Data processing agreement

Introduction and scope

This Data Processing Agreement (the "DPA") forms part of the agreement between Native Teams and the Client for the provision of the Services, which may be our General terms of use together with the applicable Service Terms, or a signed agreement such as a Master Services Agreement (in each case, the "Agreement").

This DPA sets out the terms on which Native Teams processes Client Personal Data on behalf of the Client. It reflects the requirements of Article 28 of the UK General Data Protection Regulation and the EU General Data Protection Regulation, and the equivalent requirements of other Data Protection Laws that apply to the processing.

This DPA applies automatically whenever Native Teams processes Client Personal Data as a processor in connection with the Services. It does not need to be signed separately. Where the Client has signed the Agreement, this DPA is incorporated into it by reference.

Definitions

In this DPA, the following terms have the meanings set out below. Capitalised terms that are not defined in this DPA have the meanings given in the Agreement.

• "Client" means the business that has entered into the Agreement with Native Teams and, where relevant, its affiliates that are authorised to use the Services under the Agreement.
• "Client Personal Data" means personal data that the Client, its users or its workers submit to the Platform, or that Native Teams otherwise processes on behalf of the Client in providing the Services.
• "Data Protection Laws" means all laws relating to data protection and privacy that apply to the processing of Client Personal Data under the Agreement, including the UK GDPR, the UK Data Protection Act 2018, the EU GDPR, the Swiss Federal Act on Data Protection, and other national data protection laws, each as amended or replaced from time to time.
• "Native Teams" means Native Teams Limited and, where a Service is provided by another company in the Native Teams group, that company.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Client Personal Data processed by Native Teams or its sub-processors.
• "Sub-processor" means any third party, including any company in the Native Teams group, that Native Teams engages to process Client Personal Data on behalf of the Client.
• "Transfer Mechanisms" means the standard contractual clauses approved by the European Commission (the "EU SCCs"), the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (the "UK Addendum"), and any other mechanism recognised under Data Protection Laws for the lawful transfer of personal data.

The terms "controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given to them in Data Protection Laws, and equivalent terms under other Data Protection Laws, such as "business" and "service provider", are to be read accordingly.

Roles of the parties

In relation to Client Personal Data, the Client is the controller and Native Teams is the processor. The Client determines the purposes and means of the processing, and Native Teams processes Client Personal Data only on behalf of the Client and in accordance with its documented instructions.

Where the Client acts as a processor on behalf of another controller, for example a group company, the Client confirms that its instructions and its appointment of Native Teams have been authorised by that controller, and Native Teams acts as a sub-processor. The Client remains the single point of contact for Native Teams in relation to that processing.

The parties acknowledge that Native Teams acts as an independent controller, and not as a processor, in the limited circumstances listed below. In those circumstances, Native Teams processes personal data in accordance with Data Protection Laws and its Privacy Policy, and this DPA does not apply to that processing:

• personal data relating to the Client's representatives and users that Native Teams processes to manage its business relationship with the Client, including account administration, billing, support and communications;
• personal data that Native Teams must process to comply with obligations imposed on it directly by law, including identity verification, anti-money laundering, sanctions screening, fraud prevention, and the keeping of financial and tax records;
• where a company in the Native Teams group acts as the legal employer of a worker under the Employer of Record service, or as the contracting party under the Contractor of Record service, personal data that the company must process to meet its own legal obligations in that capacity under employment, tax and social security laws; and
• aggregated or de-identified data derived from the use of the Services, from which no individual or Client can be identified.

The parties do not intend to act as joint controllers in relation to any processing under the Agreement.

The Client's responsibilities

The Client is responsible for the lawfulness of the processing of Client Personal Data that it instructs Native Teams to carry out. In particular, the Client is responsible for:

• establishing a valid legal basis for the processing, and for any transfer of Client Personal Data to Native Teams;
• providing data subjects with all information required by Data Protection Laws, including information about the use of Native Teams as a processor;
• ensuring that its instructions comply with Data Protection Laws, and that Client Personal Data is accurate, complete and up to date; and
• ensuring that special category data, such as health or trade union information, and data relating to criminal convictions are submitted to the Platform only where this is necessary for the Services and permitted by Data Protection Laws.

