Log In Register How it Works

Data Processing Addendum

Updated at 2022-09-10

In order that you as a service user and data controller (referred to as “Controller” or “you” or “User”) may use or continue to use our Chat services (the “Services”) offered by us, RubyChat Athens, Greece and data processor (referred to as “RubyChat” or “Processor”), you have agreed that these data processing terms (“Terms”) shall apply (notwithstanding any other terms and conditions applicable to the delivery of the Services to the contrary) in order to address the compliance obligations imposed upon RubyChat and its Users pursuant to applicable Data Protection Law and in particular, Regulation (EU) 2016/679 (“GDPR”) and Greece`s Law 4624/2019, which provides for the implementing measures of the GDPR (“DPA”).

These Terms shall constitute a separate agreement, or they may be incorporated by reference in the relevant Services agreement, as the case may be.

Definitions

In this Agreement, capitalized words shall have the meaning as set out below or, as the case may be, elsewhere in this Agreement:

Appointment

RubyChat is designated by its Users, User Affiliates and Business Affiliates (collectively “Instructing Parties”) to provide and manage various services, including the Services on their behalf. Accordingly, Personal Data may contain personal data in relation to which User and its Instructing Parties are controllers. RubyChat confirms that it is authorised to communicate to User any instructions or other requirements on behalf of User in respect of processing of Personal Data connection with the Services.

Processor is appointed by User to process Personal Data on behalf of User and/or the Instructing Parties, as the case may be, as is necessary to provide the Services or as otherwise agreed by the parties in writing.

Duration

The Terms shall commence on the Effective Date and shall continue in full force and effect until such time as all Services have ceased and all Personal Data in the Processor’s possession or within its reasonable control has been returned or destroyed (the “Term”).

Data Protection Compliance

In relation to its processing of Personal Data, save as otherwise required by law, RubyChat agrees to:

Sub Processors

Processor will sub-contract, outsource, assign, novate or otherwise transfer obligations under these Terms or engage any subcontractors involved in the processing of Personal Data (each a “Sub processor”) only with User’s prior written consent.

When engaging a Sub processor, Processor will:

Our currently engaged Sub processors are:

Security Incidents

“Security Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.

Processor will investigate the Security Breach and take reasonable action to identify, prevent and mitigate the effects of the Security Breach. Processor will take such further action as User may reasonably request in order to comply with Data Protection Law.

Processor may not release or publish any filing, communication, notice, press release, or report concerning any Security Breach (“Notices“) without User`s prior written approval; such approval shall not be unreasonably withheld.

RubyChat will notify User without undue delay if RubyChat becomes aware of any Security Breach within 24 hours of discovering such Breach and provide User with:

RubyChat shall use its best efforts to immediately mitigate and remedy any Security Incident and prevent any further Security Incident(s) at its sole expense.

RubyChat agrees that User shall have the sole right to determine (i) whether notice of the Security Incident is to be provided to any individuals, regulators, law enforcement agencies, consumer reporting agencies or others as required by law or regulation, or otherwise in User’s discretion, (ii) the contents of such notice, and (iii) whether any type of remediation may be offered to affected persons, as well as the nature and extent of any such remediation.

In the event of a Security Incident involving Personal Data in RubyChat’s possession or otherwise caused by or related to RubyChat’s acts or omissions, and without limiting User’s other rights and remedies, RubyChat will pay all costs and expenses of (i) any disclosures and notification required by applicable law or as otherwise determined as appropriate in User’s reasonable discretion, (ii) monitoring and reporting on the impacted individuals’ or entities’ credit records if determined in User’s reasonable discretion as reasonable to protect such individuals, and (iii) all other costs incurred by User in responding to, remediating and mitigating damages caused by such Security Incident.

RubyChat will investigate the Security Breach and take reasonable action to identify, prevent and mitigate the effects of the Security Breach. RubyChat will take such further action as User may reasonably request in order to comply with Data Protection Law.

RubyChat may not release or publish any filing, communication, notice, press release, or report concerning any Security Breach (“Notices”) without User`s prior written approval; such approval shall not be unreasonably withheld.

Audit

User (or its designated representatives) may, on an annual basis or more frequently as reasonably requested by User, at User’s expense, conduct an audit to verify that RubyChat is operating in accordance with this DPA. Such audit(s) may include a review of all aspects of RubyChat’s performance, including, but not limited to, RubyChat’s general controls and security practices and procedures. RubyChat will cooperate with User in conducting any such audit, and will allow User reasonable access, during normal business hours and upon reasonable notice, to all pertinent records, documentation, computer systems, data, personnel and areas used to Process the User Data areas as User reasonably requests to complete such audit. User will take reasonable steps to prevent the audit from materially impacting RubyChat’s operations.

RubyChat shall correct any deviations from Security Best Practices that are identified in any security audit as soon as practicable, but in no event more than five days after receiving notice from User outlining any deviations (provided, however, that if five days is not a practicable cure period, then RubyChat may instead present a remediation plan to User within such five day period that sets forth an achievable and reasonable timeframe, and RubyChat must thereafter diligently proceed to correct any deviations in accordance with such plan).

International Data Transfers

RubyChat will ensure that no Personal Data are transferred out of either:

Indemnity

Notwithstanding any provisions of the relevant Services agreement to the contrary, Processor shall and hereby agrees to indemnify User and Instructing Parties and their officers, employees, agents and subcontractors (each an “Indemnified Party”) from and against any claims, losses, demands, actions, liabilities, fines, penalties, reasonable expenses, damages and settlement amounts (including reasonable legal fees and costs) incurred by any Indemnified Party as a result of any gross negligence or willful breach by Processor of these Terms.

Miscellaneous

Schedule

Security measures

RubyChat represents, warrants, and undertakes that it has established and for so long as RubyChat Processes Personal Data it will at all times enforce, an ongoing program of Security Policies, Security Procedures, and Security Technical Controls, which reasonably ensures delivery of Security Best Practice made available at request.

Cross Border Data Transfer Mechanisms

In the event the Services are covered by more than one Transfer Mechanism, the transfer of personal data will be subject to a single Transfer Mechanism in accordance with the following order of precedence:

Binding Corporate Rules

Standard Contractual Clauses

The parties agree that the 2021 Standard contractual clauses for international transfers as publish and available here will apply to personal data that is transferred via the Services from the UK, European Economic Area or Switzerland, either directly or via onward transfer, to any country or recipient outside the UK, European Economic Area or Switzerland that is:

Who should I contact for more information?

If you have any questions or comments about our Data Processing Addendum or wish to exercise your rights under applicable laws, please contact us.