Data Processing Addendum & Standard Contractual Clauses
This Data Processing Addendum and Standard Contractual Clauses ("DPA") supplements the master subscription agreement or terms of service agreement between ReferScout, Inc. d/b/a ReferScout ("ReferScout") and Customer (the "Agreement"), when the GDPR applies to Customer's use of ReferScout's Services to Process Customer Data.
Last updated: July 10, 2024
Except as amended by this DPA, the Agreement will remain in full force and effect. The terms used in this Addendum shall have the meanings set forth in this Addendum. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Principal Agreement.
ReferScout reserves the right to periodically modify this DPA upon written notice to Customer, and such modification will automatically become effective in the next service term.
In the event that a competent government authority determines that a conflict exists between the Addendum and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail. If there is a conflict between any other agreement between the Parties including the Agreement and this DPA, the terms of this DPA will control.
1. Definitions
Unless otherwise defined in the Agreement, all capitalized terms used in this DPA will have the meanings given to them below.
1.1 "Agreement" means any agreement between ReferScout and a specific customer under which Services are provided by ReferScout to that customer. Such an agreement may have various titles, including but not limited to "Order Form," "Sales Order," or "Master Subscription Agreement."
1.2 "Customer" means the entity which determines the purposes and means of Processing of Customer Data. Customer may also be referred to as Data Exporter.
1.3 "Customer Data" means any "personal data" (as defined in GDPR) that is provided by or on behalf of Customer and Processed by ReferScout pursuant to the Agreement.
1.4 "Data Protection Laws" means all laws and regulations, including laws and binding regulations of the European Union, the European Economic Area ("EEA") and their member states, Switzerland and the United Kingdom, and any amending or replacement legislation from time to time, applicable to the Processing of Customer Data under the Agreement.
1.5 "GDPR" means the General Data Protection Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the Processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC and the UK GDPR and the Data Protection Act 2018.
1.6 "Permitted Purpose" means the use of the Customer Data to the extent necessary for provision of the Services by ReferScout to the Customer.
1.7 "Security Incident" means any unauthorized or unlawful access to, or acquisition, alteration, use, disclosure, or destruction of Customer Data.
1.8 "Services" means the ReferScout services ordered by the Customer from ReferScout.
1.9 "Standard Contractual Clauses" means the agreement, attached as Exhibit A, pursuant to the European Commission decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to processors established in third countries.
1.10 "Sub-processor" means any entity engaged by ReferScout to Process Customer Data in connection with the Services.
1.11 "Supervisory Authority" means an independent public authority which is established by an EU Member State pursuant to the GDPR and the Information Commissioner as the UK's independent data protection authority.
1.12 Terms such as "Data Subject," "Processing," "Controller," and "Processor" shall have the meaning ascribed to them in the GDPR.
1.13 "Third-Party Services" means connections and/or links to third party websites and/or services not included in the core Services offerings identified in the Agreement, including, without limitation, via application programming interfaces.
1.14 "UK SCC Addendum" means the United Kingdom International Data Transfer Addendum to the European Commission's Standard Contractual Clauses for international data transfers version B1.0 issued by the UK Information Commissioner under Section 119A of the UK Data Protection Act of 2018 and entering into force on 21 March 2022, as updated, amended, or replaced from time to time.
2. Data Processing
2.1 Data Processing Activities
2.1.1 Subject Matter. ReferScout's provision of the Services to the Customer.
2.1.2 Nature and Purpose. ReferScout will process Customer Data for the purposes of providing the Services (including administration, operations, technical and customer support), to Customer in accordance with the Agreement.
2.2 Roles of the Parties
The Parties acknowledge and agree that ReferScout will Process the Customer Data in the capacity of a Processor and that Customer will be the Controller of the Customer Data. Customer understands that to the extent Third-Party Services are accessed, Customer serves as the Controller and the Third-Party Services are Processors, and the Third-Party Services are not Sub-processors of ReferScout.
