DATA PROCESSING ADDENDUM
This Data Processing Addendum, including its Attachments, (“DPA”) is between Read AI, Inc. (“Read AI,” “Read,” or “Company”) and Enterprise Customer (“Customer,” or “you”) and is made part of the Read AI, Inc. Terms of Service, available at https://www.read.ai/termsofservice, as updated from time to time, or any other agreement about the delivery of the contracted services between Read and Customer (the “Agreement”). This DPA will be effective as of the date you agreed to the Agreement. This DPA will terminate automatically upon termination of the Agreement or as earlier terminated pursuant to the terms of this DPA. In the event of a conflict between the terms and conditions of this DPA, the Agreement, or any other documentation, the terms and conditions of this DPA govern and control with respect to the subject matter of Processing of Customer Personal Data (as those terms are defined below). Capitalized terms used but not defined in this DPA will have the meanings given in the Agreement.
1.1. Scope. This DPA applies where Company Processes Customer Personal Data as a Processor on behalf of Customer, the Controller, in connection with providing the Services. The parties agree that Read is the Processor of Customer Personal Data, except where Read acts as an independent Controller processing Customer Personal Data in accordance with Section 1.5 in connection with its own legitimate business operations.
1.2. Limitations on Use. In Company’s capacity as a Processor, Company will Process Customer Personal Data only: (a) pursuant to Customer’s documented Instructions as specified under Section 1.3 (Instructions), including with regard to transfers of Customer Personal Data to a third country; and (b) as otherwise required by applicable laws, provided that Company will inform Customer (unless prohibited by law) of the applicable legal requirement before such Processing. As a Processor, Company will not (except where otherwise instructed to do so by the Customer): (a) retain, use, or disclose the Customer Personal Data (i) outside of the direct business relationship between the parties or (ii) for any purpose other than for the specific purpose of performing the Services; (b) sell or share (as defined by Data Protection Law) the Customer Personal Data; or (c) combine Customer Personal Data with Personal Data Company receives from individuals or other sources, except as permitted by Data Protection Law.
1.3. Processor Instructions. Customer instructs Company to Process Customer Personal Data as necessary to provide the Services and as otherwise authorized or permitted under this DPA and the Agreement, including as specified in Attachment 2 (Scope of Processing). This DPA, the Agreement, and any instructions provided by Customer through configuration tools made available by Company are Customer’s documented instructions regarding Company’s Processing of Customer Personal Data (“Instructions”). Additional Instructions provided by Customer (if any) require prior written agreement by Customer and Company. Customer will not instruct Company to Process Customer Personal Data in violation of any Data Protection Law. Company may suspend Processing based upon any Customer Instructions that Company reasonably suspects violate Data Protection Law, provided Company will promptly inform Customer if Company believes an instruction infringes Data Protection Law.
1.4. Compliance. Each party will comply with its obligations under Data Protection Law. Company shall promptly notify Customer if it determines that it cannot meet its obligations under Data Protection Law. Upon receiving written notice from Customer that Company has Processed Customer Personal Data without authorization, Company will take reasonable and appropriate steps to stop and remediate such Processing.
1.5. Independent Controller Processing. Read may Process certain data (including Customer Personal Data and Service Data) for its own legitimate business purposes, as an independent Controller, solely when the Processing is strictly necessary and proportionate, and if the Processing is for one of the following purposes:
1.5.1. Customer Personal Data, including but not limited to name, user name, profile photo, email address, phone number, and postal address may be Processed for: (i) billing and account management, and related Customer correspondence; (ii) complying with and resolving legal obligations, including responding to Data Subject Requests (defined in Section 2.1) for Personal Data processed by Company as Controller, financial requirements, agreements, and disputes; (iii) abuse detection, prevention, and protection, virus scanning and scanning to detect violations of terms of service (such as copyright infringement, SPAM, and actions not permitted under Read's Terms of Service); (iv) improving and optimizing the performance and core functionalities of accessibility, privacy, security, and the IT infrastructure efficiency of the Services; (v) internal reporting, financial reporting, revenue planning, capacity planning, and forecast modeling (including product strategy); and (vi) receiving and using Feedback for Read's overall service improvement. For the avoidance of doubt, the company does not process the following categories of Customer Personal Data for the purposes of this Section 1.5.1: audio and video recordings, transcription content, the substance of communications or meeting content.
