Data Processing Agreement

This Data Processing Agreement (“DPA”) is part of the Terms of Service, or the master agreement if one is signed (the “Agreement”), between Coggno Inc. (“Coggno”) and the Customer that accepts it (“Customer”). It applies when Coggno processes Customer Personal Data on Customer’s behalf. Customer accepts this DPA by accepting the Agreement; no separate signature is needed.

#1. Definitions

• Data Protection Laws: the laws that apply to processing Customer Personal Data under the Agreement, which may include the GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and U.S. state privacy laws such as the California Consumer Privacy Act (“CCPA”).
• Customer Personal Data: personal data that Customer or its users submit to the Service and that Coggno processes on Customer’s behalf.
• Subprocessor: a third party Coggno engages to process Customer Personal Data.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

“Controller,” “processor,” “data subject,” “personal data” and “processing” have the meanings given in the GDPR. “Business,” “service provider,” “sell” and “share” have the meanings given in the CCPA.

#2. Roles and Scope

2.1 Customer is the controller, or under the CCPA the business, and Coggno is the processor, or service provider, of Customer Personal Data.

2.2 Annex 1 describes the subject matter, duration, nature and purpose of the processing, and the types of personal data and data subjects.

2.3 Customer is responsible for having a lawful basis for the processing and for giving its users any notices the law requires.

#3. Coggno’s Obligations

Coggno will:

1. process Customer Personal Data only on Customer’s documented instructions, including on international transfers, unless the law requires otherwise, in which case Coggno will tell Customer first unless the law forbids it. The Agreement and Customer’s use and settings in the Service are Customer’s instructions;
2. make sure everyone authorized to process Customer Personal Data is bound by confidentiality;
3. take all measures required by Article 32 of the GDPR, including the technical and organizational measures in Annex 2;
4. engage Subprocessors only as Section 4 allows;
5. help Customer, through appropriate technical and organizational measures, respond to requests from data subjects exercising their rights;
6. help Customer meet its obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to Coggno;
7. when the services end, delete or return Customer Personal Data at Customer’s choice, and delete remaining copies unless the law requires Coggno to keep them;
8. make available the information needed to show compliance with this DPA, and allow and contribute to audits under Section 7; and
9. tell Customer right away if, in Coggno’s opinion, an instruction breaks Data Protection Laws.

#4. Subprocessors

4.1 Customer gives Coggno general authorization to use Subprocessors. The current list is on our Subprocessors page (Annex 3).

4.2 Coggno will give at least 30 days’ notice before adding or replacing a Subprocessor, by updating the list and emailing Customer’s account administrators. Customer may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith; if they can’t resolve it, Customer may end the affected service.

4.3 Coggno will put data protection obligations on each Subprocessor that are no less protective than this DPA, and remains responsible for its Subprocessors’ performance.

#5. Security Incidents

Coggno will notify Customer without undue delay after becoming aware of a Security Incident. Coggno will give Customer the information it reasonably needs to meet its own notification duties, update it as more is learned, and take reasonable steps to contain the incident. Notice of an incident isn’t an admission of fault.

#6. International Transfers

6.1 Coggno processes Customer Personal Data in the United States and in any other countries listed in Annex 3.

6.2 For transfers of personal data subject to the GDPR to a country without an adequacy decision, the parties incorporate Module 2 (controller to processor) of the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914, completed as set out in Annex 4. For UK transfers, the ICO’s International Data Transfer Addendum (B1.0) applies. For Swiss transfers, the EU SCCs apply with the FDPIC’s adaptations: the FDPIC is the supervisory authority, and data subjects may also sue in Switzerland.

#7. Audits

Once a year, Coggno will answer Customer’s reasonable written security questionnaire. If that isn’t enough to show compliance, or a supervisory authority requires it, Customer, or an auditor Customer appoints, may audit Coggno on 30 days’ written notice, during business hours, at Customer’s cost and under confidentiality.

#8. CCPA Service Provider Terms

Coggno will not sell or share Customer Personal Data; keep, use or disclose it for any purpose other than the business purposes described in Annex 1; keep, use or disclose it outside the direct business relationship with Customer; or combine it with personal information Coggno receives from other sources, except as the CCPA allows. Coggno will comply with the CCPA, give Customer Personal Data the same level of privacy protection the CCPA requires of businesses, and tell Customer if it can no longer meet its obligations. Customer may take reasonable and appropriate steps, including the questionnaire and audits in Section 7, to make sure Coggno uses Customer Personal Data in line with Customer’s CCPA obligations, and to stop and fix any unauthorized use.

#9. Term, Liability and Precedence

This DPA lasts as long as Coggno processes Customer Personal Data. Each party’s liability under this DPA is subject to the limits in the Agreement. If this DPA conflicts with the Agreement, this DPA controls on data protection. If the Standard Contractual Clauses conflict with this DPA, the Clauses control.

#Annex 1: Details of Processing

#Annex 2: Technical and Organizational Measures

#Annex 3: Subprocessors

The current list of Subprocessors is on our Subprocessors page.

#Annex 4: Standard Contractual Clauses