Legal
Website Terms and Conditions
Last Updated: April 25, 2024
Acceptance of the Terms and Conditions. Datavolo, Inc. (herein referred to as “Datavolo,” “we,” “us” or “our”) provides and makes available this web site (the “Site”). All use of the Site is subject to the terms and conditions contained in these Website Terms and Conditions (this “Agreement”). Please read this Agreement carefully. By accessing, browsing or otherwise using the Site, you acknowledge that you have read, understood, and agree to be bound by this Agreement. If you do not accept the terms and conditions of this Agreement, you shall not access, browse or use the Site. You understand and agree that your use of our products and services (“Datavolo Products”) shall not be governed by this Agreement, but rather by your company’s or organization’s agreement with Datavolo covering such Datavolo Products. However, please note that your access to and use of the Site and any Datavolo Products is also subject to Datavolo’s Privacy Policy located at https://datavolo.io/privacy.
You understand and agree that we may change this Agreement at any time without prior notice. You may read a current, effective copy of this Agreement at any time by selecting the “Terms of Use” link on the Site. The revised terms and conditions will become effective at the time of posting. Any use of the Site after such date shall constitute your acceptance of such revised terms and conditions. If any change to this Agreement is not acceptable to you, your sole remedy is to cease accessing, browsing and otherwise using the Site.
Use of the Site. This Site contains material, including but not limited to software, text, graphics and images (collectively referred to as the “Content”). We may own the Content or portions of the Content may be made available to us through arrangements that we have with third-parties. The Content is protected by United States and foreign intellectual property laws. Unauthorized use of the Content may result in violation of copyright, trademark, and other laws. You have no rights in or to the Content, and you will not copy the Content and will only access and use the Content for your personal purposes. You may not sell, transfer, assign, license, sublicense, or modify the Content or reproduce, display, publicly perform, make a derivative version of, distribute, or otherwise use the Content in any way for any public or commercial purpose. The use or posting of any of the Content on any other web site or computer network for any purpose is expressly prohibited. If you violate any part of this Agreement, your right to access and/or use the Content and Site shall automatically terminate.
The trademarks, service marks, and logos of Datavolo (the “Datavolo Trademarks”) used and displayed on this Site are registered and unregistered trademarks or service marks of Datavolo. Other company, product, and service names located on the Site may be trademarks or service marks owned by third-parties (the “Third-Party Trademarks”, and, collectively with the Datavolo Trademarks, the “Trademarks”). Nothing on this Site or in this Agreement should be construed as granting, by implication, estoppel, or otherwise, any license or right to use any Trademark displayed on this Site without the prior written consent of Datavolo specific for each such use. The Trademarks may not be used to disparage Datavolo or the applicable third-party, Datavolo’s or third-party’s products or services, or in any manner (using commercially reasonable judgment) that may damage any goodwill in the Trademarks. Use of any Trademarks as part of a link to or from any website is prohibited without Datavolo’s prior written consent. All goodwill generated from the use of any Datavolo Trademark shall inure to Datavolo’s benefit.
You agree not to: (a) take any action that imposes an unreasonable load on the Site’s infrastructure, (b) use any device, software or routine to interfere or attempt to interfere with the proper working of the Site or any activity being conducted on the Site, (c) attempt to decipher, decompile, disassemble or reverse engineer any of the software comprising or making up the Site, (d) delete or alter any material posted on the Site by Datavolo or any other person or entity, or (e) frame or link to any of the materials or information available on the Site.
The Site contains links to third-party web sites (“External Sites”). These links are provided solely as a convenience to you and not as an endorsement by us of the content on such External Sites. The content of such External Sites is developed and provided by others. You should contact a representative of those External Sites if you have any concerns regarding such links or any content located on such External Sites.
We are not responsible for the content of any linked External Sites and do not make any representations regarding the content or accuracy of any materials on such External Sites. You should take precautions when downloading files from all web sites to protect your computer from viruses and other destructive programs. If you decide to access any External Sites, you do so at your own risk.