The Client must not instruct Native Teams to process Client Personal Data in a manner that would breach Data Protection Laws.

Processing on documented instructions

Native Teams will process Client Personal Data only on the Client's documented instructions, unless it is required to do otherwise by law. In that case, Native Teams will inform the Client of the legal requirement before processing, unless the law prohibits it from doing so on important grounds of public interest.

The Client's documented instructions consist of the Agreement and this DPA, the Client's configuration and use of the Platform, including the Instructions it submits through the Platform, and any other written instructions agreed between the parties. The details of the processing are set out in Annex 1.

Native Teams will inform the Client promptly if, in its opinion, an instruction infringes Data Protection Laws. Native Teams is not required to carry out such an instruction until the Client has confirmed or changed it, and is not obliged to provide legal advice to the Client.

Native Teams will not sell Client Personal Data, will not share it for cross-context behavioural advertising, and will not retain, use or disclose it for any purpose other than providing the Services, or outside its direct business relationship with the Client, except as permitted by Data Protection Laws.

Confidentiality

Native Teams will ensure that every person it authorises to process Client Personal Data, including its employees, contractors and Sub-processors, is subject to an appropriate obligation of confidentiality, whether contractual or statutory, and processes Client Personal Data only as necessary to provide the Services.

Access to Client Personal Data is limited to the people who need it to perform the Services, and those people receive appropriate training in data protection and information security.

Security

Native Teams will implement and maintain appropriate technical and organisational measures to protect Client Personal Data against a Personal Data Breach, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of individuals. These measures are described in Annex 2.

Native Teams may update its security measures from time to time to reflect developments in technology and good practice, provided that any update does not materially reduce the overall level of protection of Client Personal Data.

The Client is responsible for the security of its own systems and accounts, including the management of user access, credentials and permissions, and for the security of Client Personal Data while it is in transit to the Platform from systems under the Client's control.

Sub-processors

The Client grants Native Teams general authorisation to engage Sub-processors to process Client Personal Data, including companies in the Native Teams group and the categories of third parties described in Annex 3. A current list of Sub-processors is available to the Client in the Platform or on request.

Native Teams will inform the Client of any intended addition or replacement of a Sub-processor at least thirty days before the new Sub-processor begins processing Client Personal Data. Native Teams may give shorter notice where a change is urgently required to maintain the security or continuity of the Services, in which case it will inform the Client as soon as reasonably practicable.

The Client may object to a new Sub-processor on reasonable grounds relating to data protection by notifying Native Teams within the notice period. The parties will then discuss the objection in good faith. If the parties cannot resolve the objection within a reasonable time, the Client may terminate the affected Service by written notice, without penalty, as its sole remedy.

Native Teams will enter into a written agreement with each Sub-processor that imposes data protection obligations that are no less protective than those set out in this DPA. Native Teams remains fully responsible to the Client for the performance of each Sub-processor's obligations.

International transfers

Native Teams and its Sub-processors may process Client Personal Data in countries other than the country in which it was collected, to the extent necessary to provide the Services.

Where Client Personal Data is transferred from the United Kingdom, the European Economic Area or Switzerland to a country that is not recognised as providing an adequate level of protection, Native Teams will ensure that the transfer is protected by an appropriate Transfer Mechanism, together with any supplementary measures that are necessary. Annex 4 sets out how the Transfer Mechanisms apply between the Client and Native Teams.

Where a Transfer Mechanism is amended, replaced or invalidated, the parties will cooperate in good faith to implement a valid alternative without undue delay.