1.5.2. In addition, Service Data may be Processed for: (i) sales and marketing; (ii) performing data analytics; (iii) monitoring, improving, and supporting the Services; and (iv) designing, developing, and offering Read products and Services.
Except as permitted by Clause 1.7, when acting as an independent Controller, Company will not process Customer Personal Data for any purposes other than the above list of legitimate business purposes.
1.6. Company will not Process Customer Personal Data for third-party advertising, direct marketing, profiling, research or analytics purposes except where such processing is (i) necessary to comply with Customer's Instructions as set out this DPA, or (ii) for the legitimate business purposes described in Section 1.5 or (iii) part of Company’s free Services or individual (i.e., non-enterprise) Services.
1.7. Company shall only process Customer Personal Data for the purposes specified in this DPA; provided, however, Company may process Customer Personal Data and Service Data for “further” or “compatible” purposes (within the meaning of Articles 5(1)(b) and 6(4) GDPR, where applicable), to the extent it is acting as an independent Controller as set out in Sections 1.5.1 and 1.5.2, or seek consent from end users for new types of data processing, where permitted by the Read account administrator and Data Protection Law.
1.8. Confidentiality. Company will ensure that persons authorized by Company to Process any Customer Personal Data are subject to appropriate confidentiality obligations.
1.9. Security. Regardless of its role as a Processor or independent Controller, Company will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against Security Incidents and provide the level of protection required by Data Protection Law in accordance with Attachment 4 (Data Security Exhibit). Company may amend the technical and organizational measures, provided the new measures do not materially reduce the level of security provided by Attachment 4 (Data Security Exhibit).
1.10. Disposal. In its capacity as a Processor, at the choice of Customer, Company will (or will enable Customer via the Services to) delete (and will delete existing copies of) all Customer Personal Data after termination of the Agreement (unless Data Protection Law requires the storage of such Customer Personal Data by Company, in which case Company will only further retain and Process such Customer Personal Data for the limited duration and purposes required by such Data Protection Law). The certification of deletion contemplated by Section 8.5 of the SCCs shall be provided on Customers’ written request.
1.11. Deidentified Data. In Company’s capacity as a Processor, Customer authorizes Company to Process Deidentified Data to provide and improve the Services. Company will (a) take reasonable measures to ensure the Deidentified Data cannot be associated with a Data Subject and (b) publicly commit to maintain and use Deidentified Data in deidentified form and not attempt to reidentify Deidentified Data except as permitted by Data Protection Law.
To the extent Company acts as a Processor:
2.1. Data Subject Rights Assistance. Customer shall be responsible for responding to requests from individuals to exercise rights under Data Protection Law relating to Customer Personal Data (each a “Data Subject Request”). Customer will inform Company of any Data Subject Request to which Company must comply and provide the information necessary for Company to comply with the request. Company will, to the extent permitted by Data Protection Law, notify Customer if Company receives a Data Subject Request. To the extent Customer, in its use of the Services, does not have the ability to address the Data Subject Request, Company will, on Customer’s request, use commercially reasonable assistance to Customer in responding to such Data Subject Request, to the extent the response to such Data Subject Request is required under Data Protection Law.
2.2. Security Assistance. Taking into account the nature of Processing and the information available to Company, Company will provide commercially reasonable efforts to assist Customer in Customer’s efforts to comply with Customer’s obligations to secure Customer Personal Data by providing the information and assistance described in Section 3 (Audits).
2.3. Security Incident Notice and Assistance. Company will notify Customer without undue delay after becoming aware of a Security Incident. Company will further take commercially reasonable steps to mitigate the effects and minimize any impact from the Security Incident and assist Customer in complying with any related notification obligations under Data Protection Law.
2.4. The obligations described in Section 2.3 shall not apply if a Security Incident results from the actions or omissions of Customer, except where required by Data Protection Law. Company’s obligation to report or respond to a Security Incident under Section 2.3 will not be construed as an acknowledgement by Company of any fault or liability with respect to the Security Incident.
2.5. Notification to Read. If Customer determines to notify any governmental entity, Data Subject(s), the public, or others of a Security Incident, to the extent such notice directly or indirectly refers to or identifies Read, where permitted by applicable laws, Customer will notify Read in writing in advance of such notice and will, in good faith, consult with Read and consider any clarifications or corrections Read may reasonably recommend or request to any such notification that relates to Read’s involvement in or relevance to such Security Incident and is consistent with applicable laws.