Certain elements of the Site are protected by trade dress, trademark, unfair competition, and other state and federal laws and may not be copied or imitated in whole or in part, by any means, including but not limited to, the use of framing or mirrors, except as otherwise expressly permitted by Section 2.1 of the Agreement. None of the Content for this Site may be retransmitted without the express written consent from Datavolo for each and every instance.
You may from time to time provide suggestions, comments for enhancements or functionality or other feedback (“Feedback”) to us with respect to the Site or Content. We shall have full discretion to determine whether or not to proceed with the development or implementation of any Feedback. You hereby grants Datavolo a royalty-free, fully paid up, worldwide, transferable, sublicensable, irrevocable, perpetual license to (a) copy, distribute, transmit, display, perform, and create derivative works of the Feedback; and (b) use the Feedback and/or any subject matter thereof, including without limitation, the right to develop, manufacture, have manufactured, market, promote, sell, have sold, offer for sale, have offered for sale, import, have imported, rent, provide and/or lease products or services which practice or embody, or are configured for use in practicing, the Feedback and/or any subject matter of the Feedback.
Limitation of Liability and Disclaimer of Warranties. DATAVOLO, ITS AFFILIATES, THEIR RESPECTIVE OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, SUPPLIERS, OR LICENSORS (COLLECTIVELY, THE “DATAVOLO PARTIES“) MAKE NO WARRANTIES OR REPRESENTATIONS ABOUT THE SITE OR CONTENT, INCLUDING BUT NOT LIMITED TO ITS ACCURACY, RELIABILITY, COMPLETENESS, TIMELINESS OR RELIABILITY. THE DATAVOLO PARTIES SHALL NOT BE SUBJECT TO LIABILITY FOR THE TRUTH, ACCURACY OR COMPLETENESS OF THE SITE OR CONTENT OR ANY OTHER INFORMATION CONVEYED TO THE USER OR FOR ERRORS, MISTAKES OR OMISSIONS THEREIN OR FOR ANY DELAYS OR INTERRUPTIONS OF THE DATA OR INFORMATION STREAM FROM WHATEVER CAUSE. YOU AGREE THAT YOU USE THE SITE AND THE CONTENT AT YOUR OWN RISK.
THE DATAVOLO PARTIES DO NOT WARRANT THAT THE SITE WILL OPERATE ERRORFREE OR THAT THE SITE, ITS SERVER, OR THE CONTENT ARE FREE OF COMPUTER VIRUSES OR SIMILAR CONTAMINATION OR DESTRUCTIVE FEATURES. IF YOUR USE OF THE SITE OR THE CONTENT RESULTS IN THE NEED FOR SERVICING OR REPLACING EQUIPMENT OR DATA, NO DATAVOLO PARTY SHALL BE RESPONSIBLE FOR THOSE COSTS.
THE SITE AND CONTENT ARE PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS WITHOUT ANY WARRANTIES OF ANY KIND. THE DATAVOLO PARTIES DISCLAIM ALL WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE WARRANTIES OF TITLE, MERCHANTABILITY, NONINFRINGEMENT OF THIRD PARTIES RIGHTS, AND FITNESS FOR PARTICULAR PURPOSE.
IN NO EVENT SHALL ANY DATAVOLO PARTY BE LIABLE FOR ANY DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, INCIDENTAL AND CONSEQUENTIAL DAMAGES, LOST PROFITS, OR DAMAGES RESULTING FROM LOST DATA OR BUSINESS INTERRUPTION) RESULTING FROM THE USE OR INABILITY TO USE THE SITE AND THE CONTENT, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), OR ANY OTHER LEGAL THEORY, EVEN IF SUCH DATAVOLO PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
SOME STATES DO NOT ALLOW THE DISCLAIMER OR EXCLUSION OF CERTAIN WARRANTIES OR THE LIMITATION OR EXCLUSION OF LIABILITY FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES. ACCORDINGLY, IN SUCH STATES, SOME OF THE ABOVE LIMITATIONS MAY NOT APPLY TO YOU OR BE ENFORCEABLE WITH RESPECT TO YOU, AND THE LIABILITY OF THE DATAVOLO PARTIES SHALL BE LIMITED TO THE GREATEST EXTENT PERMITTED BY LAW.