2.3 Customer Instructions
The Parties agree this DPA and the Agreement constitute Customer's documented instructions regarding ReferScout's processing of Customer Data. ReferScout will process Customer Data only in accordance with these documented instructions.
2.4 Compliance with Laws
Each party will comply with all laws, rules and regulations applicable to it and binding on it in the performance of this DPA, including the GDPR. ReferScout is not responsible for determining the requirements of laws applicable to Customer's business or that ReferScout's provision of the Services meet the requirements of such laws.
3. Customer Obligations
3.1 Instructions
Customer shall provide instructions to ReferScout pursuant to this DPA comply with the Data Protection Laws.
3.2 Data Subject and Supervisory Authority Requests
The Customer shall be responsible for communications and leading any efforts to comply with all requests made by Data Subjects under the Data Protection Laws, and all communications from Supervisory Authorities that relate to Customer Data, in accordance with Data Protection Laws. To the extent such requests or communications require ReferScout's assistance, the Customer shall notify ReferScout of the Data Subject or Supervisory Authority request.
3.3 Notice, Consent and Other Authorizations
Customer is responsible for providing the necessary notice to the Data Subjects under the Data Protection Laws. Customer is responsible for obtaining, and demonstrating evidence that it has obtained, all necessary consents, authorizations and required permissions under the Data Protection Laws in a valid manner for ReferScout to perform the Services.
4. ReferScout's Obligations
4.1 Scope of Processing
ReferScout will Process Customer Data on documented instructions from the Customer, and in such manner as is necessary for the provision of Services except as required to comply with a legal obligation to which ReferScout is subject. If ReferScout believes any documented instruction or additional processing instruction from Customer violates the GDPR or other Data Protection Laws, ReferScout will inform Customer without undue delay and may suspend the performance of the Services until Customer has modified or confirmed the lawfulness of the additional processing instruction in writing.
4.2 Data Subject Requests
If ReferScout receives a request from any Data Subject made under Data Protection relating to Customer Data, ReferScout will provide a copy of that request to the Customer within two (2) business days of receipt. ReferScout provides Customer with tools to enable Customer to respond to Data Subjects' requests to exercise their rights under the Data Protection Laws. To the extent Customer is unable to respond to Data Subject's request using these tools, ReferScout will provide reasonable assistance to the Customer in responding to the request.
4.3 Supervisory Authority Requests
ReferScout will assist Customer in addressing any communications and abiding by any advice or orders from the Supervisory Authority relating to the Customer Data.
4.4 Retention
ReferScout will retain Customer Data only for as long as the Customer deems it necessary for the Permitted Purpose, or as required by applicable laws. At the termination of this DPA, or upon Customer's written request, ReferScout will either destroy or return the Customer Data to the Customer, unless legal obligations require storage of the Customer Data.
4.5 Disclosure to Third Parties and Confidentiality
ReferScout will not disclose the Customer Data to third parties except as permitted by this DPA or the Agreement, unless ReferScout is required to disclose the Customer Data by applicable laws, in which case ReferScout shall (to the extent permitted by law) notify the Customer in writing and liaise with the Customer before complying with such disclosure request. ReferScout treats all Customer Data as strictly confidential and requires all employees, agents, and Sub-processors engaged in Processing the Customer Data to commit themselves to confidentiality.
4.6 Assistance
Taking into account the nature of the Processing and the information available, ReferScout will provide assistance to Customer in complying with its obligations under GDPR Articles 32-36 (inclusive), which address obligations with regard to security, breach notifications, data protection impact assessments, and prior consultation. Upon request, ReferScout will provide Customer a list of processing operations.
4.7 Security
ReferScout will keep Customer Data confidential and implement and maintain administrative, physical, technical and organizational safeguards for the security (including protection against accidental or unlawful loss, destruction, alteration, damage, unauthorized disclosure of, or access to, Customer Data transmitted, stored or otherwise Processed), confidentiality and integrity of Customer Data as detailed in Appendix 2 to Annex 1.
