This Data Processing Addendum (“DPA”) forms part of the Silkrun Master Subscription Agreement between Dubsof Limited (“Dubsof”) and Customer (the “Agreement”). It applies where Dubsof processes Customer Personal Data on Customer’s behalf in providing the Services. Capitalised terms not defined in this DPA have the meanings given to them in the Agreement.
1. Definitions
- “Data Protection Laws” means all laws that apply to the processing of Personal Data under the Agreement, including the GDPR, the Data Protection Acts 1988 to 2018 (Ireland), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection and US State Privacy Laws.
- “GDPR” means Regulation (EU) 2016/679.
- “Customer Personal Data” means Personal Data in Customer Information that Dubsof processes on Customer’s behalf.
- “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
- “Subprocessor” means any third party engaged by Dubsof to process Customer Personal Data.
- “SCCs” means the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914.
- “US State Privacy Laws” means the privacy laws of US states that apply to the processing of Customer Personal Data, including the California Consumer Privacy Act as amended.
- “Personal Data”, “processing”, “controller”, “processor”, “data subject” and “supervisory authority” have the meanings given to them in the GDPR.
2. Roles and Processing
2.1. Roles. Customer is the controller of Customer Personal Data, or a processor acting on behalf of its own controllers. Except as expressly set out in this DPA or the Agreement, Dubsof is a processor of Customer Personal Data, or a subprocessor where Customer is a processor.
2.2. Customer’s Instructions. Dubsof will process Customer Personal Data only on Customer’s documented instructions, unless required to do otherwise by EU or Member State law, in which case Dubsof will inform Customer of that requirement before processing unless the law prohibits it. Customer’s instructions are set out in the Agreement, this DPA and Customer’s use and configuration of the Services, including the workflows, applications and agents Customer sets up in Silkrun. Dubsof will inform Customer if, in its opinion, an instruction infringes Data Protection Laws.
2.3. Customer’s Responsibilities. Customer is responsible for having a lawful basis for the processing, for giving any notices and obtaining any consents required by Data Protection Laws, and for ensuring its instructions comply with Data Protection Laws.
2.4. Details of Processing. The subject matter, duration, nature and purpose of the processing, and the types of Customer Personal Data and categories of data subjects, are set out in Exhibit A.
3. Confidentiality
Dubsof will ensure that personnel authorised to process Customer Personal Data are bound by obligations of confidentiality and that access is limited to personnel who need it to provide the Services.
4. Subprocessors
4.1. Authorisation. Customer gives Dubsof general written authorisation to engage Subprocessors. The current list of Subprocessors is available at https://legal.dubsof.com/subprocessors.
4.2. Changes. Dubsof will notify Customer by email to Customer’s account owner at least ten (10) days before engaging a new Subprocessor or replacing an existing one. Customer may object to the change on reasonable data protection grounds by notice to legal@dubsof.com within that period. The Parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected Services by written notice and receive a pro-rata refund of any prepaid, unused Fees for them.
4.3. Subprocessor Obligations. Dubsof will impose on each Subprocessor data protection obligations no less protective of Customer Personal Data than those in this DPA, and remains liable to Customer for each Subprocessor’s performance of those obligations.
5. Security
Dubsof will implement and maintain the technical and organisational measures described in the Information Security Addendum at https://legal.dubsof.com/security (Exhibit C). Dubsof will not materially reduce the overall level of security of the Services during the then-current Service Period.
6. International Transfers
6.1. Location. Dubsof processes Customer Personal Data primarily in the European Economic Area.
6.2. Onward Transfers. Dubsof will transfer Customer Personal Data outside the European Economic Area, including to Subprocessors in the United States, only where the transfer is subject to an appropriate safeguard under Chapter V of the GDPR, such as an adequacy decision (including the EU-US Data Privacy Framework, where the recipient is certified under it) or the SCCs.
6.3. Transfers from Outside the EEA. Where the Data Protection Laws of a country outside the European Economic Area require a safeguard for the transfer of Customer Personal Data from Customer to Dubsof, the Parties will cooperate to put that safeguard in place.
6.4. Government Requests. Dubsof will not voluntarily disclose Customer Personal Data to any law enforcement or government authority. If Dubsof receives a request for Customer Personal Data from such an authority, Dubsof will try to redirect the authority to request the data directly from Customer, will notify Customer of the request unless the law prohibits it, and will challenge the request where it has reasonable grounds to do so.
7. Data Subject Requests
If Dubsof receives a request from a data subject relating to Customer Personal Data, Dubsof will promptly forward it to Customer and will not respond to it except to direct the data subject to Customer. Customer can respond to most requests using the functionality of the Services. Where Customer cannot do so, Dubsof will provide reasonable assistance, and Customer will bear Dubsof’s reasonable costs of any assistance beyond the functionality of the Services.