IF YOU ARE FROM NEW JERSEY, THE FOREGOING SECTIONS 3.1 AND 3.2 AND SECTION 4 BELOW ARE INTENDED TO BE ONLY AS BROAD AS IS PERMITTED UNDER THE LAWS OF THE STATE OF NEW JERSEY. IF ANY PORTION OF THESE SECTIONS IS HELD TO BE INVALID UNDER THE LAWS OF THE STATE OF NEW JERSEY, THE INVALIDITY OF SUCH PORTION SHALL NOT AFFECT THE VALIDITY OF THE REMAINING PORTIONS OF THE APPLICABLE SECTIONS.
Indemnification. To the extent permitted under applicable law, you agree to defend, indemnify, and hold harmless the Datavolo Parties from and against any claims, actions or demands, including, without limitation, reasonable legal and accounting fees, arising or resulting from your breach of this Agreement or your access to, use or misuse of the Content or Site. Datavolo shall provide notice to you of any such claim, suit, or proceeding. Datavolo reserves the right to assume the exclusive defense and control of any matter which is subject to indemnification under this section. In such case, you agree to cooperate with any reasonable requests assisting Datavolo’s defense of such matter.
Termination of the Agreement. Datavolo reserves the right, in its sole discretion, to restrict, suspend, or terminate this Agreement and your access to all or any part of the Site or the Content at any time and for any reason without prior notice or liability. Datavolo reserves the right to change, suspend, or discontinue all or any part of the Site or the Content at any time without prior notice or liability.
Sections 2 (Use of the Site), 3 (Limitation of Liability and Warranty), 4 (Indemnification), 5 (Termination of Agreement), and 8 (Miscellaneous) shall survive the termination of this Agreement.
User Must Comply with Applicable Laws. This Site is hosted in the United States. We make no claims concerning whether the Content may be downloaded, viewed, or be appropriate for use outside of the United States. If you access the Site or the Content from outside of the United States, you do so at your own risk. Whether inside or outside of the United States, you are solely responsible for ensuring compliance with the laws of your specific jurisdiction.
The United States controls the export of products and information. You expressly agree to comply with such restrictions and not to export or re-export any of the Content to countries or persons prohibited under the export control laws. By downloading the Content, you are expressly agreeing that you are not in a country where such export is prohibited or are a person or entity for which such export is prohibited. You are solely responsible for compliance with the laws of your specific jurisdiction regarding the import, export, or re-export of the Content.
U.S. Government Restricted Rights. The Content is provided with “RESTRICTED RIGHTS.” Use, duplication, or disclosure by the Government is subject to the restrictions contained in 48 CFR 52.227-19 and 48 CFR 252.227-7013 et seq. or its successor. Use of the Site or Content by the Government constitutes acknowledgement of our proprietary rights in the Site and Content.
Miscellaneous. This Agreement is governed by the internal substantive laws of the State of Delaware, without respect to its conflict of laws provisions. You expressly agree to submit to the exclusive personal jurisdiction of the state and federal courts located in the State of Delaware. If any provision of this Agreement is found to be invalid by any court having competent jurisdiction, the invalidity of such provision shall not affect the validity of the remaining provisions of this Agreement, which shall remain in full force and effect. Failure of Datavolo to act on or enforce any provision of the Agreement shall not be construed as a waiver of that provision or any other provision in this Agreement. No waiver shall be effective against Datavolo unless made in writing, and no such waiver shall be construed as a waiver in any other or subsequent instance. Except as expressly agreed by Datavolo and you, this Agreement constitutes the entire agreement between you and Datavolo with respect to the subject matter, and supersedes all previous or contemporaneous agreements, whether written or oral, between the parties with respect to the subject matter. The section headings are provided merely for convenience and shall not be given any legal import. We may freely assign our rights under this Agreement. This Agreement will inure to the benefit of our successors and assigns. Any information submitted or provided by you to the Site might be publicly accessible. Important and private information should be protected by you.
