Data Protection Addendum
LAST UPDATED – 29 JANUARY 2022
1. Introduction
1.1 This Data Protection Addendum (as updated from time to time) is incorporated into Pixie's Terms of Service (available at https://www.usepixie.com/terms). The Terms of Service and this Data Protection Addendum together form the 'Agreement'.
2. Definitions
2.1 In this Data Protection Addendum defined terms shall have the same meaning, and the same rules of interpretation shall apply as in the Terms of Service. In addition, in this Data Protection Addendum the following definitions have the meanings given below:
'Anonymous Data': means data (including Subscription Customer Data) that has been de-identified and/or aggregated with other data to such an extent that data subjects are no longer identified, identifiable or otherwise ascertainable by reference to or with the combination of other datasets;
'Applicable Law': applicable laws of the European Union ('EU'), the European Economic Area ('EEA') or any of the EU or EEA's member states from time to time together with applicable laws in the United Kingdom from time to time;
'Appropriate Safeguards': such legally enforceable mechanism(s) for transfers of Personal Data as may be permitted under Data Protection Laws from time to time;
'Authorised Users': means Subscription Customer's clients authorised by Subscription Customer to use the SAAS Solution in accordance with the terms of the Agreement;
'Business Contact Information': the names, mailing addresses, email addresses, and phone numbers regarding the other party's employees or consultants including such information regarding the other party's suppliers and customers, used as part of maintaining its business relationships.
'Business Day': means a day other than a Saturday, Sunday or bank or public holiday in England;
'Controller': has the meaning given to that term in Data Protection Laws;
'CRM Information': the names, mailing addresses, email addresses, and phone numbers of Authorised Users used as part of on-going customer relationship management;
'Data Protection Laws': as applicable and binding on Subscription Customer, Pixie and/or the SAAS Solution provided under the Agreement:
(a) in the United Kingdom:
(i) the Data Protection Act 2018; and
(ii) the GDPR, and/or any corresponding or equivalent national laws or regulations;
(b) in member states of the EU and/or EEA: the GDPR and all relevant EU and EEA member state laws or regulations giving effect to or corresponding with any of the GDPR; and
(c) any Applicable Laws replacing, amending, extending, re-enacting or consolidating any of the above Data Protection Laws from time to time;
'Data Protection Losses': all liabilities, including all:
(a) costs (including legal costs), claims, demands, actions, settlements, interest, charges, procedures, expenses, losses and damages (including relating to material or non-material damage); and
(b) to the extent permitted by Applicable Law:
(i) administrative fines, penalties, sanctions, liabilities or other remedies imposed by a Supervisory Authority;
(ii) compensation which is ordered by a Supervisory Authority to be paid to a Data Subject; and
(iii) the reasonable costs of compliance with investigations by a Supervisory Authority;
'Data Subject': has the meaning given to that term in Data Protection Laws;
'Data Subject Request': a request made by a Data Subject to exercise any rights of Data Subjects under Data Protection Laws;
'GDPR': the General Data Protection Regulation, Regulation (EU) 2016/679;
'International Organisation': an organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;
'International Recipient': (a) any countries outside the United Kingdom ('UK') and/or the European Economic Area ('EEA'); or (b) any International Organisation(s);
'Pixie': means UsePixie Software UK Limited, a company incorporated in England and Wales whose registered number is 13062857 and whose registered office is at 4th Floor, 86-90 Paul Street, London EC2A 4NE, United Kingdom;
'Personal Data': has the meaning given to that term in Data Protection Laws;
'Personal Data Breach': any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, any Protected Data;
'processing': has the meanings given to that term in Data Protection Laws (and related terms such as 'process' have corresponding meanings);
'Processing Instructions': has the meaning given to that term in paragraph 5.1(a);
'Processor': has the meaning given to that term in Data Protection Laws;
'Protected Data': Personal Data provided to Pixie by Subscription Customer or otherwise obtained by Pixie through the SAAS Solution;
'SAAS Solution': Pixie's cloud-hosted practice management software platform solution known as 'Pixie';
'Sub-Processor': another Processor engaged by Pixie for carrying out processing activities in respect of the Protected Data on behalf of Subscription Customer;
'Subscription Customer': means the entity named in the order placed with Pixie;
'Subscription Customer Data': means all data (in any form) that is provided to Pixie or uploaded or hosted on any part of the SAAS Solution by Subscription Customer or an Authorised User (but excluding feedback relating to the SAAS Solution); and
'Supervisory Authority': any local, national or multinational agency, department, official, parliament, public or statutory person or any government or professional body, regulatory or supervisory authority, board or other body responsible for administering Data Protection Laws.