5. Sub-Processors
5.1 SCC's
Pursuant to Clause 9 of the Standard Contractual Clauses, Customer acknowledges and expressly agrees ReferScout may engage new Sub-processors as described in Section 5 of this DPA.
5.2 General Consent
Customer agrees that ReferScout may engage third-party Sub-processors in connection with the provision of Services, subject to compliance with the requirements below. As a condition to permitting a Sub-processor to Process Customer Data, ReferScout will enter into a written agreement with each Sub-processor containing data protection obligations that provide at least the same level of protection for Customer Data as those in this DPA.
5.3 Current Sub-processor List
Customer acknowledges and agrees that ReferScout may engage its current Sub-processors listed at referscout.com/sub-processors.
5.4 Written Notice Via Mailing List
ReferScout will provide Customer with notice ("New Sub-processor Notice") of the addition of any new Sub-processor to the Sub-processor List at any time during the term of the Agreement. ReferScout will provide Customer with additional information about any Sub-processor on the Sub-processor List that Customer may reasonably request upon receipt of a New Sub-processor Notice.
5.5 Customer Objection
If Customer has a reasonable basis to object to ReferScout's use of a new Sub-processor, Customer will notify ReferScout promptly in writing within 15 days after receipt of a New Sub-processor Notice. ReferScout will use reasonable efforts to make available to Customer a change in the affected Services or recommend a commercially reasonable change to Customer's configuration or use of the affected Services to avoid processing of Personal Data by the objected-to new Sub-processor without unreasonably burdening Customer.
5.6 Responsibility
ReferScout will remain responsible for its compliance with the obligations of this DPA and for any acts and omissions of its Sub-processors that cause ReferScout to breach any of ReferScout's obligations under this DPA.
6. Security Incident Notification
ReferScout shall, to the extent permitted by law, notify Customer without undue delay, but no later than 72 hours after becoming aware of any Security Incident. ReferScout's notification of a Security Incident to the Customer to the extent known should include:
- The nature of the incident
- The date and time upon which the incident took place and was discovered
- The number of data subjects affected by the incident
- The categories of Customer Data involved
- The measures taken to address the incident, including measures to mitigate possible adverse effects
- Whether such proposed measures would result in a disproportionate effort
- The name and contact details of the data protection officer or other contact
- A description of the likely consequences of the incident
The Customer alone may notify any public authority.
7. Transfers Outside of the EEA
The Parties agree the Standard Contractual Clauses, as identified in Exhibit A, will apply to Customer Data that is transferred outside the EEA, either directly or via onward transfer, to any country not recognized by the European Commission as providing an adequate level of protection for personal data (as described by the GDPR).
8. Third Party Certifications and Audits
8.1 Certification/SOC Report
In addition to the information contained in this DPA, upon Customer's request, and subject to the confidentiality obligations set forth in the Agreement, ReferScout will make available any information regarding the System and Organization Controls (SOC) 2 Report (or the reports or other documentation describing the controls implemented by ReferScout that replace or are substantially equivalent to the SOC 2), so that Customer can reasonably verify ReferScout's compliance with its obligations under this DPA.
8.2 Audits
To the extent the reports provided in Section 8.1 do not verify ReferScout's compliance with its obligations under this DPA, and subject to the audit requirements described in Clause 8 of the Standard Contractual Clauses, Customer may audit ReferScout's compliance with this DPA up to once per year, unless requested by a Supervisory Authority or in the event of a Security Incident. Such audit will be conducted by an independent third party ("Auditor") reasonably acceptable to ReferScout.
9. Liability
To the extent permitted by applicable laws, liability arising from claims under this DPA will be subject to the terms of the Agreement.
10. Switzerland Transfers
To the extent applicable, Personal Data transferred from Switzerland for which Swiss law governs the international nature of the transfer, (i) references to the GDPR in Clause 4 of the Standard Contractual Clauses are, to the extent legally required, amended to refer to the Swiss Federal Data Protection Act or its successor instead, and the concept of supervisory authority shall include the Swiss Federal Data Protection and Information Commissioner; and (ii) as so amended, the Standard Contractual Clauses are incorporated herein by reference and shall apply, form a part of this DPA, and take precedence over this DPA to the event of any conflict.
