Data Privacy & Security Statement

Version 8.3.18

This Data Privacy & Data Security Statement (the “Statement”), is provided by ProcessUnity, Inc. (“ProcessUnity”) to its Customers (each, a “Customer”). This Statement describes ProcessUnity’s commitments with regard to data privacy and data security.   ProcessUnity may update this Statement from time to time. Updated versions will be published on ProcessUnity’s website.

1. DEFINITIONS

“Authorized Persons”means ProcessUnity’s employees, agents, and contractors that have a need to know or otherwise access User Data to enable ProcessUnity to provide the Services.

“Controller”means a controller as defined under the GDPR.

“Data Protection Laws”means all international, federal, national and state privacy and data protection laws and regulations to the extent applicable to ProcessUnity and the Services.  The Data Protection Laws include GDPR, to the extent applicable to ProcessUnity.

“Data Security Incident”means any accidental, unauthorized or unlawful access, acquisition, theft, destruction, or disclosure of User Data that occurs while such User Data is in the possession of or under the control of ProcessUnity.

“GDPR”means the EU General Data Protection Regulation 2016/679.

“Personal Data”means information relating to an identified or identifiable natural person.  An identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Process”or “Processing”means any operation or set of operations that are performed upon User Data, whether or not by automatic means, such as collection, accessing, processing, use, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure, dissemination, transmittal, alignment or combination, blocking, erasure, destruction or otherwise used as set out in the applicable Data Protection Laws.

“Processor” means a processor as defined under the GDPR.

“Services”means ProcessUnity’s cloud-based governance, risk and compliance solutions.

“Sub-Processor”shall mean an entity engaged by ProcessUnity to assist it in Processing the User Data in fulfillment of its obligations with regard to the Services.

“User Data”means all data relating to a ProcessUnity Customer or its authorized users (“Users”) that is provided to ProcessUnity by a Customer or that is otherwise obtained or accessed by ProcessUnity in connection with the Services.  User Data may include Personal Data.

“Third Party”is any person or entity other than ProcessUnity and Customer and Customer’s Users.

2. DATA PRIVACY

2.1 Compliance with Laws.ProcessUnity is committed to complying with its obligations under all Data Protection Laws that are applicable to ProcessUnity and the Services.

2.2 Distribution of User Data.Customers and Users should provide ProcessUnity only with Personal Data that is requested by ProcessUnity or that is otherwise necessary for ProcessUnity to provide the Services.  ProcessUnity is not responsible for any other Personal Data.

2.3 Limitations on Use of Personal Data. ProcessUnity will not Process User Data other than for the purpose of providing the Services or as otherwise specified by Users. ProcessUnity will not Process User Data for the benefit of any Third Party. ProcessUnity will access only the User Data that it needs to perform the Services (i.e., no more than necessary). ProcessUnity will not store User Data longer than necessary to achieve the permitted purposes specified by User.

2.4  Restrictions.Except with a User’s prior, written approval, on a case-by-case basis, ProcessUnity will not: (a) use User Data other than as necessary for ProcessUnity to provide the Services, (b) disclose, sell, assign, lease or otherwise provide User Data to Third Parties (other than to its affiliates or Sub-Processors) except to the extent required or permitted by Data Protection Laws, or (c) merge User Data with other data, modify or commercially exploit any User Data.

2.5  Sensitive Personal Data. Customers and Users are advised never to provide ProcessUnity with Sensitive Personal Data.  “Sensitive Personal Data” means (a) information that reveals a natural person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, (b) information or data concerning a natural person’s health or sex life or sexual orientation; or (c) genetic data or biometric data about a natural person.

3. SUB-PROCESSORS

ProcessUnity may engage Sub-Processors in connection with the provision of the Services, provided, however, that ProcessUnity will not provide a Sub-Processor with access to User Data unless the Sub-Processor has: (i) a business need to know / access the relevant User Data, as necessary for the purposes of the Services;(ii) signed a written obligation of confidentiality or are under professional obligations of confidentiality; and (iii) implemented technical, operational, physical, and organization safeguards to protect User Data against accidental or unlawful destruction or alteration and unauthorized disclosure or access.