3. Processor and Controller
3.1 The parties agree that:
(a) for the Protected Data, Subscription Customer shall be the Controller and Pixie shall be the Processor. Nothing in this Agreement relieves SubscriptionCustomer of any responsibilities or liabilities under any Data Protection Laws;
(b) for the Protected Data that is renderedAnonymous Data by Pixie, Pixie shall be the Controller in respect of any anonymisation processing activity and shall comply with the applicable Data Protection Laws;
(c) in respect of data obtained through the SAAS Solution for the purpose of security checks conducted by Pixie in relation to services provided under the Agreement (or any other personal data where Pixie exercises overall control over the purposes and means of the processing), Pixie shall be the Controller and shall comply with the applicable Data Protection Laws;
(d) in respect of CRM Information and Subscription Customer Data, Pixie shall be the Processor; and
(e) for the Business Contact Information, each party shall be the Controller of the other party's Business Contact Information and may use the other party's Business Contact Information for contract management, payment processing, service offering, and business development purposes related to the Agreement and such other purposes as set out in the using party's privacy policy (copies of which shall be made available upon request).
3.2 To the extent Subscription Customer is not sole Controller of any Protected Data it warrants that it has full authority and authorisation of all relevant Controllers to instruct Pixie to process the Protected Data in accordance with the Agreement.
3.3 Pixie shall process Protected Data in compliance with:
(a) the obligations of Processors under Data Protection Laws in respect of the performance of its obligations under the Agreement; and
(b) the Agreement.
4. Fair processing notices
4.1 In connection with the processing of Personal Data of or provided by Authorised Users, Subscription Customer shall be fully responsible for:
(a) the form, content, publishing and maintenance of all fair processing and other information notices required by Data Protection Laws;
(b) ensuring all Data Subjects understand Subscription Customer's fair processing notice;
(c) disclosing in its fair processing notice that Subscription Customer will share Protected Data with Pixie;
(d) the collection and maintenance of all necessary consents required by Data Protection Laws from such Data Subjects; and
(e) ensuring that the processing of Protected Data is lawful, fair and transparent and that lawful grounds exist for all processing activities in respect of the Protected Data which may be undertaken by Pixie and its Sub-Processors in accordance with the Agreement.
5. Instructions and details of processing
5.1 Insofar as Pixie processes Protected Data on behalf of Subscription Customer, Pixie:
(a) unless required to do otherwise by Applicable Law, shall (and shall take steps to ensure each person acting under its authority shall) process the Protected Data only on and in accordance with Subscription Customer's documented instructions as set out in this paragraph 5.1 and paragraphs 5.2 and 5.3 (including when making a transfer of Protected Data to any International Recipient), as updated from time to time ('Processing Instructions');
(b) if Applicable Law requires it to process Protected Data other than in accordance with the Processing Instructions, shall notify Subscription Customer of any such requirement before processing the Protected Data (unless Applicable Law prohibits such information on important grounds of public interest); and
(c) shall promptly inform Subscription Customer if Pixie becomes aware of a Processing Instruction that, in Pixie's opinion, infringes Data Protection Laws, provided that to the maximum extent permitted by mandatory law, Pixie shall have no liability howsoever arising (whether in contract, tort (including negligence) or otherwise) for any losses, costs, expenses or liabilities (including any Data Protection Losses) arising from orin connection with any processing in accordance with Subscription Customer's Processing Instructions following Subscription Customer's receipt of that information.
5.2 Subscription Customer acknowledges and agrees that the execution of any computer command to process (including deletion of) any Protected Data made in the use of the SAAS Solution by an Authorised User will be a Processing Instruction (other than to the extent such command is not fulfilled due to technical, operational or other reasons). Subscription Customer shall ensure that Authorised Users do not execute any such command unless authorised by Subscription Customer (and by all other relevant Controller(s)) and acknowledge that if any Protected Data is deleted pursuant to any such command Pixie is under no obligation to seek to restore it.
5.3 The processing of the Protected Data by Pixie under the Agreement shall be for the subject-matter, duration, nature and purposes and involve the types of Personal Data and categories of Data Subjects set out in Appendix 1.
