‍

Data Processing Agreement

Processing of Personal Data

‍

Introduction

This Data Processing Agreement forms an integral part of the Master Agreement between Apostle Technologies B.V. (“Apostle” or the “Processor”) and the natural or legal person with whom Apostle enters into an agreement for the use of the Apostle Software (the “Customer” or the “Controller”). Apostle and the Customer are hereinafter jointly referred to as the “Parties”.

Apostle processes Personal Data on behalf of the Customer to the extent necessary for the performance of the Master Agreement.

By means of this Data Processing Agreement, the Parties set out their respective rights and obligations with regard to such Processing in accordance with the Applicable Privacy Legislation.

The Master Agreement and this Data Processing Agreement jointly determine the subject matter, duration, nature and purposes of the Processing of Personal Data.

‍

Article 1. Details of Processing

In this Data Processing Agreement, the following terms shall have the meanings set out below
‍

‍

Terms not defined in this Data Processing Agreement shall have the meaning assigned to them under the GDPR.

‍

Article 2. Applicability and Order of Precedence

1. This Data Processing Agreement applies to all Processing of Personal Data carried out by Apostle on behalf of the Customer.
2. In the event of any conflict, this Data Processing Agreement shall prevail with respect to matters relating to privacy, security and international data transfers.
3. The Master Agreement and this Data Processing Agreement jointly constitute the Customer’s documented instructions.
4. If amendments to the Applicable Privacy Legislation require modifications to this Data Processing Agreement, the Parties shall implement reasonable amendments accordingly.

‍

Article 3. Roles of the Parties

1. The Customer acts as the Controller; Apostle acts as the Processor.
2. The Customer determines the purposes and means of the Processing and is responsible for the legal bases for the Processing and for compliance with transparency obligations.
3. Apostle shall process Personal Data solely on the instructions of the Customer and in accordance with the Applicable Privacy Legislation.
4. Apostle shall not process Personal Data for its own independent purposes.
5. Apostle shall inform the Customer if an instruction appears to conflict with the Applicable Privacy Legislation.
6. Where applicable law requires Processing that deviates from the Customer’s instructions, Apostle shall inform the Customer thereof unless prohibited from doing so by law.

‍

Article 4. Subject Matter, Purpose and Duration of the Processing

1. Apostle shall process Personal Data solely for the provision, management, security, support and appropriate improvement of the Services.
2. Details of the Processing are set out in Schedule 1.
3. The Processing may include, among other things:
   • user management and authentication;
   • employee advocacy functionalities;
   • content distribution;
   • communication and engagement;
   • analytics and reporting;
   • support;
   • security, monitoring and logging;
   • hosting and backup.‍‍‍‍
4. Processing shall take place during the term of the Agreement and, where applicable, for a limited period thereafter for deletion, retention and compliance with statutory retention obligations.
5. Personal Data shall not be processed for incompatible purposes.

‍

Article 5. Customer Instructions

1. Apostle shall process Personal Data solely on documented instructions.
2. The Agreement and this Data Processing Agreement shall serve as the primary instructions.
3. Additional instructions shall only be followed if they are lawful, technically feasible and non-disruptive.
4. Additional work shall only be carried out following consultation and written agreement.
5. Unlawful or unreasonable instructions need not be complied with.
6. Personal Data shall not be processed for Apostle’s own purposes.
‍

Article 6. Apostle’s Obligations

1. Apostle shall treat Personal Data as confidential.
2. Only authorised personnel shall have access to Personal Data.
3. Personnel shall be bound by confidentiality obligations.
4. Apostle shall reasonably assist with:
   
   • Personal Data Breaches;
   • the rights of Data Subjects;
   • Data Protection Impact Assessments (DPIAs);
   • consultations with supervisory authorities.
5. Apostle shall maintain internal documentation where required.
6. Apostle shall not sell Personal Data.
7. Legally binding requests from government authorities shall be notified to the Customer where legally permitted.
8. Apostle shall make reasonable efforts to apply the principle of data minimisation.
9. Production data shall not be used in test or staging environments, except where appropriate safeguards are in place.
10. Paid pilots or trial periods conducted within the production environment shall not be regarded as test environments.
11. Apostle shall maintain personnel offboarding procedures.
12. The use of anonymised or aggregated data shall remain permitted.

