DATA PROCESSING AGREEMENT

THIS DATA PROCESSING AGREEMENT (“DPA”), including Exhibits A and B, is made a part of the Agreement (defined below) between Customer (“Customer,” “You,” or “Your”) and Doitb LLC (defined below, “Doitb” “We”, “Us,” or “Our”). Doitb and Customer may each be referred to in this DPA as a “Party” or together as the “Parties.”

RECITALS

WHEREAS, your contractual counterparty for the purposes of this DPA will be the Doitb entity with whom You have contracted for Company’s Products;

WHEREAS, Company’s provisioning of its Products to Customer may involve cross-border Transfers;

WHEREAS, ‘On-premises’ Doitb Products are configured by the Customer and any transmission to the Doitb of Customer’s Personal Data is determined solely by the Customer; and

WHEREAS, Doitb does not voluntarily permit any governmental agencies or public authorities access to Company’s infrastructure.

DEFINITIONS

“Agreement” means the agreement between Customer and Doitb for the provision of Products and/or Services to Customer, including (but not limited to) the End User License Agreement (“EULA”), cloud terms of service agreement, professional services terms, technical support and maintenance service terms, or any other agreement between Customer and Doitb, each of which shall be deemed to incorporate this DPA.

“Products”, “Services” means the Doitb’s commercially available products and services provided to the Customer by Doitb or through one of the Doitb’s authorized channel partners.

“Controller”, “Processor” and “Data subject” shall have the meaning ascribed to such terms per the General Data Protection Regulations.

“Personal Data” or “Personal Information” means Personal Data, in the meaning that is ascriped to it by art. 4 (1) GDPR, which the Customer uploads or otherwise provides Doitb in connection with his use of Doitb’s services. Personal Data does not include any Personal Data or Personal Information that Doitb collects, stores or processes independently from the performance of this DPA.

“Data Protection Requirements” means the General Data Protection Regulation, and any applicable laws, regulations, and other legal requirements relating to (a) privacy, data security, and protection of Personal Data; and (b) the Processing of any Personal Data. Data Protection Requirements may include, but are not limited to, UK GDPR, the Swiss Federal Act on Data Protection 2020.

“General Data Protection Regulation” or “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council together with any subordinate legislation or regulation implementing the General Data Protection Regulation.

“UK GDPR” means the UK General Data Protection Regulation, amended by the Data Protection Act 2018.

“Personal Data Breach” means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

“Processing” and its cognates mean any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“SCCs” means the European Commission Standard Contractual Clauses adopted by the European Commission, which are incorporated by the parties into this DPA. The term “SCCs" cover both the chosen general standard contractual clauses adopted upon Commission Implementing Decision (EU) 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors under Article 28(7) of GDPR and the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to GDPR.

“Subprocessor” means any entity which provides processing services to Doitb in furtherance of Doitb’s processing of Personal Data. The list of agreed subprocessors is indicated in Exhibit A.

“Supervisory Authority” means an independent public authority which is (i) established by a European Union member state pursuant to Article 51 of the General Data Protection Regulation; or (ii) the public authority governing data protection, which has supervisory authority and jurisdiction over Data subject.

“Security Incident” means any confirmed breach of security that leads to a breach of Personal data processed by Doitb under this DPA in connection with provision of the Products/Services. For the avoidance of doubt, "Security Incident" does not include unsuccessful attempts or activities that do not compromise the security of personal data, including unsuccessful login attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.

1. PURPOSE AND SCOPE

a. With respect to any Personal Data processed under the Agreement and in accordance with the Annex I to SCCs: You shall be “Controller” and We shall be “Processor” as provided for by EXHIBIT A. Controller and Processor have agreed to this DPA in order to ensure compliance with Article 28(3) and (4) of GDPR.

b. Doitb Process Personal Data (i) only for the purpose of providing, supporting and improving services (including to provide insights and other reporting), using appropriate technical and organizational security measures; and (ii) only on documented instructions received from Customer. Customer hereby instructs Doitb to Process Personal Data for the aforementioned purposes, including Transfers of Personal Data to any country in connection with carrying out activity in such purposes. We will not Process Personal Data for any other purpose, and We will not sell Personal Data as the term “sell” is defined under Data Protection Requirements.

c. Processing shall be done in accordance with Your documented instructions, which are finally and completely reflected under this DPA. Unless prohibited by Data Protection Requirements, we will inform You if (a) Your instructions conflict with Data Protection Requirements, or (b) Data Protection Requirements require Processing contrary to Your instructions.