6. Technical and organisational measures
6.1 Taking into account the nature of the processing, Pixie shall implement and maintain, at its cost and expense, the technical and organisational measures:
(a) in relation to the processing of Protected Data by Pixie; and
(b) to assist Subscription Customer insofar as is possible in the fulfilment of Subscription Customer's obligations to respond to Data Subject Requests relating to Protected Data, in each case at Subscription Customer's cost on a time and materials basis in accordance with Pixie's standard pricing terms, as notified to Subscription Customer by Pixie from time-to-time.
7. Using staff and other processors
7.1 Permitted Use
Subscription Customer grants to Pixie a general authorisation to sub-contract the processing of Protected Data to Sub-Processors, provided that Pixie shall:
(a) engage Sub-Processors under a written (including in electronic form) contract consistent with the terms of this Data ProtectionAddendum in relation to the Sub-Processor's processing of Protected Data. Pixie shall be liable for any breaches by the Sub-Processor in accordance with the terms of the Agreement;
(b) evaluate the security, privacy and confidentiality practices of a Sub-Processor prior to selection to establish that it is capable of providing the level of protection of Protected Data as required by this Data Protection Addendum; and
(c) make available to Subscription Customer upon request a list of Sub-Processors used to process Protected Data under thisAgreement, including in the delivery of the SAAS Solution, and such list shall include the name, address and role of each Sub-Processor.
7.2 New Sub-Processors
Pixie's use of Sub-Processors is in its discretion, provided that:
(a) Pixie shall give Subscription Customer advance notice (which may be by email to the email address associated with SubscriptionCustomer's user account) of any intended additions or replacements to Pixie's current list of Sub-Processors, and such notice shall include the name, address and role of the new Sub-Processor; and
(b) Subscription Customer has the right to object to the changes in clause 7.2(a), in accordance with clause 7.3.
7.3 Objections to new Sub-Processors
(a) If Subscription Customer has a reasonable and legitimate reason under Data Protection Laws to object to the new Sub-Processor's processing of Protected Data, Subscription Customer may terminate the Agreement on written notice to Pixie. Such termination shall take effect at the time determined by Subscription Customer which shall be no later than 30 days from the date of Pixie's notice to Subscription Customer informing Subscription Customer of the new Sub-Processor. If Subscription Customer does not terminate the Agreement within that 30-day period, Subscription Customer is deemed to have accepted the new Sub-Processor.
(b) Subscription Customer may, after receiving notice from Pixie in accordance clause 7.3(a) above and acting reasonably, raise an objection to the proposed new Sub-Processor and request that Subscription Customer and Pixie negotiate in good faith a resolution to any such objection. Any negotiations under this clause 7.3(b) shall not extend the period for termination under clause 7.3(a) and nor shall it prejudice Pixie's rights to use the new Sub-Processor after the notice period expires in accordance with clause 7.3(a).
(c) Any termination under this clause 7.3 shall be deemed to be termination without fault by either Pixie or Subscription Customer and shall be subject to the terms of the Agreement.
7.4 Emergency Replacement
Pixie may, in its sole discretion, replace a Sub-Processor without advance notice where the reason for the change is outside of Pixie's reasonable control and prompt replacement is required for security or other urgent reasons. In this case, Pixie shall inform Subscription Customer of the replacement Sub-Processor as soon as practicable following such appointment. Clause 7.2 applies accordingly.
8. Assistance with compliance and Data Subject rights
8.1 Pixie shall refer all Data Subject Requests it receives to Subscription Customer without undue delay. Subscription Customer shall pay Pixie for all work, time, costs and expenses incurred in connection with such activity, calculated on a time and materials basis at Pixie's rates set out in Pixie's standard pricing terms, as notified to Subscription Customer by Pixie from time-to-time.
8.2 Pixie shall provide such reasonable assistance as Subscription Customer reasonably requires (taking into account the nature of processing and the information available to Pixie) to Subscription Customer in ensuring compliance with Subscription Customer's obligations under DataProtection Laws with respect to:
(a) security of processing;
(b) data protection impact assessments (as such term is defined in Data Protection Laws);
(c) prior consultation with a Supervisory Authority regarding high risk processing; and
(d) notifications to the Supervisory Authority and/or communications to Data Subjects by Subscription Customer in response to any Personal Data Breach, provided Subscription Customer shall pay Pixie for all work, time, costs and expenses incurred in connection with providing the assistance in this paragraph 8.2, calculated on a time and materials basis at Pixie's rates set out in Pixie's standard pricing terms, as notified to Subscription Customer by Pixie from time-to-time.
