{"id":6231,"date":"2025-01-01T00:00:13","date_gmt":"2025-01-01T00:00:13","guid":{"rendered":"https:\/\/ecaldima.com\/avenant-relatif-au-traitement-des-donnees\/"},"modified":"2025-05-24T21:17:28","modified_gmt":"2025-05-24T21:17:28","slug":"data-processing-addendum","status":"publish","type":"page","link":"https:\/\/ecaldima.com\/en\/data-processing-addendum\/","title":{"rendered":"Data Processing Addendum"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\n\t\n\t\n\t\n<\/svg>\t\t<\/div>\n\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Data Processing Addendum<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tEffective Date: 01\/01\/2025

Purpose
This Data Processing Addendum, including its Schedules (\u201cDPA\u201d), is entered into by and between Zapp and the Customer (each a \u201cParty\u201d and together the \u201cParties\u201d).
This DPA forms an integral part of the Main Service Agreement, or other applicable written or electronic terms of service between the Parties (\u201cAgreement\u201d).
Unless amended in writing by Zapp, this DPA shall take effect on the earlier of:
(i) the Customer\u2019s initial access to any Service via online provisioning, registration or ordering; or
(ii) the effective date of the first applicable Service Order Form (the \u201cEffective Date\u201d).
The obligations herein shall only apply to the extent that:
(i) Personal Data is subject to Applicable Data Protection Laws; and
(ii) such law has entered into force.

Modifications
Zapp may modify this DPA from time to time. Unless otherwise stated, such modifications shall take effect for the Customer upon renewal of the then-current Subscription Term or upon execution of a new Service Order Form referencing the updated DPA.
Zapp will make reasonable efforts to notify the Customer of any changes via the Customer Account, by email, or by other appropriate means.

Acceptance
By accepting this Data Processing Addendum or by accessing or using the Service, you confirm that you have read and understood the terms of this DPA, agree to be bound by it on behalf of the Customer, and represent and warrant that you have full legal authority to bind the Customer to its terms.

Relationship with the Agreement
Unless otherwise defined in this DPA or the Agreement, all capitalised terms shall have the meanings set out in clause 10.
In the event of a conflict between this DPA and the Agreement, the DPA shall prevail to the extent of the inconsistency.
Where the Parties rely on an International Data Transfer Mechanism, any conflict between its terms and those of this DPA shall be resolved in favour of the mechanism.

a processing

a. Scope and roles
This DPA applies whenever Zapp processes Personal Data.
Section 5 applies where Zapp acts as a Processor on behalf of the Customer, who acts as Controller.
Section 6 applies where Zapp processes certain Personal Data about the Customer or its users as an independent Controller, in accordance with its privacy notice available at https:\/\/www.zapp.com\/privacy.

b. Processing details
Schedule 1 of this DPA sets out:
(i) the purposes of processing by Zapp, the types or categories of Personal Data processed, and the categories of Data Subjects concerned; and
(ii) the roles of the Parties under Applicable Data Protection Laws.

c. Location of processing
Personal Data processed by Zapp as a Processor may be stored within or outside the European Union, depending on the product or service used.
Personal Data processed by Zapp as a Controller may also be stored or processed within or outside the European Union.

d. International data transfers

i. Where required under Applicable Data Protection Laws, the Parties agree to implement a valid international data transfer mechanism (\u201cInternational Data Transfer Mechanism\u201d) where Personal Data is transferred to a jurisdiction that does not ensure an adequate level of data protection.

ii. If the International Data Transfer Mechanism relied upon by the Parties is invalidated or replaced, the Parties shall cooperate in good faith to implement a suitable alternative.

iii. Schedule 4 sets out:
(i) jurisdiction-specific obligations; and
(ii) information relating to international transfers, including the Standard Contractual Clauses (SCCs).

e. Compliance with laws
Each Party shall comply with its respective obligations under Applicable Data Protection Laws.

f. Notification of inability to comply
Zapp shall notify the Customer without undue delay if it determines that it is unable to comply with its obligations under Applicable Data Protection Laws.

