Data Processing Addendum
Unless otherwise defined herein, capitalized terms and expressions used in this Addendum shall have the following meaning:
- “CCPA” means the California Consumer Privacy Act of 2018.
- “Customer Personal Data” means any personal data or personal information of data subjects contained within the data provided to or accessed by XB Software by or on behalf of Customer or Customer end users in connection with the Services.
- “Global Data Protection Legislation” means the European Data Protection Legislation, CCPA, and LGPD as applicable to the processing of Customer Personal Data under the Agreement.
- “EEA” means the European Economic Area.
- “EU” means the European Union.
- “European Data Protection Legislation” means EU Directive 95/46/EC, as transposed into domestic legislation of each Member State and as amended, replaced or superseded from time to time, including by the GDPR and laws implementing or supplementing the GDPR.
- “GDPR” means EU General Data Protection Regulation 2016/679.
- “LGPD” means the Brazilian General Data Protection Law.
- “Standard Contractual Clauses” or “SCCs” mean the standard data protection clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, as described in Article 46 of the GDPR.
- “Services” means the services and/or products to be provided by XB Software to Customer under the Agreement.Agreement, including, but not limited to: registration, team members and projects management, and all other functionality available for using GanttPro.
- “Sub-processors” means any individual or entity (including any third party but excluding XB Software) appointed by or on behalf of XB Software to process Customer Personal Data in connection with the Agreement.
- The terms “personal data”, “data subject”, “processing”, “controller”, “processor” and “supervisory authority” as used in this Addendum have the meanings given in the GDPR. The terms “personal information”, “Business”, and “Service Provider” have the meanings set forth in the CCPA, and the terms “data importer” and “data exporter” have the meanings given in the Standard Contractual Clauses.
Processing of Data
- This Addendum only applies to the extent that we are processing Customer Personal Data on behalf of Customer. XB Software shall comply with European Data Protection Legislation, LGPD, or CCPA, if applicable to the processing of Customer Personal Data. XB Software will only process Customer Personal Data in accordance with Customer’s instructions. Parties acknowledge and agree that details of the processing are described in Appendix 1.
- Customer warrants to XB Software that If the European Data Protection Legislation applies to the processing of Customer Personal Data and Customer is a processor, Customer’s instructions and actions with respect to that Customer Personal Data, including its appointment of XB Software as another processor, have been authorized by controller.
Customer instructs XB Software to process Customer Personal Data only in accordance with applicable law: (a) to provide the Services; (b) as authorized by the Agreement, including this Addendum and its Appendices; and (c) as further documented in any other written instructions given by Customer and acknowledged in writing by XB Software as constituting instructions for purposes of this Addendum.
Customer instructs XB Software to delete all Customer Personal Data (including existing copies) from XB Software’s systems as required by and in accordance with applicable law as soon as reasonably practicable, unless applicable law prevents XB Software from deleting such data.
- XB Software will implement and maintain appropriate technical and organizational measures provided in Appendix 2 for protection of the security, confidentiality, and integrity of the Controller’s personal data. XB Software may update or modify the Security Measures from time to time provided that such updates and modifications do not materially decrease the overall security of the Services.
- XB Software has been certified according to ISO 27001.
XB Software shall take reasonable steps to ensure the reliability of any employee, agent, or contractor of any Contracted Processor who may have access to the Company Personal Data. XB Software will grant access to Customer Personal Data only to employees, contractors, and Sub-processors who need such access for the scope of their performance, and are subject to appropriate confidentiality arrangements.
Information Security Incidents
- XB Software will notify Customer without undue delay upon Processor becoming aware of a Information Security Incident affecting Company Personal Data. XB Software’s notification of or response to an Information Security Incident will not be construed as an acknowledgement by XB Software of any fault or liability with respect to the Information Security Incident. Customer is solely responsible for notification obligations related to Information Security Incident(s) any third parties under applicable law.
- XB Software will co-operate with Customer and take reasonable steps to identify the case of such Information Security Incident, minimize harm and prevent a recurrence.
Customer’s Security Responsibilities and Assessment
- Customer agrees that XB Software is under no obligation to protect Customer Personal Data that Customer chooses to store or transfer outside of XB Software's systems and its Sub-processors. Customer is fully responsible for proper use of the Services, including making appropriate use of the Services to ensure a level of security appropriate to the risk in respect of Customer Personal Data; securing the account authentication credentials, systems, and devices Customer uses to access the Services; and securing Customer’s systems and devices XB Software uses to provide the Services; and backing up its Customer Personal Data. At the same time, this Section does not exclude XB Software's obligations under Section 5 (Security) and Section 7 (Information Security Incidents).