9. International data transfers
9.1 Subject to paragraph 9.2, Pixie shall not transfer, or otherwise directly or indirectly disclose, any Protected Data to any International Recipient without the prior written consent of Subscription Customer except where Pixie is required to transfer the Protected Data by Applicable Law (and shall inform Subscription Customer of that legal requirement before the transfer, unless those laws prevent it doing so).
9.2 Subscription Customer agrees that Pixie may transfer any Protected Data for the purposes referred to in paragraph 5.3 to any International Recipient, provided all transfers by Pixie of Protected Data to an International Recipient (and any onward transfer) shall (to the extent required under Data Protection Laws) be effected by way of Appropriate Safeguards and in accordance with Data Protection Laws. The provisions of the Agreement shall constitute Subscription Customer's instructions with respect to transfers in accordance with paragraph 5.1(a).
9.3 Subscription Customer acknowledges that due to the nature of cloud services, the Protected Data may also be transferred to other geographical locations in connection with use of the SAAS Solution further to access and/or computerised instructions initiated by Authorised Users. Subscription Customer acknowledges that Pixie does not control such processing and Subscription Customer shall ensure that Authorised Users (and all others acting on its behalf) only initiate the transfer of Protected Data to other geographical locations if Appropriate Safeguards are in place and that such transfer is in compliance with all Applicable Laws.
10. Information and audit
10.1 Pixie shall maintain, in accordance with Data Protection Laws binding on Pixie, written records of all categories of processing activities carried out on behalf of Subscription Customer.
10.2 Subscription Customer may by written notice to Pixie request information regarding Pixie's compliance with the obligations placed on it under this Data Protection Addendum. On receipt of such request Pixie shall provide Subscription Customer (or auditors mandated by Subscription Customer) with a copy of the latest third-party certifications and audits to the extent made generally available to its customers. Such copies are confidential to Pixie and shall be Pixie's Confidential Information for the purposes of the Agreement.
10.3 Pixie shall, on request by Subscription Customer, in accordance with Data Protection Laws, make available to Subscription Customer such information as is reasonably necessary to demonstrate Pixie's compliance with its obligations under this Data Protection Addendum and Article 28 of the GDPR (and under any Data Protection Laws equivalent to that Article 28), and allow for and contribute to audits, including inspections, by Subscription Customer (or another auditor mandated by Subscription Customer) for this purpose provided:
(a) such audit, inspection or information request is reasonable, limited to information in Pixie's (or any Sub-Processor's) possession or control and is subject to Subscription Customer giving Pixie reasonable prior notice of such audit, inspection or information request;
(b) the parties (each acting reasonably and consent not to be unreasonably withheld or delayed) shall agree the timing, scope and duration of the audit, inspection or information release together with any specific policies or other steps with which Subscription Customer or third party auditor shall comply (including to protect the security and confidentiality of other customers, to ensure Pixie is not placed in breach of any other arrangement with any other customer and so as to comply with the remainder of this paragraph 10.3);
(c) all costs of such audit or inspection or responding to such information request shall be borne by Subscription Customer, and Pixie's costs, expenses, work and time incurred in connection with such audit or inspection shall be reimbursed by Subscription Customer on a time and materials basis in accordance with Pixie's standard pricing terms, as notified to Subscription Customer by Pixie from time-to-time;
(d) Subscription Customer's rights under this paragraph 10.3 may only be exercised once in any consecutive 12-month period, unless otherwise required by a Supervisory Authority or if Subscription Customer (acting reasonably) believes Pixie is in breach of this Data Protection Addendum;
(e) Subscription Customer shall promptly (and in any event within three Business Days) report any non-compliance identified by the audit, inspection or release of information to Pixie;
(f) Subscription Customer shall ensure that all information obtained or generated by Subscription Customer or its auditor(s) in connection with such information requests, inspections and audits is kept strictly confidential (save for disclosure required by Applicable Law);
(g) Subscription Customer shall ensure that any such audit or inspection is undertaken during normal business hours, with minimal disruption to the businesses of Pixie and each Sub-Processor; and
(h) Subscription Customer shall ensure that each person acting on its behalf in connection with such audit or inspection(including the personnel of any third-party auditor) shall not by any act or omission cause or contribute to any damage, destruction, loss or corruption of or to any systems, equipment or data in the control or possession of Pixie or any Sub-Processor whilst conducting any such audit or inspection.