 

3. Zapp\u2019s obligations as a Processor

a. Scope of processing
Zapp shall process Personal Data solely for the purpose of fulfilling its obligations under the Agreement and in accordance with the Customer\u2019s documented instructions.

b. Processing instructions

i. This DPA constitutes the Customer\u2019s initial instructions to Zapp.
The Customer may update or amend these instructions in writing at any time. Zapp shall comply with such instructions unless they conflict with applicable law or fall outside the scope of the Agreement.

ii. Notwithstanding any restrictions set out in this DPA or the Agreement, the Customer authorises Zapp to process Personal Data as necessary to:
\u2013 detect or respond to data security incidents;
\u2013 prevent fraud or other unlawful activity;
\u2013 perform maintenance and repairs; and
\u2013 ensure the continuity and improvement of the Services.

iii. Where new processing activities are required that fall outside the scope of this DPA, the Parties shall agree on such activities in writing before commencement. This may include a contract amendment if required under the Agreement.

iv. Upon the Customer\u2019s written instruction, Zapp shall correct, delete or block the relevant Personal Data.

v. Zapp shall promptly inform the Customer in writing if, in its opinion, any instruction infringes Applicable Data Protection Laws, providing the reasons for its assessment.

vi. Zapp shall not be liable for any losses arising from processing conducted in accordance with the Customer\u2019s lawful instructions.

c. Confidentiality
Zapp shall ensure that all personnel authorised to process Personal Data are bound by appropriate confidentiality obligations, whether contractual or statutory.

d. Disclosure to third parties
Zapp shall not disclose Personal Data to any third party, including public authorities, except:
\u2013 as provided in this DPA;
\u2013 with the prior written consent of the Customer; or
\u2013 where required by applicable law.

Where Zapp is legally obliged to disclose Personal Data to a third party (including public authorities), it shall:
\u2013 notify the Customer in advance, unless legally prohibited from doing so; and
\u2013 take reasonable steps to protect the Personal Data against undue disclosure, as if it were Zapp\u2019s own confidential information.

e. Data subject requests

i. Where the Customer receives a request from a data subject in relation to the processing of their Personal Data (\u201cRequest\u201d), Zapp shall provide all reasonable cooperation and assistance to enable the Customer to respond to the Request.

ii. If Zapp receives a Request directly, it shall:
\u2013 not respond to the Request itself;
\u2013 forward the Request to the Customer within three (3) business days of identifying it as relating to the Customer; and
\u2013 provide assistance in accordance with the Customer\u2019s further instructions.

f. Assistance

i. Zapp shall assist the Customer, to the extent reasonably possible, in complying with Articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to Zapp.

ii. Upon request, Zapp shall assist the Customer in meeting its obligations to conduct data protection impact assessments or prior consultations with supervisory authorities, provided the Customer lacks access to the relevant information and such information is reasonably available to Zapp.

g. Information rights and audit

i. Zapp shall, upon written request, provide the Customer with information necessary to demonstrate compliance with this DPA and Applicable Data Protection Laws.

ii. Zapp maintains third-party certifications and audit reports, as listed at https:\/\/www.zapp.com\/security\/resources\/. Copies of current certifications or audit summaries may be provided to the Customer upon written request, subject to the confidentiality terms of the Agreement.

iii. Zapp shall allow and contribute to reasonable audits or inspections by the Customer or its designated auditor (excluding competitors), with prior written notice and during normal business hours, provided such auditor is bound by appropriate confidentiality obligations.

iv. If the Customer conducts more than one audit or inspection in any twelve (12)-month period, Zapp may charge reasonable fees for the time and resources incurred.

v. If the Customer identifies unauthorised use of Personal Data by Zapp or its Subprocessors, it may take reasonable steps to address the issue upon giving notice to Zapp.

4. Zapp\u2019s obligations as an independent Controller

This section applies solely to Zapp\u2019s processing of certain Personal Data about the Customer or its users where Zapp acts as an independent Controller, as described in Zapp\u2019s Privacy Notice at https:\/\/www.zapp.com\/privacy.

a. Zapp acknowledges and agrees that it is independently responsible for complying with Applicable Data Protection Laws when acting as a Controller, including all obligations applicable to Controllers under such laws.

b. Zapp shall be responsible for providing appropriate privacy notices to Data Subjects where required and for responding to Data Subjects\u2019 requests to exercise their rights under Applicable Data Protection Laws.

c. If Zapp receives a request, complaint, inquiry or other form of contact (\u201cInquiry\u201d) from a government, legislative, judicial, regulatory or law enforcement authority, or becomes subject to a claim relating to the Parties\u2019 processing of Personal Data described in Schedule 1, Zapp shall:
\u2013 notify the Customer without undue delay, and in any event within ten (10) business days, unless legally prohibited from doing so; and
\u2013 provide relevant information and cooperation to the Customer, including information necessary to respond to or defend such Inquiry.