Data Processing Addendum
This Data Processing Addendum (including all Schedules attached hereto, the “DPA”) is incorporated into, and is subject to the terms and conditions of, the Master Subscription Agreement (“Agreement”) between Datavolo, Inc. (“Datavolo ”) and the entity identified as the customer in the Agreement or the relevant order form (“Customer”). This DPA applies to the extent Datavolo’s Processing of Customer Personal Data in the provision of the Datavolo Product is subject to the Data Protection Legislation. This DPA shall be effective for the term of the Agreement.
1. Definitions
1.1. “Controller” means the entity that determines the purposes and means of the Processing of Personal Data. The term “Controller” includes a “business” as defined under the CCPA.
1.2. “Customer Personal Data” means the Personal Data described under Schedule 1 to this DPA.
1.3. “Data Protection Legislation” means all laws and regulations, including laws and regulations of: (i) the European Union, the European Economic Area and their member states, Switzerland and the United Kingdom; (ii) the United States (including, but not limited to the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) and other applicable state privacy laws); and (iii) any other jurisdiction in which the parties operate, all (i)–(iii) applicable to the Processing of Personal Data under the Agreement.
1.4. “Data Subjects” means the individuals identified in Schedule 1 to this DPA.
1.5. “EU SCCs” means the Standard Contractual Clauses approved with Commission Implementing Decision (EU) 2021/914 of June 4, 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as amended, supplemented, updated or replaced from time to time.
1.6. “GDPR” means the General Data Protection Regulation (EU) 2016/679 together with any national implementing laws in any member state of the EEA (“EU GDPR”), and the EU GDPR as incorporated into the laws of the United Kingdom (“UK GDPR”).
1.7. “Personal Data” and “Processing” will each have the meaning given to them in the Data Protection Legislation. The term “Personal Data” includes “personal information,” “personally identifiable information,” and equivalent terms as such terms may be defined by the Data Protection Legislation.
1.8. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to Customer Personal Data.
1.9. “Processor” means the entity which Processes Personal Data on behalf of the Controller. The term “Processor” includes a “service provider” as that term is defined under the CCPA.
1.10. “Sell” and “Share” has the meaning given in the Data Protection Legislation.
1.11. “Sub-Processor” means another Processor engaged by a Processor to carry out Processing on behalf of a Controller.
1.12. “UK Addendum” means the International Data Transfer Addendum to the EU SCCs, issued by the UK Information Commissioner for parties making restricted transfers, which entered into force on 21 March 2022 (collectively, with the EU SCCs, the “SCCs”).
Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement.
2. Processing of Customer Personal Data
2.1. Customer is a Controller of Customer Personal Data and Datavolo is a Processor. If Customer is itself acting as a Processor for Customer Personal Data on behalf of a Controller of such data, Datavolo will Process such data as a Sub-Processor to Customer. The details of Datavolo’s Processing of Customer Personal Data are described in Schedule 1 to this DPA.
2.2. Datavolo will only Process Customer Personal Data as a Processor on behalf of and in accordance with Customer’s prior written instructions, including any instructions provided through Customer’s use of the Datavolo Product. Customer hereby instructs Datavolo to Process Customer Personal Data to the extent necessary to provide the Datavolo Product as set forth in the Agreement and this DPA. Datavolo shall not (1) retain, use, or disclose Customer Personal Data other than as provided for in the Agreement, as needed to provide the Datavolo Product, or as otherwise permitted by Data Protection Legislation; (2) retain, use, or disclose Customer Personal Data outside of the direct business relationship between Customer and Datavolo, including by combining Customer Personal Data with Personal Data Datavolo receives from third parties, other than Customer, except as permitted by the Data Protection Legislation; or (3) Sell or Share Customer Personal Data. Upon notice to Datavolo, Customer may take reasonable and appropriate steps to remediate Datavolo’s use of Customer Personal Data in violation of this DPA.