11. Breach notification
11.1 In respect of any Personal Data Breach involving Protected Data, Pixie shall, without undue delay:
(a) notify Subscription Customer of the Personal Data Breach; and
(b) provide Subscription Customer with details of the Personal Data Breach.
12. Deletion of Protected Data and copies
Following the termination of the Agreement, Pixie shall dispose of Protected Data in accordance with its obligations under the Agreement. Pixie shall have no liability (howsoever arising, including in negligence) for any deletion or destruction of any suchProtected Data undertaken in accordance with the Agreement.
13. Compensation and claims
13.1 Subject to clause 8 of the Terms of Service, Pixie shall be liable for Data Protection Losses (howsoever arising, whether in contract, tort (including negligence) or otherwise) under or in connection with the Agreement:
(a) only to the extent caused by the processing of Protected Data under the Agreement and directly resulting from Pixie's breach of the Agreement; and
(b) in no circumstances to the extent that any Data Protection Losses (or the circumstances giving rise to them) are contributed toor caused by any breach of the Agreement by Subscription Customer (including in accordance with paragraph 4.1(c)).
13.2 If a party receives a compensation claim from a person relating to processing of Protected Data in connection with theAgreement or the SAAS Solution, it shall promptly provide the other party with notice and full details of such claim. The party with conduct of the action shall:
(a) make no admission of liability nor agree to any settlement or compromise of the relevant claim without the prior written consent of the other party (which shall not be unreasonably withheld or delayed); and
(b) consult fully with the other party in relation to any such action but the terms of any settlement or compromise of the claim will be exclusively the decision of the party that is responsible under the Agreement for paying the compensation.
13.3 The parties agree that Subscription Customer shall not be entitled to claim back from Pixie any part of any compensation paid by Subscription Customer in respect of such damage to the extent that Subscription Customer is liable to indemnify or otherwise compensate Pixie in accordance with the Agreement.
13.4 This paragraph 13 is intended to apply to the allocation of liability for Data Protection Losses as between the parties, including with respect to compensation to Data Subjects, notwithstanding any provisions under Data Protection Laws to the contrary, except:
(a) to the extent not permitted by Applicable Law (including Data Protection Laws); and
(b) that it does not affect the liability of either party to any Data Subject.
14. Subscription Customer's obligations
14.1 Subscription Customer shall ensure that it, its group companies and each Authorised User shall at all times comply with:
(a) all Data Protection Laws in connection with the processing of Protected Data, the use of the SAAS Solution and the exercise and performance of its respective rights and obligations under the Agreement, including maintaining all relevant regulatory registrations and notifications as required under Data Protection Laws; and
(b) the terms of the Agreement.
14.2 Subscription Customer warrants, represents and undertakes, that at all times:
(a) all Protected Data (if processed in accordance with the Agreement) shall comply in all respects, including in terms of its collection, storage and processing, with Data Protection Laws;
(b) the Protected Data is accurate and up to date;
(c) it shall establish and maintain adequatesecurity measures to safeguard Protected Data in its possession or control fromunauthorised access and copying and maintain complete and accurate backups ofall Protected Data provided to Pixie (or anyone acting on its behalf) so as teable to immediately recover and reconstitute such Protected Data in theevent of loss, damage or corruption of such Protected Data by Pixie or anyother person; and
(d) all instructions given by it to Pixie in respect of Personal Data shall at all times be in accordance with Data Protection Laws.
15. Survival
This Data Protection Addendum (as updated from time to time) shall survive termination (for any reason) or expiry of the Agreement and continue until no Protected Data remains in the possession or control of Pixie or any Sub-Processor, except that paragraphs 12to 15 (inclusive) shall continue indefinitely.
Appendix 1
Data processing details
Subject-matter of processing:
· Delivery of the SAAS Solution to Subscription Customer and Authorised Users.
Duration of the processing:
· For as long as the Protected Data is required for log-in purposes or until termination of the Agreement.
Nature and purpose of the processing:
· Processing as is reasonably necessary for performance of Pixie's obligations under the Agreement, particularly to provide the services associated with the SAAS Solution.
Type of Personal Data:
· Names
· Addresses
· Email addresses
· IP address
· Location data
Categories of Data Subjects:
· User data in respect of Subscription Customer
· User data in respect of Authorised Users
· Data uploaded to the SAAS Solution during ordinary use by Subscription Customer and/or Authorised Users
Special categories of Personal Data:
· Not applicable.
Location of processing:
· UK
· USA
· EEA