Data Processing Addendum
Being on the same page is critical.
1. Introduction and Scope
1.2 This DPA is a binding agreement between MyListing Club and its Clients, but only to the extent that (a) MyListing Club Processes Client Personal Data
(defined below) for or on behalf of the Client pursuant to the Agreement (b) and the Data Protection Laws apply to such Client Personal Data. By using our Services in any way, you are agreeing to the terms of this DPA.
1.3 MyListing Club, while having access to certain aspects of Client websites, has intentions to only be a reseller of Kinsta Inc.’s passive-hosting platform and services. To that end, there are aspects, such as sub-processors that apply to Kinsta, rather than MyListing Club.
2.1 “Controller”, “Processor”, “Data Subject”, “Processing”, “Personal Data”, and “Personal Data Breach” shall have the meanings ascribed to them in Data Protection Laws.
2.2 “Client Personal Data” means any Personal Data subject to the Data Protection Laws that Client provides, transfers, or makes accessible to MyListing Club in connection with the Services.
2.3 “Data Protection Laws” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and any similar or related implementing legislation by European Union or European Economic Area member states, the United Kingdom, or Switzerland.
3. Roles of the Parties
3.1 Client is the Controller and MyListing Club is the Processor with respect to Client Personal Data. MyListing Club shall only Process Client Personal Data
in accordance with Client’s documented instructions, which include the provisions of the Agreement unless otherwise required to comply with any Data Protection Laws. We will inform you if, in our opinion, your instructions violate the Data Protection Laws.
3.2 Client and MyListing Club shall comply with the Data Protection Laws. Client shall obtain any required authorizations, consents, releases, or permissions, and provide all required privacy notices, regarding the Client Personal Data. For the avoidance of doubt, Client shall have sole responsibility for the accuracy, quality, and legality of all Client Personal Data and the bases on which it is collected from the Data Subject.
4. Nature, Purpose, and Duration of Processing
4.1 MyListing Club will Process Client Personal Data as necessary to perform the Services – which is generally limited to passive hosting of Client websites – or to protect MyListing Club’s legal rights, for the duration of the Agreement, unless otherwise agreed upon in writing. The client’s transfer of Client Personal Data to MyListing Club in connection with the Services is determined and controlled by the Client in its sole discretion.
4.2 MyListing Club may Process the following categories of Client Personal Data: any Personal Data collected, used, or otherwise Processed from End User Data Subjects in connection with Client Websites.
4.3 MyListing Club may Process Client Personal Data from the following categories of Data Subjects: End Users of Client Websites.
5. Cross-border Transfers
5.1 You choose the Google Cloud Platform data center(s) where your websites will be hosted. You acknowledge, agree, and understand that (a) all of your Client Personal Data will be automatically transferred and stored in the Google data center you choose, and (b) Client Personal Data may be transferred from the European Economic Area, the United Kingdom, or Switzerland to the country where the Google data center is located, depending on your choice.
5.2 Client also authorizes MyListing Club to transfer Client Personal Data to any jurisdiction outside the EEA for the purpose of providing the Services if either (a) an adequacy finding has been made under the Data Protection Laws that the relevant jurisdiction provides an adequate level of protection, or (b) other appropriate safeguards are in place, such as standard contractual clauses or Privacy Shield, as applicable.
6.1. MyListing Club engages third-party subcontractors that Process Client Personal Data (“Sub-processors”) for the purposes of providing the Services. A current list of Sub-processors is available below in Appendix A. Client authorizes MyListing Club to engage these Sub-processors for the purpose of providing the Services.
6.2 MyListing Club may update the list of Sub-processors in Appendix A from time to time, and such updates shall be the sole means of providing notice of Sub-processor changes to Client. The client is responsible for regularly checking and reviewing the list of Sub-processors in Appendix A.
7.1 MyListing Club shall ensure that its personnel is subject to binding obligations of confidentiality with respect to Client Personal Data.
7.2 Taking into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of Data Subjects, MyListing Club shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
8. Personal Data Breach
8.1 In the event of a discovered Personal Data Breach, MyListing Club shall provide prompt notice, via email, using the Client’s email address used to sign up for our hosting services.
8.2 Our notice shall include the following information to the extent it is reasonably available to MyListing Club at the time of the notice, and MyListing Club shall update its notice as additional information becomes reasonably available: (a) the dates and times of the Personal Data Breach; (b) the basic facts that underlie the discovery of the Personal Data Breach, or the decision to begin an investigation into a suspected Personal Data Breach, as applicable; (c) a description of the Client Personal Data involved in the Personal Data Breach, either specifically, or by reference to the data set(s), and (d) the measures planned or underway to remedy or mitigate the vulnerability giving rise to the Personal Data Breach.
9. Data Subject Requests
9.1 MyListing Club will promptly notify Client if we receive a request from a Data Subject to invoke their rights with respect to Client Personal Data unless otherwise prohibited by applicable law; and, except to the extent required by applicable law; we will not independently take any action in response to a request from a Data Subject without Client’s prior written instruction.
10. Deletion or Return of Client Personal Data
10.1 Clients are solely responsible for transferring out their data, if desired, prior to deletion by MyListing Club.
10.2 Upon proper termination of the Agreement and at the written direction of the Client, MyListing Club shall delete all Client Personal Data.
Customer Signature: __________________________________________
Print Name: __________________________________________
MyListing Club Signature: __________________________________________
Print Name: Ryan Logan
Date: August 10, 2020
- Kinsta: MyListing Club, while having access to certain aspects of Client websites, has intentions to only be a reseller of Kinsta Inc.’s passive-hosting platform and services.
- Google Cloud Platform: Google Cloud servers are used to host, secure, and store data related to Client Websites.
- Packet: Kinsta Inc., rather than MyListing Club, collects and analyzes logs – that is necessary for operating our infrastructure – for security reasons on Packet servers. MyListing Club simply has read-only access to this data, for management purposes.
- Intercom: Kinsta Inc., rather than MyListing Club, uses Intercom to communicate with our customers and provide them support.
- Tidio: Cloud-based chat widget provider used to communicate with our customers and provide them with support.
- SendGrid: Cloud-based SMTP provider used to send transactional and marketing emails.
- KeyCDN: Kinsta Inc., rather than MyListing Club, uses KeyCDN to power Kinsta CDN. If you enable Kinsta CDN on a website, the website’s static assets will be delivered by KeyCDN which will receive the IP addresses of website visitors.
- Slack: Kinsta Inc., rather than MyListing Club, uses Slack for internal communication and collaboration.
- Stripe: We use Stripe to process Client payments.
- PayPal: We use PayPal to process Client payments.