2.3. Datavolo will immediately inform Customer if, in its opinion, an instruction from Customer infringes the Data Protection Legislation. If applicable laws preclude Datavolo from complying with Customer’s instructions, Datavolo will inform Customer of its inability to comply with the instructions, to the extent permitted by law.
2.4. Each of Customer and Datavolo will comply with their respective obligations under the Data Protection Legislation. Datavolo shall notify Customer if it determines that it cannot meet its obligations under the Data Protection Legislation. Customer has the right to take reasonable steps to ensure that Datavolo uses Customer Personal Data in a manner consistent with Customer’s obligations under Data Protection Legislation by exercising Customer’s audit rights in Section 10 of this DPA.
3. Cross-Border Transfers of Personal Data
3.1. With respect to Customer Personal Data originating from the European Economic Area (“EEA”), the United Kingdom (the “UK”) or Switzerland that is transferred from Customer to Datavolo, the parties agree to comply with the general clauses and with “Module Two” (Controller to Processor) and “Module Three” (Processor to Processor) of the EU SCCs, which are incorporated herein by reference, with Customer as the “data exporter” and Datavolo as the “data importer.”
3.2. For purposes of the EU SCCs the parties agree that:
3.2.1. The optional docking clause 7 of the EU SCCs will not apply.
3.2.2. In clause 9 of the EU SCCs, option 2 will apply and the time period for prior notice of Sub-Processor changes will be as set forth in Section 5.2 of this DPA.
3.2.3. The optional language in clause 11 of the EU SCCs will not apply.
3.2.4. In clause 17 of the EU SCCs, option 1 applies and the EU SCCs shall be governed by the laws of Ireland.
3.2.5. In clause 18(b) of the EU SCCs, the parties agree to submit to the jurisdiction of the courts of Ireland.
3.2.6. In Annex I, Section A (List of Parties) of the EU SCCs, (i) the Customer is the data exporter and Datavolo is the data importer, and their identity and contact details and, where applicable, information about their respective data protection officer and/or representative in the EEA are those set forth in the Agreement or as otherwise communicated by each party to the other party; (ii) Customer is a Controller (under “Module Two” of the EU SCCs) or Processor (under “Module Three” of the EU SCCs), and Datavolo is a Processor; (iii) the activities relevant to the data transferred under the EU SCCs relate to the provision of the Datavolo Product pursuant to the Agreement; and (iv) entering into this DPA shall be treated as each party’s signature of Annex I, Section A, as of the effective date of this DPA.
3.2.7. In Annex I, Section B (Description of Transfer) of the EU SCCs: (i) Schedule 1 to this DPA describes Datavolo’s Processing of Customer Personal Data; (ii) the frequency of the transfer is continuous (for as long as Customer uses the Datavolo Product); (iii) Customer Personal Data will be retained in accordance with Clause 8.5 of the EU SCCs and this DPA; (iv) Datavolo uses the Sub-Processors described in Section 5.2 of this DPA to support the provision of the Datavolo Product.
3.2.8. In Annex I, Section C (Competent Supervisory Authority) of the EU SCCs, the competent supervisory authority identified in accordance with Clause 13 of the EU SCCs is the competent supervisory authority communicated by Customer to Datavolo.
3.2.9. In Annex II of the EU SCCs, data importer has implemented and will maintain appropriate technical and organizational measures to protect the security, confidentiality and integrity of Customer Personal Data as described in Schedule 2 to this DPA.
3.3. If the transfer of Customer Personal Data is subject to the Swiss Federal Act on Data Protection (“FADP”), the parties agree to rely on the EU SCCs with the following modifications: (i) the Federal Data Protection and Information Commissioner (FDPIC) will be the competent supervisory authority under Clause 13 of the EU SCCs; (ii) the parties agree to abide by the GDPR standard in relation to all Processing of Customer Personal Data that is governed by the FADP; (iii) the term “Member State” in the EU SCCs will not prevent Data Subjects who habitually reside in Switzerland from initiating legal proceedings in Switzerland in accordance with Clause 18(c) of the EU SCCs; and (iv) references to the ‘GDPR’ in the EU SCCs will be understood as references to the FADP.