d. The subject-matter and duration of the Processing, the nature of the Processing, the type of Personal Data and categories of Data Subjects are set out in Exhibit A of this DPA.

e. You are responsible for ensuring You have a valid legal basis for the Processing contemplated hereunder, and that any required Data Subject consent is duly provided and documented, and You represent and warrant that You have complied with all Data Protection Requirements in collecting, providing, and/or making Personal Data available to Us such that We are entitled to Process Personal Data in accordance with the Agreement and this DPA. You agree to hold Us harmless and indemnify Us for any damages suffered due to the Processing of Personal Data in accordance with Your instructions.

f. In accordance with Data Protection Requirements, We shall implement technical and organizational measures intended to provide a level of security appropriate to the risks presented by the Processing of Personal Data, consisting of the technical and organizational measures set out in Exhibit B. These measures are intended to help protect Personal Data against (a) unauthorized or accidental access or disclosure, and (b) unauthorized or accidental loss or destruction.

g. Doitb confirms that its employees, authorized agents and any Subprocessors are required to comply with and acknowledge and respect the confidentiality of the Personal Data, including after the end of their respective employment, contract or assignment.

2. REQUESTS TO ACCESS PERSONAL DATA AND REQUESTS FROM SUPERVISORY AUTHORITIES

a. If a Data Subject makes a request to Us for access, correction/rectification, deletion/erasure, portability, objection, or any other purported right relating to Personal Data for which We can identify You as the Controller/Data exporter, We will refuse the request, provide the Data Subject with Your contact information, and instruct the Data Subject to direct the request to You.

b. If compelled to disclose Personal Data for which You are the Controller due to a request by a law enforcement agency or other third-party, We will give You notice of such request before granting access and/or providing Personal Data, to allow You to seek a protective order or another appropriate remedy. If We are legally prohibited from providing You a notification, We will take measures to protect Personal Data from undue disclosure, as if it were Our own Confidential Information being requested.

c. Customer agrees to, at Our request, designate to Us a single point of contact (the “DPO or personal data manager”) responsible for (i) receiving and responding to data subject requests Doitb receives from Customer data subjects relating to Personal Data; and (ii) notifying Doitb of Customer’s intended response to a data subject request relating to the access to or the rectification, erasure, restriction, portability, blocking or deletion of Personal Data that Doitb processes for Customer, and authorizing Doitb to fulfill such responses on behalf of Customer.

3. DATA TRANSFERS

a. Customer agrees that Doitb may transfer Personal Data processed under this DPA outside the European Economic Area (the “EEA”), the UK, or Switzerland as necessary to provide the Services. Customer acknowledges that Doitb’s primary processing operations take place in the United States, and that the transfer of Personal Data to the United States is necessary for the provision of the Services to Customer. Doitb may also transfer Personal Data to other jurisdictions on documented instructions from You if reasonably necessary for the provision of the Services, including wherever Doitb maintains facilities.

b. To the extent Customer (as a data exporter) transfers to Doitb (as to a data importer) any Personal Data that is subject to Data Protection Regulations, and the transfer is to a country that is deemed to not provide an adequate level of protection, Customer and Doitb agree to incorporate Standard Contractual Clauses (Module 2). For the application of the said SCCs the Parties have agreed on the Annex I to this DPA, within which the Customer is referred to as a "Data exporter” and Doitb is referred to as a “Data importer”.
Parties agree that any dispute arising from the this DPA (except for the disputes related to the application of Module 2 of SCCs) shall be resolved by Arbitration Court attached to the Czech Chamber of Commerce and the Agricultural Chamber of the Czech Republic by a single arbitrator appointed by the President of the Arbitration Court in accordance with the Online Rules of the Arbitration Court).

c. The choices made by the Parties on the options available within Module 2 of SCCs may implicitly follow from the provisions of this DPA. Should any provision of this DPA contradict with the SCCs incorporated, the relevant SCC provision shall prevail.
Parties agree that the application of the said SSCs shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the law of the Netherlands.
Parties agree that any dispute related to the application of Module 2 of SCCs shall be resolved by the courts of the Netherlands.

d. Doitb shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.

