Distance One Data Processing Agreement

This Data Processing Agreement (“DPA”), applies to the Agreement between Rare Circles Inc. dba Distance One (“Distance”), a Canadian corporation (“Distance”), and subscribers to the Distance services (“Subscriber”) (collectively referred to as the “Parties”), sets forth the terms and conditions relating to the privacy, confidentiality, security and protection of Personal Data (as defined below) associated with services to be rendered by Distance to Subscriber (and no other person) pursuant to the agreement entered into between the Parties whereby the Subscriber subscribed for Distance’s services (the “Agreement”).

1. Definitions

“Applicable Law” means all applicable national laws and regulations relating to the privacy, confidentiality, security and protection of Personal Data, including, without limitation: the California Consumer Privacy Act as amended by the California Privacy Rights Act, and its implementing regulations as amended by the California Privacy Rights Act of 2020 (“CCPA”);  as well as relevant data protection and privacy laws in other jurisdictions applicable to Data Processor.

“Data Security Measures” means technical and organisational measures that are aimed at ensuring a level of security of Personal Data that is appropriate to the risk of the Processing, including protecting Personal Data against accidental or unlawful loss, misuse, unauthorised access, disclosure, alteration, destruction, and all other forms of unlawful Processing, including measures to ensure the confidentiality of Personal Data.

“Data Subject” means an identified or identifiable natural person to which the Personal Data pertains.

“Instructions” means this DPA, the Agreement and any further written agreement or documentation through which the Data Controller instructs the Data Processor to perform specific Processing of Personal Data.

“Personal Data” means any information relating to an identified or identifiable natural person Processed by Distance in accordance with Subscriber’s Instructions; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Personal Data Breach” a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.

“Process”, “Processed”, or “Processing” means any operation or set of operations performed upon Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Processor” means the entity which Processes Personal Data on behalf of the Controller, including as applicable any “service provider” as that term is defined by the CCPA.

“Services” means the services offered by Distance and subscribed for by Subscriber under the Master Agreement.

“Standard Contractual Clauses” means Standard Contractual Clauses for the transfer of Personal Data to third countries.

“Sub-Processor” means the entity engaged by the Data Processor or any further Sub-Processor to Process Personal Data on behalf and under the authority of the Data Controller.

2. Roles and Responsibilities of the Parties

   2.1 The parties acknowledge and agree that with regard to the Processing of Personal Data, Distance is a Processor and that Distance or members of the Distance Group will engage Sub-processors pursuant to the requirements set forth in section 4 “Sub-processors” below.

   2.2 Subscriber shall, in its use of the Services, Process Personal Data in accordance with the requirements of Data Protection Laws and Regulations, including any applicable requirement to obtain consent from and provide notice to Data Subjects of the use of their Personal Data by Distance as Processor (including where the Subscriber is a Processor, by ensuring that the ultimate Controller does so). For the avoidance of doubt, Subscriber’s instructions for the Processing of Personal Data shall comply with Data Protection Laws and Regulations. Subscriber shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Subscriber acquired Personal Data. Subscriber specifically acknowledges and agrees that its use of the Services will not violate the rights of any Data Subject, including those that have opted-out from sales or other disclosures of Personal Data, to the extent applicable under Data Protection Laws and Regulations.

   2.3 Distance shall treat Personal Data as Confidential Information and shall Process Personal Data on behalf of and only in accordance with Subscriber’s documented instructions for the following purposes: (i) Processing in accordance with the Agreement and applicable Order Form(s); (ii) Processing initiated by Users in their use of the Services; and (iii) Processing to comply with other documented reasonable instructions provided by Subscriber (e.g., via email) where such instructions are consistent with the terms of the Agreement.

   2.4 The subject-matter of Processing of Personal Data by Distance is the performance of the Services pursuant to the Agreement.

   2.5 Distance shall inform Subscriber immediately (i) if, in its opinion, an instruction from Subscriber constitutes a breach of the Applicable Law and/or (ii) if Distance is unable to follow Subscriber’s instructions for the Processing of Personal Data.

3. Obligation of the Distance

   Distance agrees to and warrants that it shall:

   3.1 Process Personal Data disclosed to it by Subscriber only in accordance with Applicable Law and on behalf of, and in accordance with, the Instructions of the Data Controller, including in order to provide the Services (as defined in the Agreement) or as otherwise, unless Distance is otherwise required by Applicable Law, in which case Distance shall inform Subscriber of that legal requirement before Processing the Personal Data, unless informing the Subscriber is prohibited by law. Distance shall immediately inform Subscriber if, in Distance’s opinion, an Instruction provided infringes Applicable Law.

   3.2 Maintain internal record(s) of Processing activities, copies of which shall be provided to Subscriber by Distance or to supervisory authorities upon request.

4. Sub-Processing

   4.1 Distance shall not share, transfer, disclose, make available or otherwise provide access to any Personal Data to any third party, or contract any of its rights or obligations concerning Personal Data, unless Distance has entered into a written agreement with each such third party that imposes obligations on the third party that are similar to those imposed on Distance under this DPA. Distance shall only retain third parties that are capable of appropriately protecting the privacy, confidentiality and security of the Personal Data.

