EdgeCMS Cloud Data Processing Addendum

DRAFT — not legal advice, not in force. For review by a qualified lawyer before publication.

Effective date: [EFFECTIVE DATE]

This Data Processing Addendum ("DPA") forms part of the Terms of Service between the customer ("Customer") and [COMPANY] ("Processor", "we"). It applies when we process personal data contained in Customer Content.

1. Definitions

"Data Protection Law" means all privacy laws that apply to the processing, including the EU GDPR, the UK GDPR and the law of the Processor's country (for example Malaysia's Personal Data Protection Act 2010 as amended). "Personal data", "controller", "processor", "processing" and "data subject" have the meanings in that law. "Customer Personal Data" means personal data in Customer Content.

2. Roles

Customer is the controller (or a processor acting for its own customer). We are the processor (or sub-processor). Each party complies with Data Protection Law as it applies to its role.

3. Instructions

We process Customer Personal Data only to provide the Service under the Terms, as configured by Customer in the Service, and on other documented instructions from Customer. We will tell Customer if we believe an instruction breaks Data Protection Law. Details of the processing are in Annex 1.

4. Confidentiality

Everyone we allow to access Customer Personal Data is bound by confidentiality and gets access only as needed for their role.

5. Security

We maintain the technical and organizational measures in Annex 2 and may improve them over time, provided the overall level of protection does not go down.

6. AI features

AI features are off by default for each workspace. Only when a Customer admin enables them do we send the relevant Customer Content to the AI subprocessors listed in Subprocessors. Customer decides whether to enable them and what content to send. We do not use Customer Personal Data to train models.

7. Subprocessors

• Customer gives general authorization for the subprocessors listed in Subprocessors.
• We give at least 30 days' notice by email and on that page before adding or replacing a subprocessor. Customer may object on reasonable data-protection grounds; if we cannot resolve the objection, Customer may end the affected service and receive a pro-rated refund of prepaid fees.
• We impose data-protection terms on each subprocessor that are at least as protective as this DPA and remain responsible for their performance.

8. Assistance

Taking into account the nature of the processing, we help Customer:

• respond to data subject requests, mainly through self-service export and deletion features, and by forwarding any request we receive directly;
• carry out data protection impact assessments and consult regulators, by providing the information we reasonably have;
• meet its security and breach-notification obligations.

9. Personal data breaches

We notify Customer without undue delay, and in any case within 48 hours, after confirming a breach affecting Customer Personal Data. The notice describes what happened, the data and data subjects affected (as far as known), the likely consequences, the measures taken or proposed, and a contact. We update it as we learn more.

10. Deletion and return

Customer can export Customer Content at any time while the workspace is active and during 1 month after cancellation, suspension or account closure. After that month we delete Customer Personal Data from the live Service; it expires from backups within [BACKUP EXPIRY] days. We keep data longer only where the law requires, and then only for that purpose.

11. Audits

We make available the information reasonably needed to show compliance with this DPA, including completed security questionnaires and, once available, independent audit reports. If that is not enough, Customer may audit us once a year with 30 days' notice, during business hours, at its own cost, under confidentiality, and in a way that does not compromise other customers' data.

12. International transfers

Where Customer Personal Data is transferred from the EU, EEA, UK or Switzerland to a country without an adequacy decision, the parties agree to the EU Standard Contractual Clauses (Module 2 or Module 3 as applicable) and the UK International Data Transfer Addendum, which are incorporated by reference with the details in Annex 1. Where another country's law restricts transfers, the parties will rely on the equivalent mechanism under that law.

13. Liability and precedence

Liability under this DPA is subject to the limits in the Terms, except where Data Protection Law does not allow it. If this DPA conflicts with the Terms on data protection, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the Clauses prevail.

Annex 1 — Details of processing

Annex 2 — Technical and organizational measures