- Customer bears sole responsibility for reviewing the Security Documentation and assessing for itself whether the Services, Security Measures and obligations of the XB Software will meet Customer's needs, including with respect to any Customer security obligations under applicable Global Data Protection Laws. Accordingly, Customer acknowledges and agrees that the Security Measures implemented and maintained by XB Software provide a level of security consistent with the risk in relation to Customer's Personal Data.
Data Protection Impact Assessment and Prior Consultation
XB Software will reasonably assist Customer in complying with its obligations in respect of data protection impact assessments and prior consultation, including, if applicable, Customer’s obligations pursuant to Articles 35 and 36 of the GDPR, or equivalent provisions of any other Data Protection Law, in each case solely in relation to Processing of Company Personal Data by, and taking into account the nature of the Processing and available information.
- Customer may audit XB Software’s compliance with its obligations under this Addendum. XB Software will contribute to such audits by providing Customer or Customer’s supervisory authority with the information and assistance reasonably necessary to conduct the audit, including any relevant records of processing activities applicable to the Services.
- Customer pays for all audits and must reimburse XB Software for all audit time at XB Software's current professional services rates. When requesting an audit, Customer must submit to XB Software a detailed proposed audit plan with a specified audit date no earlier than two weeks later. Information and audit rights of Customer only arise this Section to the extent that the Addendum does not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Law.
Data Subject Rights
- Taking into account the nature of the processing, XB Software may assist Customer by implementing appropriate technical and organizational measures, insofar as this is possible and reasonable, for the fulfilment of Customer obligations, as reasonably understood by Customer, to respond to requests to exercise Data Subject rights under the Data Protection Laws.
- XB Software will, at its sole discretion, notify Customer if it receives a request from a Data Subject under any Data Protection Law in respect of Customer Personal Data; or advise the data subject to submit his or her request to Customer, and/or notify the data subject that his or her request has been forwarded to Customer.
Data Storage and Data Transfer
- Customer agrees that XB Software may store and process personal data in any country in which the XB Software or any of its sub-processors maintains facilities.
- For transfers of personal data under this Addendum from the European Union, the European Economic Area and/or their member states and Switzerland to other countries Parties agree to enter into Standard Contract Clauses which are attached hereto as Appendix 3. At the Addendum Effective Date, Customer hereby authorizes the transfer of personal data and provides consent that the following data processing activities specifically authorized by Customer and indicated in Appendix 1, will take place in the countries outside of the EEA and in strict compliance to the legal bases for data transfer.
- Customer acknowledges and agrees that XB Software may engage third-party sub-processors in connection with the provision of the Services. As a condition to permitting a third-party sub-processor to process personal data, XB Software will enter into a written agreement with each sub-processor containing data protection obligations that provide at least the same level of protection for personal data as those in this Addendum. In either case, Customer agrees to enter into the Standard Contractual Clauses where necessary acknowledging that sub-processors may be appointed by XB Software in accordance with Clause 11 of Standard Contractual Clauses.
- A current list of sub-processors is accessible by the following link: https://ganttpro.com/sub-processors/ (list may be updated by XB Software from time to time in accordance with this Addendum).
- Customer may reasonably object to XB Software using a new sub-processor by notifying XB Software promptly in writing within five (5) days after receipt of XB Software’s notice about a new sub-processor. Such notice shall explain the reasonable grounds for the objection. In the event of Customer objects to a new Sub-processor, Customer and XB Software will work together in good faith to find a mutually acceptable resolution to address such objection. If the parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, either party may terminate Agreement by providing written notice.
Processing Records ana Analytics
GDPR requires XB Software to collect and record certain information, including the name and contact details of each processor and / or controller on whose behalf XB Software acts and provide such information to supervisory authorities. If the GDPR applies to the processing of Customer's Personal Data, Customer provides such information to XB Software upon request and guarantees that all provided information will be accurate and current. Customer acknowledges and agrees that XB Software may create and extract from the processing associated with the Services, anonymous and/or aggregated data that does not identify Customer or any individual, as well as use, publish or transfer such data to third parties to improve XB Software products and services and for other legitimate business purposes.
All notices and communications given under this Agreement may be given by XB Software to Customer via XB Software’s primary points of contact with Customer or sent by email provided by Customer for the purpose of providing it with Service-related communications or alerts. Customer is solely responsible for ensuring that such email addresses are valid.