding (i) data transfers as set forth in Section 1 of this European DPA Addendum; and (ii) assistance with Data Subject requests to access, delete or erase, restrict, rectify, receive and transmit (data portability), block access to or object to Processing of specific Personal Information or sets of Personal Information as described in Section 3 of the Data Processing Agreement.
4.2 To the extent required by the Applicable EEA Data Protection Law, Teamwork will immediately inform You if, in its opinion, Your instruction infringes Applicable European Data Protection Law. You acknowledge and agree that Teamwork is not responsible for performing legal research and/or for providing legal advice to You.
5. Notice and Objection Right to New Teamwork Affiliates and Third Party Subprocessors
5.1 Subject to the terms and restrictions specified in this Section 4 of the European DPA Addendum and Section 4 of the Data Processing Agreement, You provide Teamwork general written authorization to engage Teamwork Affiliates and Third Party Sub-processors to assist in the performance of the Services.
5.2 Within fourteen (14) calendar days of Teamwork providing such notice to You, You may object to the intended involvement of a Third Party Subprocessor or Teamwork Affiliate in the performance of the Services, providing objective justifiable grounds related to the ability of such Third Party Subprocessor or Teamwork Affiliate to adequately protect Personal Information in accordance with the Data Processing Agreement or Applicable European Data Protection Law in writing by submitting a “service request” via (i) My Teamwork Support (or other applicable primary support tool) or (ii) for ACS and Consulting Services, the project manager for the Services. You and Teamwork will work together in good faith to find a mutually acceptable resolution to address such objection, including but not limited to reviewing additional documentation supporting the Third Party Sub-processor’s or Teamwork Affiliate’s compliance with the Data Processing Agreement or Applicable European Data Protection Law, or delivering the Services without the involvement of such Third Party Sub-processor. To the extent You and Teamwork do not reach a mutually acceptable resolution within a reasonable timeframe, You shall have the right to terminate the relevant Services (i) upon serving thirty (30) days prior notice; (ii) without liability to You or Teamwork and (iii) without relieving You from Your payment obligations under the Services Agreement up to the date of termination. If the termination in accordance with this Section 4.2 only pertains to a portion of Services under an order, You will enter into an amendment or replacement order to reflect such partial termination.
6. Information and Assistance
6.1 For hosted Services, Your audit rights under Section 7 of the Data Processing Agreement.
6.2 In addition, You may request that Teamwork audit a Third Party Sub-processor or provide confirmation that such an audit has occurred (or, where available, obtain or assist You in obtaining a third-party audit report concerning the Third Party Sub-processor’s operations) to verify compliance with the Third Party Sub-processor’s obligations. You will also be entitled, upon written request, to receive copies of the relevant privacy and security terms of Teamwork’s agreement with any Third Party Subprocessors and Teamwork Affiliates that may Process Personal Information.
6.3 Teamwork provides You with information and assistance reasonable necessary for You to conduct Your data protection impact assessments or consult with Your Regulator(s), contact Your Teawmwork Customer Success Team who will provide assistance and documentation.
7. Data Protection Officer/Security Team
7.1 Teamwork has a security team that can be contacted at the following email address: ITSecurity@teamworkcommerce.com.
7.2 If You have appointed a Data Protection Officer, You may request Teamwork to include the contact details of Your Data Protection Officer in the relevant Services order.