3.4. With respect to transfers from Customer to Datavolo of Customer Personal Data originating from the UK, the parties agree that the UK Addendum will complement the EU SCCs to the extent required under Data Protection Law. The UK Addendum is incorporated herein by reference. The parties agree that the UK Addendum is completed as follows:
3.4.1. For the purpose of Part 1 of the UK Addendum:
3.4.1.1. Table 1 (Parties): the start date is the effective date of the Agreement, the exporter is the Customer and the importer is Datavolo, the table is deemed to be completed with the information set out in Section 3.2 of this DPA, and by entering into this DPA, the parties are deemed to have signed the UK Addendum.
3.4.1.2. Table 2 (Selected SCCs, Modules and Selected Clauses): the “Approved EU SCCs” which the UK Addendum is appended to are the EU SCCs incorporated into this DPA and completed as set out in Section 3.2 of this DPA.
3.4.1.3. Table 3 (Appendix Information): the information requested in Annex 1 is provided in Sections 3.2.6 and 3.2.7 of this DPA; the security measures requested in Annex 2 are described in Schedule 2 to this DPA; the list of Sub-Processors is available as described in Section 5.2 of this DPA.
3.4.1.4. Table 4: both the data importer and the data exporter may end the UK Addendum as set out in section 19 of the UK Addendum.
4. Confidentiality and Security
4.1. Datavolo will require Datavolo’s personnel who access Customer Personal Data to commit to protect the confidentiality of Customer Personal Data.
4.2. Datavolo will implement commercially reasonable technical and organisational measures, as further described in Schedule 2 to this DPA, that are designed to protect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
4.3. To the extent required by Data Protection Legislation, Datavolo will provide Customer with reasonable assistance for the fulfilment of Customer’s obligations under Data Protection Legislation to maintain the security of Customer Personal Data.
5. Sub-Processing
5.1. Customer hereby authorizes Datavolo to appoint (and permit each Sub-Processor appointed in accordance with this Section 5 to appoint) Sub-Processors in accordance with this Section 5.
5.2. The Sub-Processors appointed by Datavolo as at the date of this DPA are set out in Schedule 3 of this DPA. Datavolo will inform customer of any intended changes concerning the addition or replacement of any appointed Sub-Processors (a “New Sub-Processor”) at least ten (10) days in advance, along with reasonably detailed information about such New Sub-Processor. Customer will have an opportunity to object in writing to the appointment of a New Sub-Processor within ten (10) business days after receipt of notice of a New Sub-Processor in accordance with Section 5.2, provided that such objection must be on reasonable, substantial grounds, directly related to such New Sub-Processor’s ability to comply with substantially similar obligations to those set out in this DPA. If Customer does not so object, the engagement of the New Sub-Processor shall be deemed accepted by Customer. If Customer notifies Datavolo in writing of any objections to the proposed appointment, the parties agree to discuss commercially reasonable alternative solutions in good faith. If the parties cannot reach a resolution within thirty (30) business days from the date of
5.3. Datavolo’s receipt of Customer’s written objection, the parties may terminate the Agreement.
Datavolo will enter into an agreement with each Sub-Processor that imposes on the Sub-Processor, in substance, the same obligations that apply to Datavolo under this DPA. Where any of its Sub-Processors fails to fulfil its data protection obligations, Datavolo will be liable to Customer for the performance of its Sub-Processors’ obligations.
6. Data Subject Rights
Customer is responsible for responding to any Data Subject requests relating to Customer Personal Data (“Requests”). If Datavolo receives any Requests during the term of the Agreement, Datavolo will advise the Data Subject to submit the request directly to Customer. Datavolo will provide Customer with reasonable assistance to permit Customer to respond to Requests.