4. SUBPROCESSORS

a. The Parties agree to apply a general written authorization option provided by Clause 7.7 of SCCs. Accordingly, You hereby grant Us a general authorization to appoint Subprocessors listed in EXHIBIT A.

b. Whether the Sub-processor is a Company Affiliate or a third-party, We will: a. restrict Sub-processors' access to Personal Data only to what is necessary to maintain or provide the Products and Services to You; b. impose substantially similar appropriate contractual obligations in writing upon Subprocessors that are no less protective than the obligations set forth in this DPA; and c. remain responsible for Sub-processors’ compliance with and performance of the obligations of this DPA.

c. Doitb shall specifically inform in writing the Customer of any intended changes of the list of subprocessors set in EXHIBIT A through the addition or replacement of sub-processors at least 14 (fourteen) calendar days in advance, thereby giving the Customer sufficient time to be able to object to such changes prior to the engagement of the concerned sub-processor(s). Doitb shall provide the Customer with the information necessary to enable the Customer to exercise the right to object.

5. PRIVACY VIOLATIONS, SECURITY AND DATA BREACH INCIDENTS

a. Doitb and, to the extent required under the DPA, Customer must implement appropriate technical and organizational measures in accordance with Data Protection Requirements (e.g., Art. 32 GDPR) to protect Personal Data from Security Incidents and to preserve the security and confidentiality of the Personal Data. Doitb’s current technical and organizational measures are described in Exhibit B (“Security Measures”). Customer acknowledges that the Security Measures are subject to technical progress and development and that Doitb may update or modify the Security Measures from time to time, provided that such updates and modifications do not degrade or diminish the overall security of the Services.

b. Taking into account the nature of the processing, Doitb must provide reasonable and timely assistance to Customer (at Customer’s expense) to enable Customer to respond to: (i) any request from a data subject to exercise any of its rights under Data Protection Requirements (including its rights of access, to rectification, to erasure, to restriction, to objection, and data portability, as applicable); and (ii) any other correspondence, enquiry or complaint received from a data subject, regulator or other third party, in each case in respect of Personal Data that Doitb processes on Customer’s behalf; (b) In the event that any request, correspondence, enquiry or complaint (referred to under paragraph (a) above) is made directly to Doitb, Doitb acting as a processor will not respond to such communication directly without Customer’s prior authorization, unless legally required to do so, and instead, after being notified by Doitb, Customer may respond. If Doitb is legally required to respond to such a request, Doitb will promptly notify Customer and provide it with a copy of the request unless legally prohibited from doing so; and (c) To the extent Doitb is required under Data Protection Requirements, Doitb will (at Customer’s request and expense) provide reasonably requested information regarding the Services to enable the Customer to carry out data protection impact assessments or prior consultations with data protection authorities, taking into account the nature of processing and the information available to Doitb.

c. Upon becoming aware of a Security Incident, Doitb will inform Customer without undue delay and provide timely information (taking into account the nature of processing and the information available to Doitb) relating to the security Incident as it becomes known or as is reasonably requested by Customer to allow Customer to fulfill its data breach reporting obligations under Data Protection Requirements. Doitb will further take reasonable steps to contain, investigate, and mitigate the effects of the Security Incident. Doitb’s notification of or response to a Security Incident will not be construed as an acknowledgment by Doitb of any fault or liability with respect to the Security Incident.

d. Upon written request from Customer, Doitb and Doitb’s Subprocessors will delete or return to Customer all Personal Data (including copies) processed on behalf of the Customer in compliance with the procedures and retention periods outlined in the DPA; this requirement does not apply to the extent Doitb is required by Data Protection Requirements to retain some or all of the Personal Data.

6. AUDIT

a. Subject to relevant confidentiality obligations, Doitb agree, upon Your request and up to once per year, to:

i. provide copies of documentation designed to enable You to verify Our compliance with the technical and organizational measures set forth in Exhibit A to this DPA; and

ii. provide written responses, on a confidential basis, to reasonable requests for information made by You, including responses to information security and audit questionnaires, which are reasonably required to confirm Our compliance with this DPA and the Data Protection Requirements.

iii. In addition to the foregoing, solely to the extent required by Data Protection Requirements or a binding request by a regulatory body, You may perform an audit of the Products and Services that Process Personal Data. If a third-party is to conduct the audit, the third-party must not be a competitor to Doitb, and such third-party is subject to our prior assent, and must execute a written confidentiality agreement with the Parties before conducting the audit.