2.6. Data Protection Impact Assessment (“DPIA”) and Prior Consultation Assistance. Taking into account the nature of Processing and the information available to Company, Company will provide commercially reasonable assistance to Customer in ensuring compliance with the obligations related to DPIAs and consulting with regulatory authorities.
To the extent Company acts as a Processor:
3.1. Company Audits. Company may procure audits by third parties to assess Company’s adherence to the following standards or requirements: (a) SOC 2 Type II; (b) ISO 27001; (c) PCI DSS Service Provider Level 1; and/or (d) certifications or other documentation evidencing compliance with alternative standards that are substantially equivalent to the foregoing (collectively, “Audits”). Subject to the confidentiality obligations set forth in the Agreement, Company will provide Customer with summaries of Company’s then-current Audit reports (“Reports”) on Customer’s request. If the Agreement does not include a provision protecting Company’s confidential information, then the Reports will be made available to Customer subject to a mutually agreed upon non-disclosure agreement covering the Reports.
3.2 Customer Audits. Customer agrees to exercise its audit rights by first requesting the Reports as described in Section 3.1 (Company Reports). Customer will only request additional information or an on-site audit of Company to the extent the information provided by Company is not reasonably sufficient to enable Customer to evaluate Company’s compliance with this DPA and/or Data Protection Law. Except in the event of a Security Incident or regulatory investigation, Customer will provide no less than 30 days' advance notice of its request for an on-site audit and will cooperate in good faith with Company to schedule any such audit on a mutually agreeable date and time. Any such on-site audit must occur during Company’s normal business hours and be conducted by Customer or a nationally recognized independent auditor that has agreed to confidentiality provisions reasonably acceptable to Company. Customer is responsible for ensuring that the audit will comply with Company’s applicable on-site policies and procedures and will not unreasonably interfere with Company’s business activities. Customer will provide a written summary of any audit findings to Company, and the results of the audit will be the confidential information of Company.
To the extent Company acts as a Processor:
4.1. Appointment of Subprocessors. Customer authorizes Company to use subcontractors to Process Customer Personal Data in connection with providing the Services (each, a “Subprocessor”). Customer specifically consents to Company’s appointment of the Subprocessors listed at https://trust.read.ai/subprocessors (the “Subprocessor List”).
4.2. Objection Right for New Subprocessors.
4.2.1. Company will notify Customer of its intent to update the Subprocessor List at least 15 days prior to engaging a new Subprocessor. Customer may object to Company’s use of a new Subprocessor within 10 days of receiving such notice by sending an e-mail to privacy@read.ai clearly indicating its desire to object to any such change.
4.2.2. If Customer objects to the change in Subprocessors, Company and Customer will cooperate in good faith to resolve Customer’s objection. If the parties are unable to resolve Customer’s objection within 10 days, then either party may terminate the Agreement only with respect to those Services that Company indicates cannot be provided without the objected-to Subprocessor.
4.3. Liability. Company will impose data protection obligations upon any Subprocessor that are no less protective of Customer Personal Data than those included in this DPA. Company will be liable to Customer for any breach of such obligations by its Subprocessors as it would for its own acts and omissions.
To the extent Company acts as a Processor:
5.1. Overview. The parties will conduct any transfers of European Economic Area, UK, and Swiss residents’ Customer Personal Data to a country not subject to an adequacy decision (a “Data Transfer”) pursuant to the SCCs, which are incorporated and deemed executed by this reference. If Company notifies Customer that Data Transfers can be conducted in compliance with Data Protection Law pursuant to an alternative transfer mechanism such as the Data Privacy Framework, the parties will rely on the alternative mechanism to legitimize Data Transfers instead of the provisions that follow.
5.2. SCCs. The parties agree to comply with the general clauses and; (i) where Company acts as a Processor, with Module 2 (Controller to Processor) of the SCCs with Customer as the “data exporter” and Company as the “data importer” ; and (ii) where Company acts as independent Controller, with Module 1 (Controller to Controller) of the SCCs with Customer as the “data exporter” and Company as the “data importer”.