5. Security

a. Zapp shall implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, in accordance with Articles 32 and 33 of the GDPR.

b. Upon becoming aware of any confirmed Personal Data Breach, Zapp shall:
i. notify the Customer without undue delay;
ii. take reasonable steps to identify the cause of the breach and to remediate the breach to the extent within Zapp\u2019s control; and
iii. provide reasonable cooperation and assistance to the Customer in meeting any legal obligations regarding breach notification to Data Protection Authorities or Data Subjects.

6. Amendments and Miscellaneous

a. Amendments for compliance
If amendments to this DPA are necessary to ensure compliance with Applicable Data Protection Laws or to satisfy requirements of competent supervisory authorities, the Parties shall cooperate in good faith to agree on such amendments upon Customer\u2019s request, without additional cost to the Customer.
If the Parties cannot agree on such amendments, either Party may terminate the Agreement and this DPA by providing ninety (90) days\u2019 written notice.

b. Limitation of Liability
The limitation of liability set out in the Agreement shall apply to any breaches of this DPA.

c. No consideration
Neither Party shall receive any remuneration for performing obligations under this DPA, except as expressly provided in this DPA or in the Agreement.

d. Notices
Where written notice is required under this DPA, such notice may be sent by email to the contact persons listed in Schedule 1.

e. Modifications
Zapp may modify this DPA from time to time. Unless otherwise stated, changes shall take effect upon renewal of the then-current Subscription Term or the execution of a new Service Order Form referencing the updated DPA.
Zapp shall use reasonable efforts to notify the Customer of any changes via the Customer Account, email or other appropriate means.

f. Further amendments
Any further amendments to this DPA must be made in writing and signed by both Parties, except as otherwise set forth in the Agreement or this DPA.

g. Severability
If any provision of this DPA is held invalid or unenforceable by a court of competent jurisdiction, the remainder of the DPA shall remain in full force and effect.

ule 1: Description of the Processing

A. List of Parties

Data exporter:
The Customer as described in the Agreement.
Name, address, contact person\u2019s name, position and contact details are as set out in the Agreement or may be requested by either Party.

Activities relevant to the data transferred under these Clauses:
Export of Personal Data in connection with the use of the Processor\u2019s services.

Role:
Controller or Processor, as applicable.

Data importer:
Name: Zapp S.L.
Address: Calle Asturias 4, 28850 Torrej\u00f3n de Ardoz, Madrid, Spain
Contact person: Sandra L\u00f3pez, sandra.lopez@ecaldima.com

Activities relevant to the data transferred under these Clauses:
Processing of Personal Data on behalf of the Customer as Processor.

Role:
Processor

B. Description of Transfer

Categories of Data Subjects:
Data Subjects may include the Customer\u2019s Users, Agents, End Users, prospects, customers, suppliers, business partners, employees, contractors, agents and advisors, all of whom are natural persons.

Categories of Personal Data:
May include, but are not limited to: names, contact information (email, phone, address), unique identifiers (IP address), internet or electronic activity data (browsing history, search history), account information, user data, communications, purchase and transaction history, and any inferences derived from such data.

Sensitive Data (if applicable):
May include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, sex life or sexual orientation.

Frequency of Transfer:
Continuous for the duration of the Agreement.

Nature and Purpose of Processing:
Processing is necessary to provide the Services under the Agreement and as instructed by the Customer.

Retention Period:
Data will be retained for the term of the Agreement and in accordance with the Data Retention Period set forth therein.

Subprocessors:
Further details are provided in Schedule 3.

Schedule 2: Technical and Organisational Measures (TOMs) to Ensure the Security of the Data

Zapp has implemented and maintains appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures are reviewed and updated regularly to ensure ongoing compliance with Applicable Data Protection Laws.

The current description of Zapp\u2019s TOMs is available at:
https:\/\/www.ecaldima.com\/technical-organisational-measures\/

Zapp\u2019s TOMs include, but are not limited to:

Access controls to limit personnel access to Personal Data;

Encryption and pseudonymisation of Personal Data where appropriate;

Physical security measures at data centres and offices;

Regular security awareness training for staff;

Incident detection and response procedures;

Business continuity and disaster recovery plans;

Data minimisation and retention policies;

Regular audits and penetration testing.

Upon Customer\u2019s reasonable request, and subject to confidentiality obligations, Zapp will provide evidence or certification of compliance with these security measures.

Schedule 3: List of Sub-processors

The Customer hereby consents to Zapp engaging the Sub-processors listed below to assist in the provision of the Services.
Zapp shall ensure that each Sub-processor is bound by written contractual terms imposing obligations equivalent to those contained in this DPA.