11. Miscellaneous
11.1 Obligations Post-termination
Termination or expiration of this DPA shall not discharge the Parties from their obligations meant to survive the termination or expiration of this DPA.
11.2 Severability
Any provision of this DPA that is prohibited or unenforceable in any jurisdiction shall, as to such jurisdiction, be ineffective to the extent of such prohibition or unenforceability without invaliding the remaining provisions hereof.
Exhibit A
Standard Contractual Clauses (Controller to Processor)
Section I
Clause 1: Purpose and scope
(a) The purpose of these standard contractual clauses is to ensure compliance with the requirements of Regulation (EU) 2016/679 for the transfer of personal data to a third country.
(b) The Parties: (i) the entity/ies transferring the personal data, as listed in Annex I.A ("data exporter"), and (ii) the entity/ies in a third country receiving the personal data from the data exporter ("data importer") have agreed to these standard contractual clauses ("Clauses").
(c) These Clauses apply with respect to the transfer of personal data as specified in Annex I.B.
(d) The Appendix to these Clauses containing the Annexes referred to therein forms an integral part of these Clauses.
Clause 2: Effect and invariability of the Clauses
(a) These Clauses set out appropriate safeguards, including enforceable data subject rights and effective legal remedies, pursuant to Article 46(1) and Article 46(2)(c) of Regulation (EU) 2016/679.
(b) These Clauses are without prejudice to obligations to which the data exporter is subject by virtue of Regulation (EU) 2016/679.
Clause 3: Third-party beneficiaries
(a) Data subjects may invoke and enforce these Clauses, as third-party beneficiaries, against the data exporter and/or data importer.
(b) Paragraph (a) is without prejudice to rights of data subjects under Regulation (EU) 2016/679.
Clause 4: Interpretation
(a) Where these Clauses use terms defined in Regulation (EU) 2016/679, those terms shall have the same meaning. (b) These Clauses shall be read and interpreted in the light of the provisions of Regulation (EU) 2016/679. (c) These Clauses shall not be interpreted in a way that conflicts with rights and obligations provided for in Regulation (EU) 2016/679.
Clause 5: Hierarchy
In the event of a contradiction between these Clauses and the provisions of related agreements between the Parties, these Clauses shall prevail.
Clause 6: Description of the transfer(s)
The details of the transfer(s), and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred, are specified in Annex I.B.
Clause 7 (Optional): Docking clause
An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time, either as a data exporter or as a data importer, by completing the Appendix and signing Annex I.A.
Section II — Obligations of the Parties
Clause 8: Data protection safeguards
The data exporter warrants that it has used reasonable efforts to determine that the data importer is able, through the implementation of appropriate technical and organizational measures, to satisfy its obligations under these Clauses.
8.1 Instructions — The data importer shall process the personal data only on documented instructions from the data exporter.
8.2 Purpose limitation — The data importer shall process the personal data only for the specific purpose(s) of the transfer, as set out in Annex I.B.
8.3 Transparency — On request, the data exporter shall make a copy of these Clauses available to the data subject free of charge.
8.4 Accuracy — If the data importer becomes aware that the personal data it has received is inaccurate, or has become outdated, it shall inform the data exporter without undue delay.
8.5 Duration of processing and erasure or return of data — Processing by the data importer shall only take place for the duration specified in Annex I.B. After the end of the provision of the processing services, the data importer shall, at the choice of the data exporter, delete all personal data processed on behalf of the data exporter and certify to the data exporter that it has done so, or return all personal data.
8.6 Security of processing — The data importer and the data exporter shall implement appropriate technical and organizational measures to ensure the security of the data, including protection against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.
8.7 Sensitive data — Where the transfer involves sensitive data, the data importer shall apply the specific restrictions and/or additional safeguards described in Annex I.B.