4. DATA SUBJECT RIGHTS AND COOPERATION

ProcessUnity will use commercially reasonable efforts to cooperate and assist with a User’s exercise of his/her rights under applicable Data Protection Laws with respect to Personal Data Processed by ProcessUnity, including, without limitation, the right to be forgotten, the right to data portability, and the right to access data under the GDPR.

5. RETURN OR DESTRUCTION OF USER DATA

Upon the written request of a User, ProcessUnity will return User Data to a User or securely delete User Data as soon as reasonably practicable. However, if ProcessUnity is required by law to retain User Data or if User Data is stored in a manner such that it cannot readily be returned or destroyed without affecting other data, then ProcessUnity will continue to protect such User Data in accordance with this Statement and limit any use to the purposes of such retention.

6. DATA SECURITY

6.1  Security Program Requirements. ProcessUnity will maintain a security program that contains administrative, technical, and physical safeguards appropriate to the complexity, nature, and scope of its activities. ProcessUnity’s security program shall be designed to protect the security and confidentiality of User Data against unlawful or accidental access to, or unauthorized processing, disclosure, destruction, damage or loss of User Data.  At a minimum, ProcessUnity’s security program shall include: (a) limiting access of User Data to Authorized Persons; (b) implementing network, application, database, and platform security; (c)means for securing information transmission, storage, and disposal within ProcessUnity’s possession or control; (d) means for encrypting User Data stored on media within ProcessUnity’s possession or control by using modern acceptable cyphers and key lengths, including backup media; (e)means for encrypting User Data transmitted by ProcessUnity over public or wireless networks by using modern acceptable cyphers and key lengths; and(f) means for keeping firewalls, routers, servers, personal computers, and all other resources current with appropriate security-specific system patches.

6.2  Regular Reviews.ProcessUnity will ensure that its security measures are regularly reviewed and revised to address evolving threats and vulnerabilities.

7. DATA SECURITY INCIDENT PROCEDURES

7.1 Notification.ProcessUnity shall notify Customer as promptly as reasonably feasible, but in any event within forty-eight (48) hours of becoming aware of a Data Security Incident.  ProcessUnity shall provide Customer with a detailed description of the Data Security Incident, the type of data that was the subject of the Data Security incident and, to the extent known to ProcessUnity, the identity of each affected person, as soon as this information can be collected or otherwise becomes available, as well as all other information and cooperation that Customer may reasonably request relating to the Data Security Incident.

7.2 Mitigation.ProcessUnity agrees to take action immediately, at its own expense, to investigate the Data Security Incident and to identify, prevent, and mitigate the effects of the Data Security Incident and, with Customer’s prior agreement, to carry out any recovery or other action necessary to remedy the Data Security Incident.  ProcessUnity will inform Customer of the steps it is taking to mitigate the effects of the Data Security Incident and to minimize the chances of another Data Security Incident happening again.

7.3 Publicity.ProcessUnity will not issue, publish or make available to any third party any press release or other communication concerning the Data Security Incident without Customer’s prior written approval or request.

7.4  Cooperation.ProcessUnity shall provide full cooperation and assistance to Customer to enable Customer to fulfill its obligations to enable Data Subjects affected by the Data Security Incident to exercise their rights under the Data Protection Laws. ProcessUnity will notify Customer within three (3) business days of all communications Customer receives from an affected Data Subject seeking to exercise his/her right in connection with the Data Security Incident.

8. CROSS-BORDER TRANSFERS

8.1  Location.ProcessUnity systems and ProcessUnity’s Processing of User Data will occur within the following jurisdictions: United States of America and Ireland (the “Processing Jurisdictions”).  ProcessUnity will not transfer any User Data outside of the Processing Jurisdictions without the prior written agreement of Customer and Users.

8.2 Sub-Processors. Before providing User Data of a European citizen to Sub-Processors, ProcessUnity will use commercially reasonable efforts to ensure that the Sub-Processors will either be certified under the EU-US Privacy Shield or that the Sub-Processors execute EU-prescribed Standard Contractual Clauses.

9. AUDITS REPORTS

If ProcessUnity engages a third party auditor to perform a Statement on Standards for Attestation Engagements No. 16 (SSAE 16) or other data security audit of ProcessUnity’s operations, information security program or disaster recovery/business continuity plan, ProcessUnity shall provide a copy of the audit report to Customer or User within a reasonable period of time after receipt of a request from Customer or the User for such a report. Any such audit reports shall be ProcessUnity’s confidential information.