‍

Article 7. Technical and Organisational Measures

1. Apostle shall implement appropriate technical and organisational measures (TOMs).
2. These shall include, among other things:
   
   • access security;
   • encryption;
   • logging;
   • patch management;
   • backup;
   • incident management;
   • role management.
3. Apostle maintains an information security management system certified in accordance with ISO/IEC 27001:2022, with a scope that at least supports the ISMS for the provision of the Services, including relevant software development, customer success, HR/finance processes and applicable AWS infrastructure, in accordance with the applicable Statement of Applicability.
4. This certification is subject to periodic and at least annual surveillance audits by an accredited certification body.
5. The existence of certifications or audits does not guarantee that Personal Data Breaches or security incidents cannot occur.
6. Relevant security information may be provided through documentation or the Trust Center.
7. Apostle may amend the Technical and Organisational Measures, provided that the level of protection is not materially reduced.
8. Additional security functionalities may be package-dependent without prejudice to basic obligations.
9. Further TOMs may be included in Schedule 3.

‍

Article 8. Subprocessors

1. Customer hereby grants Apostle general, prior authorisation to engage Subprocessors for processing activities that are reasonably necessary for hosting, infrastructure, support, communication, security, analytics or other supporting services in connection with the delivery of the Services.
2. When selecting Subprocessors, Apostle shall reasonably assess whether the relevant party offers appropriate safeguards with respect to security and data protection, taking into account the nature of the processing activities.
3. Apostle shall contractually impose data protection obligations on each Subprocessor which, to the extent relevant for the outsourced processing, are not materially less protective than the obligations under this Data Processing Agreement.
4. To the extent required under Applicable Privacy Legislation, Apostle shall remain responsible for compliance with the relevant obligations of engaged Subprocessors, without prejudice to the liability limitations in the Master Agreement.
5. An up-to-date list of Subprocessors shall be maintained via Schedule 2 and/or the Trust Center.
6. Where Apostle intends to add a new Subprocessor with a material impact on the processing of Personal Data, Apostle shall inform the Customer in advance.
7. The Customer may raise a written, substantiated objection within fourteen (14) calendar days on reasonable data protection grounds.
8. If no objection is received within this period, the Customer shall be deemed to have consented.
9. In the event of an objection, the Parties shall consult in good faith to explore reasonable alternatives, additional safeguards or mitigation.
10. If no reasonable alternative is available, the Parties shall consult on the conditions under which continuation of the relevant processing may be possible.
11. No separate objection mechanism shall apply for administrative, legal or non-material changes.

‍

Article 9. International Transfers

1. Processing shall, in principle, take place within the EEA.
2. Transfers outside the EEA shall only take place on a lawful transfer basis.
3. Transfers may be based on:
   
   • an adequacy decision;
   • Standard Contractual Clauses (SCCs);
   • other lawfully valid transfer mechanisms.
4. Applicable SCCs shall apply automatically where required.
5. Apostle shall apply reasonable additional measures to protect Personal Data where necessary.

‍

Article 10. Data Subject Rights

1. The Customer shall remain responsible for requests from Data Subjects.
2. Apostle shall reasonably assist with such requests.
3. Requests submitted directly to Apostle shall, in principle, be referred to the Customer.
4. Apostle shall not be obliged to independently decide on the substance of such requests.
5. Additional assistance beyond the regular functionalities may be provided at reasonable cost.

‍

Article 11. Personal Data Breaches

1. Apostle shall notify the Customer of a Personal Data Breach without undue delay and, where possible, within twenty-four (24) hours.
2. The notification shall include where available:
   
   • nature of the incident;
   • categories of Personal Data involved;
   • possible consequences;
   • measures taken;
   • contact point.
3. Information may be provided in phases.
4. Apostle shall use reasonable efforts for investigation, mitigation and assistance.
5. The Customer shall remain responsible for statutory notifications to supervisory authorities.
6. A notification shall not constitute an admission of liability.