8. Impact Assessments and Consultations
Dubsof will provide reasonable assistance to Customer with any data protection impact assessment or prior consultation with a supervisory authority that Data Protection Laws require of Customer in relation to the Services, to the extent Customer does not otherwise have access to the relevant information.
9. Audits
9.1. Information. Dubsof will make available to Customer the information reasonably necessary to demonstrate its compliance with this DPA, including its completed security questionnaires and, once available, its SOC 2 report or ISO/IEC 27001 certificate.
9.2. Audits. Where that information is not sufficient to demonstrate compliance, or where a supervisory authority requires it, Customer may audit Dubsof’s compliance with this DPA, either itself or through an independent auditor bound by confidentiality obligations. Customer must give at least thirty (30) days’ notice, and audits must take place during normal business hours in Ireland, no more than once in any calendar year (except following a Personal Data Breach or at the direction of a supervisory authority), and be limited to systems and records relevant to Customer Personal Data. Customer bears the costs of any audit.
9.3. Records. Dubsof will keep the records needed to demonstrate its compliance with this DPA for three (3) years after the Agreement ends.
10. Personal Data Breaches
10.1. Notification. Dubsof will notify Customer of a Personal Data Breach without undue delay, and in any event within seventy-two (72) hours of becoming aware of it. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it.
10.2. Response. Dubsof will take reasonable steps to contain and remediate the breach, and will provide reasonable assistance to Customer with any notifications to supervisory authorities and data subjects.
10.3. No Admission. Dubsof’s notification of a Personal Data Breach is not an acknowledgement of fault or liability. This Section 10 does not apply to a breach caused by Customer or its Authorised Users.
11. Return and Deletion
Customer can export Customer Personal Data using the functionality of the Services during the Service Period. When the Agreement ends, Dubsof will, at Customer’s choice, return Customer Personal Data to Customer or delete it, and will delete existing copies, unless EU or Member State law requires Dubsof to keep them. Copies held in backups will be deleted in the normal backup cycle. Dubsof will confirm deletion in writing on request.
12. US State Privacy Laws
Where US State Privacy Laws apply to the processing of Customer Personal Data, the terms in Exhibit B also apply.
13. General
13.1. Order of Precedence. If there is a conflict between this DPA and the Agreement relating to the processing of Customer Personal Data, this DPA prevails. Where the SCCs apply, they prevail over this DPA.
13.2. Liability. Each Party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.
13.3. Governing Law. This DPA is governed by the laws of Ireland, and the courts of Ireland have exclusive jurisdiction over any dispute relating to it.
Exhibit A: Details of Processing
| Subject matter | The provision of the Services under the Agreement. |
| Duration | The Service Period, and the period until deletion under Section 11. |
| Nature and purpose | Hosting, storing, organising, structuring, analysing (including with AI models), transforming, transmitting, generating outputs from and deleting Customer Personal Data, in order to provide the Services and to carry out Customer’s instructions, including running the workflows, applications and agents Customer sets up in Silkrun. |
| Data subjects | Customer’s employees, contractors and Authorised Users; Customer’s customers, suppliers and business partners, and their contacts; and other individuals whose Personal Data Customer or its Authorised Users submit to the Services. |
| Types of Personal Data | Identification and contact details (such as names, job titles, email addresses, phone numbers and postal addresses); business transaction records (such as orders, invoices and payment details); Personal Data contained in documents, emails, messages and other records Customer uploads to or connects to the Services; and technical data (such as IP addresses, device identifiers and log data). |
| Special categories | None. Customer will not submit special categories of Personal Data, or Personal Data relating to criminal convictions and offences, to the Services unless the Parties agree otherwise in writing. |
| Frequency | Continuous, for the duration of the Service Period. |
| Subprocessors | As listed at https://legal.dubsof.com/subprocessors. |
Exhibit B: US State Privacy Terms
Where US State Privacy Laws apply, Dubsof is a “service provider” or “processor” (as those terms are defined in US State Privacy Laws) of Customer Personal Data, and Dubsof will:
- not sell or share Customer Personal Data;
- not retain, use or disclose Customer Personal Data for any purpose other than providing the Services, or outside the direct business relationship between Dubsof and Customer;
- not combine Customer Personal Data with Personal Data it receives from other sources, except as US State Privacy Laws permit;
- comply with US State Privacy Laws and provide the same level of privacy protection they require; and
- notify Customer if it can no longer meet its obligations under US State Privacy Laws.
Customer may take reasonable and appropriate steps to stop and remediate any unauthorised use of Customer Personal Data. Dubsof certifies that it understands and will comply with the restrictions in this Exhibit B.
Exhibit C: Security Measures
The technical and organisational measures Dubsof implements are described in the Silkrun Information Security Addendum at https://legal.dubsof.com/security.