8.8 Onward transfers — The data importer shall only disclose the personal data to a third party on documented instructions from the data exporter.
8.9 Documentation and compliance — The Parties shall be able to demonstrate compliance with these Clauses. The data importer shall keep appropriate documentation on the processing activities carried out on behalf of the data exporter.
Clause 9: Use of sub-processors
The data importer has the data exporter's general authorization for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the data exporter in writing of any intended changes to that list at least thirty (30) days in advance.
Clause 10: Data subject rights
The data importer shall promptly notify the data exporter of any request it has received from a data subject. The data importer shall assist the data exporter in fulfilling its obligations to respond to data subjects' requests for the exercise of their rights under Regulation (EU) 2016/679.
Clause 11: Redress
The data importer shall inform data subjects in a transparent and easily accessible format, through individual notice or on its website, of a contact point authorised to handle complaints. It shall deal promptly with any complaints it receives from a data subject.
Clause 12: Liability
Each Party shall be liable to the other Party/ies for any damages it causes by any breach of these Clauses. The data importer shall be liable to the data subject for any material or non-material damages caused by breaching third-party beneficiary rights.
Clause 13: Supervision
The supervisory authority of the Member State in which the representative within the meaning of Article 27(1) of Regulation (EU) 2016/679 is established shall act as competent supervisory authority. The data importer agrees to submit itself to the jurisdiction of and cooperate with the competent supervisory authority.
Section III — Local Laws and Obligations in Case of Access by Public Authorities
Clause 14: Local laws and practices affecting compliance
The Parties warrant that they have no reason to believe that the laws and practices in the third country of destination prevent the data importer from fulfilling its obligations under these Clauses. The data importer agrees to notify the data exporter promptly if it has reason to believe that it is or has become subject to laws or practices not in line with these requirements.
Clause 15: Obligations of the data importer in case of access by public authorities
15.1 Notification — The data importer agrees to notify the data exporter promptly if it receives a legally binding request from a public authority for the disclosure of personal data or becomes aware of any direct access by public authorities.
15.2 Review of legality and data minimization — The data importer agrees to review the legality of the request for disclosure and to challenge the request if there are reasonable grounds to consider that it is unlawful. The data importer agrees to provide the minimum amount of information permissible when responding to a request for disclosure.
Section IV — Final Provisions
Clause 16: Non-compliance with the Clauses and termination
The data importer shall promptly inform the data exporter if it is unable to comply with these Clauses. The data exporter shall be entitled to terminate the contract where the data importer is in substantial or persistent breach of these Clauses.
Clause 17: Governing law
These Clauses shall be governed by the law of one of the EU Member States. The Parties agree that this shall be the law of Ireland.
Clause 18: Choice of forum and jurisdiction
Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State. The Parties agree that those shall be the courts of Ireland. A data subject may also bring legal proceedings before the courts of the Member State in which he/she has his/her habitual residence.
Annex I
A) List of Parties
Data Exporter
See Order Form
Role: Controller
B) Description of Transfer
Categories of data subjects:
- Applicants — Natural persons who submit their own personal data via use of the Services
- Referrers — Natural persons who participate in the referral program via use of the Services
- Authorized users of the data exporter who access and use the Services
Categories of personal data transferred:
- Customer Data submitted by Applicants (name, contact details, profession, gender, employment history, references, and other preferences)
- Customer Data included in forms hosted on the Services (such as job application forms)
Frequency: Ongoing during the provision of Services to Customer.
Nature: The data will be routinely accessed from the data importer's systems, which are based outside of the European Economic Area.
Purpose: For the purposes of delivering the Services (including administration, operations, technical and customer support).
Retention: During the Service Term identified in the Order Form.
C) Competent Supervisory Authority
Identified in accordance with Clause 13, based on where the Customer is established, whether Customer has appointed an EU representative, or as otherwise notified in writing to [email protected].
Annex II
Technical and Organizational Measures
ReferScout will process Customer data in accordance with the security standards identified in the Security documentation at referscout.com/security.