Zapp will provide the Customer with at least fifteen (15) calendar days\u2019 prior written notice of any planned addition, replacement or removal of Sub-processors.
The Customer may object to such changes by providing written notice to Zapp within the notice period.
In the event of a valid objection, Zapp shall either refrain from engaging the proposed Sub-processor or the Customer may suspend or terminate the affected Services without penalty, subject to payment of any outstanding fees incurred prior to suspension or termination.

Current Sub-processors:
[List to be inserted here or referenced via URL]

For the most current list of Sub-processors, please refer to:
https:\/\/www.zapp.com\/privacy\/sub-processor\/

Schedule 4: Jurisdiction-specific Obligations and Information for International Transfers

A. General Provisions

The Parties agree that for any jurisdiction not explicitly listed below, which requires an International Data Transfer Mechanism, they shall be bound by the Standard Contractual Clauses (\u201cSCCs\u201d) or any other appropriate mechanism as required under Applicable Data Protection Laws.
Should any such mechanism be invalidated or replaced, the Parties commit to cooperate in good faith to adopt a suitable alternative.

The Parties acknowledge that additional technical, organisational and\/or contractual safeguards may be necessary based on the results of any transfer impact assessments.

B. Standard Contractual Clauses

By entering into this DPA, the Parties also enter into and agree to be bound by the Standard Contractual Clauses as annexed and incorporated herein by reference, forming an integral part of the Agreement.

Module Two (Controller to Processor) applies where the Customer is the Controller.

Module Three (Processor to Processor) applies where the Customer is also a Processor.

The Parties acknowledge that for Personal Data transferred from jurisdictions subject to the SCCs, this DPA and its Schedules 1-4 contain relevant information and commitments.

The execution of the Agreement by the Parties is deemed to constitute their execution of the SCCs, even if the SCCs are not separately signed.

C. European Union

For transfers from the European Union that are not subject to an adequacy decision or alternative mechanism (such as the EU-U.S. Data Privacy Framework), the Parties are bound by the SCCs as implemented by the European Commission (Commission Implementing Decision (EU) 2021\/914).
The Parties agree on the following SCC options:

Clause 7 (Docking Clause) \u2013 Optional provision applies;

Clause 9(a) (Use of Sub-processors) \u2013 Option 2 applies (with notice and objection rights);

Clause 11(a) (Redress) \u2013 Optional provision does not apply;

Clause 17 (Governing law) \u2013 Option 1 applies (Spanish law);

Clause 18(b) (Choice of forum and jurisdiction) \u2013 Parties submit to the exclusive jurisdiction of courts in Madrid, Spain.

D. Switzerland

For transfers from Switzerland not covered by an adequacy decision or alternative mechanism, the Parties shall adopt modified SCCs as set forth by Swiss data protection authorities, including adaptations on competent authority and rights of data subjects.

E. United Kingdom

For transfers from the United Kingdom, the Parties incorporate the UK International Data Transfer Agreement (\u201cUK IDTA\u201d), as updated from time to time by the UK Information Commissioner.
The UK IDTA shall be coterminous with this DPA.
Relevant clauses include governing law (England and Wales), jurisdiction (England and Wales), and rights and obligations under the UK GDPR.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Data Processing Addendum Effective Date: 01\/01\/2025 PurposeThis Data Processing Addendum, including its Schedules (\u201cDPA\u201d), is entered into by and between Zapp and the Customer (each a \u201cParty\u201d and together the \u201cParties\u201d).This DPA forms an integral part of the Main Service Agreement, or other applicable written or electronic terms of service between the Parties (\u201cAgreement\u201d).Unless amended […]<\/p>\n","protected":false},"author":5,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"footnotes":""},"class_list":["post-6231","page","type-page","status-publish","hentry"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/ecaldima.com\/en\/wp-json\/wp\/v2\/pages\/6231","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ecaldima.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/ecaldima.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/ecaldima.com\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/ecaldima.com\/en\/wp-json\/wp\/v2\/comments?post=6231"}],"version-history":[{"count":3,"href":"https:\/\/ecaldima.com\/en\/wp-json\/wp\/v2\/pages\/6231\/revisions"}],"predecessor-version":[{"id":6234,"href":"https:\/\/ecaldima.com\/en\/wp-json\/wp\/v2\/pages\/6231\/revisions\/6234"}],"wp:attachment":[{"href":"https:\/\/ecaldima.com\/en\/wp-json\/wp\/v2\/media?parent=6231"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}