7. Personal Data Breaches
Upon becoming aware of a Personal Data Breach affecting Customer Personal Data, Datavolo will (i) promptly take measures designed to remediate the Personal Data Breach, and (ii) notify Customer without undue delay. Customer is solely responsible for complying with Personal Data Breach notification requirements applicable to Customer. Customer may request that Datavolo reasonably assist Customer’s efforts to notify Personal Data Breaches to the competent data protection authorities and/or affected Data Subjects, if Customer is required to do so under the Data Protection Legislation. Datavolo’s notice of or response to a Personal Data Breach under this Section 7 will not be an acknowledgement or admission by Datavolo of any fault or liability with respect to the Personal Data Breach.
8. Data Protection Impact Assessment; Prior Consultation
Customer may request reasonable assistance from Datavolo in connection with conducting data protection impact assessments and consultation with data protection authorities if Customer is required to engage in such activities under applicable Data Protection Legislation and the data protection impact assessment or consultation relate to the Processing by Datavolo of Customer Personal Data.
9. Deletion or Return of Customer Personal Data
Datavolo will delete or return Customer Personal Data, upon Customer’s written request, upon termination of the Agreement, and delete existing copies. The parties agree that the certification of deletion described in the SCCs, if applicable, shall be provided only upon Customer’s written request. Notwithstanding the foregoing, Datavolo may retain Customer Personal Data to the extent and for the period required by applicable laws provided that Datavolo maintains the confidentiality of all such Customer Personal Data and Processes such Customer Personal Data only as necessary for the purpose(s) specified in the applicable laws requiring its storage.
10. Audits
10.1. Customer may audit Datavolo’s compliance with its obligations under this DPA up to once per year. In addition, Customer may perform more frequent audits (including inspections) in the event: (1) Datavolo suffers a Personal Data Breach affecting Customer Personal Data; (2) Customer has genuine, documented concerns regarding Datavolo’s compliance with this DPA or the Data Protection Legislation; or (3) where required by the Data Protection Legislation, including where mandated by regulatory or governmental authorities with jurisdiction over Customer Personal Data. Datavolo will contribute to such audits by providing Customer or Customer’s regulatory or governmental authority with the information and assistance reasonably necessary to conduct the audit.
10.2. To request an audit, Customer must submit a detailed proposed audit plan to [email protected] at least one month in advance of the proposed audit start date. The proposed audit plan must describe the proposed scope, duration, start date of the audit, and the identity of any third party Customer intends to appoint to perform the audit. Datavolo will review the proposed audit plan and provide Customer with any concerns or questions (for example, Datavolo may object to the third party auditor as described in Section 10.3, provide an Audit Report as described in Section 10.4, or identify any requests for information that could compromise Datavolo confidentiality obligations or security, privacy, employment or other relevant policies). The parties will negotiate in good faith to agree on a final audit plan at least two weeks in advance of the proposed audit start date. Nothing in this Section 10 shall require Datavolo to breach any duties of confidentiality.
10.3. Datavolo may object to third party auditors that are, in Datavolo’s reasonable opinion, not suitably qualified or independent, a competitor of Datavolo, or otherwise manifestly unsuitable. Customer will appoint another auditor or conduct the audit itself if the parties cannot resolve Datavolo’s auditor objection after negotiating in good faith.
10.4. If the requested audit scope is addressed in an SSAE 18/ISAE 3402 Type 2, ISO, NIST or similar audit report performed by a qualified third party auditor on Datavolo’s systems that Process Customer Personal Data (“Audit Reports”) within twelve (12) months of Customer’s audit request and Datavolo confirms there are no known material changes in the controls audited, Customer agrees to accept the Audit Report in lieu of requesting an audit of the controls covered by the Audit Report.
10.5. The audit must be conducted at a mutually agreeable time during regular business hours at the applicable facility, subject to the agreed final audit plan and Datavolo’s health and safety or other relevant policies. The audit may not unreasonably interfere with Datavolo business activities.