Rights of data subjects

Taking into account the nature of the processing, Native Teams will assist the Client, by appropriate technical and organisational measures and in so far as possible, to respond to requests from data subjects exercising their rights under Data Protection Laws. Many requests can be addressed directly by the Client using the functionality of the Platform.

If Native Teams receives a request from a data subject relating to Client Personal Data, it will not respond to the request itself, except to direct the data subject to the Client, unless it is required to do so by law. Native Teams will forward the request to the Client without undue delay, where it is able to identify the Client from the request.

Assistance to the Client

Taking into account the nature of the processing and the information available to it, Native Teams will provide reasonable assistance to the Client in meeting its obligations under Data Protection Laws in relation to the security of processing, data protection impact assessments and prior consultations with supervisory authorities.

Native Teams will promptly inform the Client of any request, complaint or enquiry it receives from a supervisory authority or other public authority that relates to Client Personal Data, unless it is prohibited by law from doing so. Native Teams will challenge any request for disclosure from a public authority that it reasonably considers to be unlawful, and will disclose only the minimum information required.

Personal Data Breaches

Native Teams will notify the Client without undue delay, and where feasible within forty-eight hours, after becoming aware of a Personal Data Breach affecting Client Personal Data.

The notification will describe, to the extent then known, the nature of the Personal Data Breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it and to mitigate its possible adverse effects. Where it is not possible to provide all of this information at the same time, Native Teams will provide it in phases without undue further delay.

Native Teams will take reasonable steps to contain, investigate and remediate the Personal Data Breach, and will cooperate with the Client to enable it to meet any obligation to notify supervisory authorities or data subjects. Native Teams will not notify supervisory authorities or data subjects on behalf of the Client without the Client's prior agreement, unless it is required to do so by law.

A notification of a Personal Data Breach is not an acknowledgement by Native Teams of any fault or liability.

Information and audits

Native Teams will make available to the Client the information reasonably necessary to demonstrate its compliance with this DPA. Native Teams may do so by providing summaries of its security policies, responses to reasonable security questionnaires, and, where available, independent audit reports or certifications.

Where the information provided is not sufficient to demonstrate compliance, or where an audit is required by a supervisory authority or by Data Protection Laws, the Client may carry out an audit of Native Teams' processing of Client Personal Data, either itself or through an independent auditor who is bound by confidentiality obligations and who is not a competitor of Native Teams.

The Client must give at least thirty days' written notice of any audit, and the parties will agree its scope, timing and duration in advance. Audits may take place no more than once in any twelve-month period, unless required following a Personal Data Breach or by a supervisory authority. Audits must be conducted during normal business hours, in a manner that minimises disruption to Native Teams' operations, and without access to the data of other clients. Each party bears its own costs of an audit.

Artificial intelligence

Where the Services include features that use artificial intelligence, Native Teams will process Client Personal Data in connection with those features in accordance with this DPA, its Responsible AI Policy, and the additional commitments set out in Annex 5.

Return and deletion

During the term of the Agreement, the Client may export Client Personal Data from the Platform using the functionality available to it.

When the Services end, the Client may export Client Personal Data for a period of thirty days. After that period, Native Teams will delete Client Personal Data, including existing copies, within ninety days, unless Data Protection Laws or other applicable laws require Native Teams to retain it. Any Client Personal Data retained under this clause will remain protected in accordance with this DPA and will be processed only for the purposes for which it is retained.

Client Personal Data held in backup systems will be deleted in accordance with Native Teams' standard backup cycle and will remain protected until it is deleted. Native Teams will confirm deletion in writing on request.

Records of processing

Native Teams will maintain records of its processing activities carried out on behalf of the Client, as required by Data Protection Laws, and will make them available to a supervisory authority on request.

Liability

Each party's liability arising out of or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Agreement, except to the extent that such limitation is prohibited by Data Protection Laws. Nothing in this DPA limits the rights of data subjects under Data Protection Laws or the Transfer Mechanisms.