   4.2 Distance has Subscriber’s general authorisation to appoint (and permit each Sub-processor appointed in accordance with this section 4 to appoint) Sub-processors

   4.3 Distance shall give Subscriber prior written notice at least 30 (thirty) days in advance of the appointment of any new Sub-processor, including reasonable details of the Processing to be undertaken by the Sub-processor and any other information necessary to enable Subscriber to exercise its right to object. Subscriber shall have the right to object to the identity of any such alternate third-party provider and, in the event that Distance continues to engage such alternate third-party provider despite such objection, to terminate this Agreement and the Master Agreement immediately on notice without any further liability to Distance within sixty (60) days’ of notification of such appointment.  

   4.4 Distance may continue to use those Sub-processors already engaged by Distance as at the Effective Date.  

5. Compliance with Applicable Laws

   5.1 Each party covenants and undertakes to the other that it shall comply with all Applicable Laws in the provision and use (as applicable) of the Services.

   5.2 Without limiting the above, (i) Subscriber is responsible for ensuring that it has a lawful basis for the processing of Personal Data in the manner contemplated by this Agreement, and has adequate record of such basis (whether directly or through another third party provider); and (ii) Distance is not responsible for determining the requirements of laws applicable to Subscriber’s business or that Distance’s provision of the Services meet the requirements of such laws. As between the parties, Subscriber is responsible for the lawfulness of the Processing of the Subscriber Personal Data. Subscriber will not use the Services in conjunction with Personal Data to the extent that doing so would violate applicable Data Protection Laws.

   5.3 Subject to the terms of the Agreement, Subscriber may claim from Distance amounts paid to a Data Subject for a violation of their Data Subject rights caused by Distance’s breach of its obligations under Applicable Law.

6. California Specific Provisions. 

   6.1 In this section 7, the terms “processing”, “personal information”, “consumer”, “sell”, “selling”, “sale” and “commercial purpose” shall have the meaning given to them in the CCPA. 

   Notwithstanding anything to the contrary in this DPA, to the extent that Distance is processing any personal information of any consumer on behalf of Subscriber, Distance shall not:

   a) provide Subscriber with remuneration in exchange for Personal Data from Subscriber, where the parties further acknowledge and agree that Subscriber has not “sold” (as such term is defined by the CCPA) Subscriber Data to Distance;

   b) “sell” (as such term is defined by CCPA) or “share” (as such term is defined by the CCPA) Personal Data; nor

   c) retain, use or disclose the personal information that form part of the Personal Data for any purpose other than for the specific purpose of performing the Services or as otherwise permitted by the CCPA, including retaining, using or disclosing the personal information for a commercial purpose other than providing the Services. 

   6.2 Service Distance certifies that any Subprocessors appointed in accordance with the terms of this DPA are “service providers” (as defined under the CCPA) with whom Service Distance has entered into a written contract that includes terms no less protective than those in this DPA.

7. Data Security

   7.1 Distance shall develop, maintain and implement a comprehensive written information security program that complies with Applicable Law and good industry practice. Distance’s information security program shall include appropriate administrative, technical, physical, organisational and operational safeguards and other security measures designed to (i) ensure the security and confidentiality of Personal Data; (ii) protect against any anticipated threats or hazards to the security and integrity of Personal Data; and (iii) protect against any Personal Data Breach, including, as appropriate:

   a) The encryption of the Personal Data;

   b) The ability to ensure the ongoing confidentiality, integrity, availability and resilience of Processing systems and services;

   c) The ability to restore the availability and access to the Personal Data in a timely manner in the event of a physical or technical incident; and

   d) A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures adopted pursuant to this provision for ensuring the security of the Processing.

   7.2 Distance shall supervise Distance personnel to the extent required to maintain appropriate privacy, confidentiality and security of Personal Data. Distance shall provide training, as appropriate, to all Distance personnel who have access to Personal Data.

   7.3 Promptly (and in any event within 90 days) following the expiration or earlier termination of the Master Agreement, Distance shall return to Subscriber or its designee, if so requested during such period, or if not so requested securely destroy or render unreadable or undecipherable, each and every original and copy in every media of all Personal Data in Distance’s, its affiliates’ or their respective subcontractors’ possession, custody or control. In the event applicable law does not permit Distance to comply with the delivery or destruction of the Personal Data, Distance warrants that it shall ensure the confidentiality of the Personal Data and that it shall not use or disclose any Personal Data after termination of this DPA.

8.  Data Breach Notification

   8.1 Distance shall without undue delay inform Subscriber in writing of any Personal Data Breach. The notification to Subscriber shall include all available information regarding such Personal Data Breach, including information on:

   a) The nature of the Personal Data Breach including where possible, the categories and approximate number of affected Data Subjects and the categories and approximate number of affected Personal Data records;

   b) The likely consequences of the Personal Data Breach; and

   c) The measures taken or proposed to be taken to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.

9. Governing Law

   9.1 This DPA shall be governed by the same laws as those that govern the Agreement.