10.6. Any audits are at Customer’s expense and Customer will promptly disclose to Datavolo any perceived non-compliance or security concerns discovered during the audit, together with all relevant details.
10.7. The parties agree that the audits described in the SCCs, if applicable, shall be performed in accordance with this Section 10.
11. Liability
11.1. Each party’s liability towards the other party under or in connection with this DPA will be limited in accordance with the provisions of the Agreement.
11.2. Customer acknowledges that Datavolo is reliant on Customer for direction as to the extent to which Datavolo is entitled to Process Customer Personal Data on behalf of Customer in performance of the Datavolo Product. Consequently, Datavolo will not be liable under the Agreement for any claim brought by a Data Subject arising from (a) any action or omission by Datavolo in compliance with Customer’s instructions or (b) from Customer’s failure to comply with its obligations under the Data Protection Legislation.
12. General Provisions
With regard to the subject matter of this DPA, in the event of inconsistencies between the provisions of this DPA and the Agreement, the provisions of this DPA shall prevail. In the event of inconsistencies between the DPA and the SCCs, the SCCs will prevail.
SCHEDULE 1
Details of Processing
1. Categories of Data Subjects. This DPA applies to Datavolo’s Processing of Customer Personal Data relating to Customer’s authorized users, employees, contractors, or other individuals whose Personal Data is contained in Customer Materials.].
2. Types of Personal Data. The extent of Customer Personal Data Processed by Datavolo is determined and controlled by Customer in its sole discretion and may include names, email, and other Personal Data contained in Customer Materials.
3. Types of Sensitive Personal Data: None.
4. Subject-Matter and Nature of the Processing. Customer Personal Data will be subject to the Processing activities that Datavolo needs to perform in order to provide the Datavolo Product pursuant to the Agreement.
5. Purpose of the Processing. Datavolo will Process Customer Personal Data for purposes of providing the Datavolo Product as set out in the Agreement.
6. Duration of the Processing. Customer Personal Data will be Processed for the duration of the Agreement, subject to Section 9 of the DPA.
SCHEDULE 2
Security Measures
Datavolo will ensure the ongoing confidentiality, integrity, availability and resilience of processing systems, including the following safeguards:
(a) A security program which addresses: compliance and standards; data privacy and protection; communications and operations security management; physical security; systems acquisition, development, and maintenance; third-party risk management; configuration and change management for software systems; incident response planning and management, including appropriate maintenance, and monitoring and analysis of audit logs;
(b) Personnel, with access to Customer Personal Data, shall be bound to keep such information confidential and shall comply with Datavolo’s applicable data protection and security procedures;
(c) Where physical locations process Customer Personal Data in connection with this DPA, Datavolo shall ensure: (i) location access control procedures are aligned with Datavolo’s security procedures; (ii) data centers and other locations which house computers and communication systems used to perform obligations under this Agreement have: (a) suitable physical security measures designed to prevent unauthorized persons from gaining access; and (b) suitable environmental controls, in accordance with good industry practices, and have the ability to continue in operation despite disruption to the main power supply;
(d) Backups, on a regular basis, of Datavolo’s systems, applications, and software replicated to a disaster recovery facility, so recovery can take place when there is a disaster;
(e) Customer Personal Data is replicated to a disaster recovery facility, providing a scheduled point in time to back up the data to ensure data integrity;
(f) Encryption and other security technologies are implemented to safeguard the integrity, and confidentiality in connection with any transmission, transfer, communication, or remote access connectivity involving Customer Personal Data;
(g) Access to Datavolo’s systems, or applications, will be granted and revoked, in accordance with Datavolo’s procedures; and
(h) Passwords allocated will conform to industry standards and align with password management standards.
SCHEDULE 3
Sub-Processors
| Company Name | Description of Service | Country of Processing |
| Amazon Web Services, Inc. | Cloud Infrastructure | United States |
| Google Cloud Platform | Cloud Infrastructure | United States |
| Azure | Cloud Infrastructure | United States |