Data Processing Agreement

1. Parties and background

This Data Processing Agreement (“DPA”) forms part of the agreement between Ecolyptus Limited (company number 806284), 50 Clanbrassil Street, D08 Y5DC, Dublin, Ireland (“Processor” or “ecolyptus”) and the customer identified in the applicable order or subscription (“Controller” or “Customer”) for use of the ecolyptus platform (the “Services”).

Where the Customer is itself acting on behalf of its own clients (for example a consultancy using ecolyptus under its own brand), the Customer may be a processor and ecolyptus a sub-processor. In that case the Customer confirms it has authority to enter into this DPA on behalf of the relevant controller(s), and the terms apply accordingly through the chain.

This DPA reflects the parties’ obligations under the EU General Data Protection Regulation (GDPR) and applicable data protection law.

2. Definitions

Terms such as “controller”, “processor”, “data subject”, “personal data”, “processing” and “personal data breach” have the meanings given in the GDPR. “Sub-processor” means any third party engaged by ecolyptus to process personal data under this DPA.

3. Roles and scope

The Customer is the controller (or processor) of the personal data processed through the Services, and ecolyptus is the processor (or sub-processor). ecolyptus shall process personal data only on the documented instructions of the Customer, including as set out in this DPA and the Services agreement, unless required to do otherwise by law.

4. Processor obligations

ecolyptus shall:

• Process personal data only on the Customer’s documented instructions;
• Ensure that persons authorised to process the data are bound by confidentiality;
• Implement appropriate technical and organisational security measures (Annex C);
• Respect the conditions for engaging sub-processors set out in section 5;
• Assist the Customer, taking into account the nature of the processing, in responding to data subject rights requests;
• Assist the Customer with security, breach notification, and data protection impact assessments;
• Notify the Customer without undue delay after becoming aware of a personal data breach;
• At the Customer’s choice, delete or return personal data at the end of the Services, as set out in section 8;
• Make available information necessary to demonstrate compliance and allow for and contribute to audits, as set out in section 7.

5. Sub-processors

The Customer provides general authorisation for ecolyptus to engage the sub-processors listed in Annex B. ecolyptus shall impose data protection obligations on each sub-processor equivalent to those in this DPA, and remains liable for their performance. ecolyptus will inform the Customer of any intended changes to sub-processors, giving the Customer the opportunity to object on reasonable data protection grounds.

6. International transfers

Personal data in the Platform is hosted within the EU. Where any transfer of personal data outside the EU/EEA occurs, ecolyptus shall ensure an appropriate transfer mechanism is in place, such as the European Commission’s Standard Contractual Clauses.

7. Audits

ecolyptus shall make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits conducted by the Customer or an appointed auditor, subject to reasonable notice, confidentiality, and frequency limits.

8. Return and deletion of data

On termination of the Services, ecolyptus shall, at the Customer’s choice, delete or return the personal data. Consistent with our retention practice, data is retained for a 30-day grace period after cancellation, then permanently deleted within 90 days, except where retention is required by law (for example accounting records retained for up to 6 years).

9. Liability, term and governing law

This DPA takes effect on the date of the Services agreement and continues for as long as ecolyptus processes personal data on the Customer’s behalf. Liability under this DPA is subject to the limitations set out in the Services agreement. This DPA is governed by the laws of Ireland, and the courts of Ireland have exclusive jurisdiction.

Annex A – Details of processing

Annex B – Approved sub-processors

Annex C – Security measures

ecolyptus maintains appropriate technical and organisational measures, including:

• Encryption of personal data in transit;
• Access controls and role-based permissions, limiting access to authorised personnel;
• Hosting with a reputable cloud provider (AWS) within the EU;
• Authentication controls for Platform access;
• Logging and monitoring of Platform access and activity;
• Internal confidentiality obligations and data protection policies;
• Procedures to detect, report and respond to personal data breaches.