iv. To request an audit, You must submit a detailed audit plan at least two (2) months in advance of the proposed audit date to Doitb, which plan describes the proposed scope, duration, and start date of the audit. We will review the audit plan and provide You with any concerns or questions (for example, any request for information that could compromise the Company’s security, privacy, employment, or other relevant policies; or any concerns or questions about the proposed third-party auditor). Both Parties will work cooperatively in good faith to agree on a final audit plan. If the requested audit scope is addressed in a similar audit report within the prior twelve months and We confirm there are no material changes in the controls audited, You agree to accept those findings in lieu of requesting an audit of the controls covered by the report.

v. The audit must be conducted during regular business hours at the applicable facility and may not interfere with business activities or with Our confidentiality obligations to other customers.

vi. You will provide Us with any audit reports generated in connection with any audit under this section, unless prohibited by Data Protection Requirements. You may use the audit reports only for the purposes of meeting the requirement of Data Protection Requirements and/or the binding request by a regulatory body that gave rise to the audit. The audit reports and any other materials, documents, communications, and/or information relating to the audit are Confidential Information of the Parties under the terms of the Agreement.

vii. Any audits are at Your expense. Any request for Us to provide assistance with an audit is considered a separate service if such audit assistance requires the use of resources different from, or in addition to, those required for the provision of the Products and Services. We will seek Your written approval to pay any applicable fees before performing such audit assistance.

7. MISCELLANEOUS

a. Notwithstanding anything to the contrary, the Parties acknowledge that the Data Protection Requirements are not intended to jeopardize or undermine the confidentiality obligations to which the Parties are subject to in the Agreement or an agreed upon written non-disclosure agreement.

b. This DPA shall be deemed duly signed electronically by the Parties due to their explicit actions: entrance to the Agreement and provision/use of the Products/Services on the date when such actions take place. This DPA shall remain effective as long such Agreement remains in full force and effect. Any terms of this DPA which by their nature should survive termination of this DPA shall survive such termination.

c. In the event of inconsistencies between the provisions of this DPA and the Agreement, the provisions of this DPA shall prevail regarding the Parties' data protection obligations relating to Personal Data. In cases of doubt, this DPA shall prevail where it cannot be clearly established whether a clause relates to a Party's data protection obligations.

d. Should any provision or condition of this DPA be held or declared invalid, unlawful, or unenforceable by a competent authority or court, then the remainder of this DPA shall remain valid.

e. Instructions, notices and other communications made under this DPA shall be made in accordance with the provisions of the Agreement.

f. Any amendments to this DPA shall be in writing duly signed by authorized representatives of the Parties.

EXHIBIT A

Controller/Data exporter. Under this DPA, You, meaning the Customer, as described in the Definitions section of this DPA, is considered to be a Controller/Data exporter for the purposes of the application of SCCs referred to explicitly in this DPA. Name and Address of the Controller/Data exporter shall be the same as provided by You along with entering the Agreement. The name and position of the contact person on the Data exporter’s side shall be provided by the Customer in accordance with the p. (c) of Section 2 of this DPA.

Processor/Data importer. Under this DPA, We, meaning Doitb LLC, having our registered address at Ste 1200, 1309 Coffeen Avenue, Sheridan, WY, Sheridan, US, 82801, are considered to be Processor/Data importer for the purposes of the application of SCCs referred to explicitly in this DPA. Name and title of a contact person on the Processor’s side shall be provided by Doitb to the Customer along with the start of delivering of the Products/Services pursuant to the Agreement.

Subject Matter, Nature, and Duration of the Processing/Data transfer. The nature and subject matter of the Processing/Data transfer are set forth in the Agreement. The Processing will continue for so long as the Agreement remains in effect between the Parties.

Purposes for which Personal Data is Processed. See Section 1 of this DPA.

Purposes for which Personal Data is transferred. See Section 1 of this DPA.

Categories of Data Subjects whose Personal Data is Processed/Transferred. Customer’s end users of Products, including Customer’s employees, contractors, contingent workers, business partners, vendors and any other end users that receive access to the Products and Services through Customer.