‍

Article 12. Audits

1. Apostle shall provide information on reasonable request that is reasonably necessary to demonstrate compliance with this Data Processing Agreement.
2. Where available, this shall primarily be done through existing audit reports, certifications, security documentation, Trust Center information or comparable documentation.
3. Only if such information is reasonably insufficient and the Customer substantiates this, additional verification may be requested.
4. Any such audit shall be carried out by an independent auditor, under appropriate confidentiality and without unreasonable disruption to business operations.
5. Unless required by law, the Customer shall be entitled to a maximum of one audit per calendar year.
6. For requests that go beyond existing documentation, Apostle may charge reasonable costs.
7. On-site audits are a last resort and only permitted where verification is not reasonably possible by less intrusive means.
8. Audit rights do not include access to source code, data of other customers, unfiltered penetration test results or information that would undermine security.
9. Where existing certifications or independent audit reports reasonably cover the subject matter, these shall in principle constitute an adequate alternative.

‍

Article 13. Return and Deletion

1. Upon termination of the Agreement, Apostle shall delete, anonymise or archive Personal Data in accordance with Apostle’s applicable retention, archiving and backup periods, unless statutory retention obligations, security purposes, backup and disaster recovery purposes, dispute resolution or other legitimate operational purposes require longer retention. Customer environments may, following termination, be temporarily retained in archived form for operational, security, invoicing, dispute resolution or recovery purposes before permanent deletion takes place. Backups, snapshots and disaster recovery copies may temporarily continue to contain Personal Data in accordance with Apostle’s regular retention cycles. Such data shall not be actively processed and shall not be made available again within production environments, unless necessary for recovery purposes. If, in exceptional circumstances, a backup or snapshot is restored, it shall be verified that Customer Data previously deleted is not made actively available again within the production environment.
2. If the Customer timely requests the return of Personal Data, Apostle shall provide a standard export in a reasonably common format.
3. Any additional migration, mapping or export assistance may, following prior consultation, be provided at reasonable cost.
4. Appropriate security measures shall continue to apply to data that temporarily remains present in backup systems until deletion is effected through the regular retention cycles.
5. To the extent that data must be retained for a longer period pursuant to applicable legislation, such data shall be retained solely for that purpose.
6. Upon reasonable request, Apostle may confirm that deletion has taken place in accordance with this Article.

‍

Article 14. Customer Responsibilities

1. The Customer shall remain responsible for compliance with the Applicable Privacy Legislation.
2. The Customer shall ensure appropriate legal bases and transparency.
3. The Customer shall remain responsible for: the accuracy of the data; the instructions; the use of the Services; the configurations.
4. The Customer shall remain responsible for user management and offboarding, unless automatic deprovisioning has been explicitly agreed.
5. Customer-owned integrations and external tools shall remain the responsibility of the Customer.
6. No structural Processing of special categories of Personal Data shall take place unless explicitly agreed.
7. The Customer shall remain responsible for any Data Protection Impact Assessment (DPIA).

‍

Article 15. Notifications and Contact Persons

1. The Parties shall designate contact persons.
2. Notifications may be made by email or through agreed communication channels.
3. Notification to the designated contact person shall constitute notification to the Customer.
4. The Customer shall remain responsible for internal coordination between multiple contact persons.

‍

Article 16. Term and Termination

1. This Data Processing Agreement shall enter into force simultaneously with the Master Agreement.
2. This Data Processing Agreement shall automatically terminate when the Processing permanently ends.
3. Provisions which, by their nature, are intended to survive termination shall remain in force.
4. Amendments shall only be valid if made in writing, except where amendments are required by applicable law.

‍

Schedule 1. Details of the Processing

Subject Matter: Provision of employee advocacy software.

Purposes: Communication; distribution; employee advocacy; engagement; security; product support.

Processing Location: Personal Data shall, in principle, be processed within the European Economic Area (EEA), except where lawful international transfers apply.

‍

‍

Apostle may use anonymised Customer Data for analytical and statistical purposes in order to improve its Services.

‍

Schedule 2. Subprocessors

The following Subprocessors are engaged by Apostle. The current list is available at: https://trust.apostlesocial.com/subprocessors

‍

‍

Apostle may amend the list of Subprocessors at any time. The current list is available via the Apostle Trust Center. The Customer shall be notified in advance of any intended changes and shall have fourteen (14) days to raise reasonable objection.