Duration, precedence and changes

This DPA remains in force for as long as Native Teams processes Client Personal Data on behalf of the Client, and the obligations that by their nature are intended to survive will continue after the Agreement ends.

If there is any conflict between this DPA and the Agreement, this DPA prevails in relation to the processing of Client Personal Data. If there is any conflict between this DPA and a Transfer Mechanism, the Transfer Mechanism prevails.

Native Teams may update this DPA where necessary to reflect changes in Data Protection Laws, guidance from supervisory authorities, or the Services, provided that any update does not materially reduce the protection of Client Personal Data. Native Teams will notify the Client of material updates in advance. Where the Client has a signed Agreement, any change that materially affects the Client's rights requires the Client's agreement.

This DPA is governed by the law that governs the Agreement, and disputes are subject to the jurisdiction set out in the Agreement, except where a Transfer Mechanism requires otherwise.

Questions about this DPA may be sent to legal@nteams.com.

Annex 1: Details of the processing

This Annex describes the processing of Client Personal Data that Native Teams carries out on behalf of the Client. The scope of the processing in each case depends on the Services that the Client uses and on its configuration of the Platform.

Annex 2: Technical and organisational security measures

Native Teams maintains the following categories of technical and organisational measures to protect Client Personal Data. The measures are reviewed regularly and may be updated in accordance with this DPA.

Annex 3: Sub-processors

Native Teams engages Sub-processors in the categories described below. The current list of Sub-processors, including their location and the services they provide, is available to the Client in the Platform or on request, and Native Teams notifies the Client of changes in accordance with this DPA.

Annex 4: International transfers

This Annex sets out how the Transfer Mechanisms apply to transfers of Client Personal Data from the Client to Native Teams, where such transfers are restricted under Data Protection Laws.

Transfers subject to the EU GDPR

Where the Client is subject to the EU GDPR and transfers Client Personal Data to Native Teams in a country that is not recognised as providing an adequate level of protection, the EU SCCs are incorporated into this DPA by reference and apply as follows. Module Two (controller to processor) applies where the Client is a controller, and Module Three (processor to processor) applies where the Client is a processor. The optional docking clause in Clause 7 does not apply. For Clause 9, Option 2 (general written authorisation) applies, with the notice period set out in this DPA. The optional language in Clause 11 does not apply. For Clause 13, the competent supervisory authority is determined in accordance with that Clause. For Clauses 17 and 18, the EU SCCs are governed by the law of Ireland, and disputes are resolved by the courts of Ireland. The information required by the Annexes to the EU SCCs is set out in Annexes 1, 2 and 3 of this DPA.

Transfers subject to the UK GDPR

Where the Client transfers Client Personal Data from the United Kingdom, the UK Addendum is incorporated into this DPA by reference and applies to the EU SCCs as described above. Table 1 of the UK Addendum is completed with the details of the parties in the Agreement, Tables 2 and 3 are completed with the information in this Annex and in Annexes 1 to 3, and for Table 4, either party may end the UK Addendum in accordance with its Section 19. Where Native Teams receives Client Personal Data in the United Kingdom, no transfer mechanism is required for the transfer from the European Economic Area, as the United Kingdom benefits from an adequacy decision.

Transfers subject to Swiss law

Where the Client transfers Client Personal Data from Switzerland, the EU SCCs apply as described above, with the modifications required by the Swiss Federal Act on Data Protection, including that the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for such transfers.

Onward transfers

Where Native Teams transfers Client Personal Data to a Sub-processor in a country that is not recognised as providing an adequate level of protection, Native Teams will ensure that the transfer is protected by an appropriate Transfer Mechanism and any necessary supplementary measures.

Annex 5: Artificial intelligence

This Annex sets out the additional commitments that apply where Native Teams processes Client Personal Data in connection with features of the Services that use artificial intelligence.

Where the Client connects its own AI tools or third-party AI tools to the Platform, for example through an application programming interface, the Client is responsible for those tools and for the processing they carry out, and they are not Sub-processors of Native Teams.