Categories of Personal Data Processed/Transferred

  • IP address
  • Browser type
  • Jira authentication token
  • calendar data fields
  • calendar event data fields
  • Any other Personal Data submitted by, sent to, or received by employees, contractors, and agents of Customer through the Services, including but not limited to:
    • Jira issue and user information (only identifiers are stored)

Our Subprocessors

The most up-to-date list of Subprocessors is available at https://doitb.com/subprocessors and forms part of this DPA

Competent supervisory authority. The data protection supervisory authority of the EU Member State where the Customer is established shall be the competent supervisory authority for the purposes of the application of Module 2 of SCCs. Should the Customer be established outside the EU, the competent supervisory authority shall be The supervisory authority of the relevant Member State in which the data subject whose personal data is at issue is located.

EXHIBIT B

Access control to premises and facilities

Data centers are located in nondescript buildings that are physically constructed, managed, and monitored 24 hours a day to protect data and services from unauthorized access as well as environmental threats. All data centers are surrounded by a fence with access restricted through badge controlled gates. CCTV is used to monitor physical access to data centers and the information systems. Cameras are positioned to monitor perimeter doors, facility entrances and exits, interior aisles, caged areas, high-security areas, shipping and receiving, facility external areas such as parking lots and other areas of the facilities.

Access control to systems

Measures must be taken to prevent unauthorized access to IT systems. The following technical and organizational measures for user identification and authentication must include:

  • Password policy implemented
  • No access for guest users or anonymous access
  • Central management of system access
  • Access to IT systems subject to approval from HR management and IT system owner

Access control to data

Measures must be taken to prevent authorized users from accessing data beyond their authorized access rights and the unauthorized modification or disclosure data. These measures shall include:

  • Differentiated access rights
  • Access rights defined according to duties
  • Automated log of user access to IT systems
  • Number of administrators kept to the minimum necessary
  • Measures to prevent the use of automated data-processing systems by unauthorized persons using data communication equipment (incl. encryption data “in-transit”, “at rest”, encrypted backups, private networks, network segregation, networking rules, privileged access management)
  • Confidential or highly confidential paper documents are locked away securely or disposed of properly

Input control

Measures must be put in place to ensure all data management and maintenance is logged, and audit trail of whether data have been entered, changed or removed and by whom must be maintained.

Disclosure control

In order to prevent unauthorized access, alteration, or removal of data during transfer, and to ensure that all transfers are secure and are logged. These measures must include:

  • Encryption using a VPN for remote access, transport and communication data
  • The electronic transfer of data and transmission of personal data is carried out with state-of-the-art encryption methods
  • Transmission of data in anonymized or pseudonymized form
  • Logging of access and retrieval

Separate processing control

Data collected for different purposes shall be processed separately. Different customers' data shall not be processed together. These measures shall include:

  • Separation between server operation and application development
  • Control via user permissions model
  • Specification of database rights

Pseudonymization

Where personal data is pseudonymized, it is processed in such a way that no data may be matched to a specific data subject without additional information. Where pseudonymization is used, additional information for attributing the personal data to a specific data subject is kept separately in separate and secure systems. There is an internal requirement to anonymize/pseudonymize personal data as far as possible where the data is to be transmitted or the statutory time limit for deletion of data expires.

Availability control

Measures should be put in place to ensure that data are protected against accidental destruction or loss. These measures must include:

  • Ensuring that installed systems may, in case of interruption, be restored
  • Ensuring systems are functioning, and that faults are reported
  • Ensure stored personal data cannot be corrupted by means of a malfunctioning of the system
  • Remote storage
  • An emergency plan is in place, including backup processes and decentralized data storage. There are defined availability periods
  • Backups are regularly available as agreed; a backup and recovery plan are in place
  • Monitoring of the backup process
  • Business continuity procedures

Risk Management

Doitb will assess risks related to processing of Personal Data and create an action plan to mitigate identified risks.

Human Resources Security

Doitb informs its personnel about relevant security procedures and their respective roles. Doitb also informs its personnel of possible consequences of breaching the security rules and procedures. Doitb will only use anonymous data in training.

Workstation protection

Doitb will implement protections on end-user devices and monitor those devices to be in compliance with the security standard requiring hard drive passwords, screen saver, antivirus software, firewall software, unauthenticated file sharing, hard disk encryption and appropriate patch levels. Controls are implemented to detect and remediate workstation compliance deviations.

Doitb will securely sanitize physical media intended for reuse prior to such reuse and will destroy physical media not intended for reuse.

Information Security Incident Management

Doitb will maintain an incident response plan and follow documented incident response policies including data breach notification to Data Controller without undue delay where a breach is known or reasonably suspected to affect Personal Data.