5.3. Transfers Subject to Swiss Data Protection Law. If any Customer Personal Data subject to the Swiss Federal Act on Data Protection of 25 September 2020 (as amended, replaced, or updated from time to time, the “FADP”) is subject to a Data Transfer, the parties will conduct such transfer pursuant to the SCCs with the following modifications: the competent supervisory authority in Annex I.C under Clause 13 shall be the Federal Data Protection and Information Commissioner; references to a “Member State” and “EU Member State” will not be read to prevent individuals in Switzerland from suing for their rights in Switzerland; and references to “GDPR” in the SCCs will be understood as references to the FADP.
5.4. Transfers Subject to the UK GDPR. Any Customer Personal Data that is subject to the UK GDPR and a Data Transfer will be subject to the UK IDTA, which is incorporated and deemed executed by this reference.
Each party’s and all of its affiliates’ liability, taken together in the aggregate, arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the limitation of liability in the Agreement. Nothing in this Section 6 is intended to restrict the rights of individuals under Data Protection Law.
7.1. To the extent there is any conflict between the terms of this DPA, on the one hand, and the applicable SCCs or UK IDTA, on the other hand, the SCCs or UK IDTA, as appropriate, will control. Except as specifically amended and modified by this DPA, the terms and provisions of the Agreement remain unchanged and in full force and effect. Except as expressly stated in the SCCs and the UK IDTA, the governing law and forum selection provisions of the Agreement will apply to any disputes arising out of this DPA. No supplement, modification, or amendment of this DPA will be binding unless executed in writing by each party to this DPA.
7.2. If there is a change in (i) Data Protection Law, or (ii) a determination, decision, or order by a Supervisory Authority or competent court affecting this DPA or the lawfulness of any Processing activities under this DPA, then Read may propose supplements and modifications to this DPA. If the Customer objects to the supplement or modification, then Customer must object to the supplement or modification within thirty (30) days or the right to object is waived. If Customer timely objects to the appropriateness of the supplement or modification, then the parties will work to resolve their differences, and if resolution cannot occur within thirty (30) days of Customer’s notice of objection, then either party may terminate this DPA and any affected portion(s) of the Agreement. All supplements and modifications will be in writing and signed by the parties unless the terms of the Agreement provide otherwise.
7.3. The provisions of this DPA are severable. If any phrase, clause or provision or Attachment (including the SCCs) is invalid or unenforceable in whole or in part, such invalidity or unenforceability shall affect only such phrase, clause or provision, and the rest of this DPA or the remainder of the Attachment, shall remain in full force and effect.
Attachment 1: Definitions
For purposes of this DPA, the following terms will have the meaning ascribed below:
“CCPA” means the California Consumer Privacy Act of 2018, including (a) as amended by the California Privacy Rights Act of 2020 or otherwise and (b) any regulations promulgated thereunder.
“Controller” means “controller” and “business” (and analogous variations of such terms) under Data Protection Law.
“Customer Personal Data” means Personal Data that Company Processes on behalf of Customer in connection with providing the Services as described in Attachment 2. Customer Personal Data does not include Service Data.
“Data Protection Law” means the GDPR, the UK GDPR, the FADP, the CCPA, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Virginia Consumer Data Protection Act, the Utah Consumer Privacy Act, and any other state, federal, or international data protection or privacy laws that apply to Company’s Processing of Customer Personal Data.
"Data Subject” means the identified or identifiable person to whom Personal Data relates.
“Deidentified Data” means information that cannot reasonably be linked to or associated with Customer or any Data Subject.
“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
“Personal Data” means “personal data” and “personal information” (and analogous variations of such terms) under Data Protection Law.
“Process” or ”Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, extending further to such operation or operations under Data Protection Law.
“Processor” means “processor” and “service provider” (and analogous variations of such terms) under Data Protection Law.
“SCCs” means Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on SCCs for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (Text with EEA relevance), available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914, as may be replaced or superseded by the European Commission. For the purposes of Module 2, the parties make the following choices for implementing the SCCs:
A los efectos del Módulo 1, las partes realizan las siguientes elecciones para la implementación de las SCC:
“Incidente de Seguridad” significa «violación de datos personales» e «incidente de seguridad» (y variaciones análogas de dichos términos) según la Ley de Protección de Datos. Para mayor claridad, un Incidente de Seguridad no incluye intentos fallidos o actividades que no comprometan la seguridad de los Datos Personales del Cliente (como intentos de inicio de sesión fallidos, pings, escaneos de puertos, ataques de denegación de servicio u otros ataques de red a cortafuegos o sistemas en red).“Datos del Servicio” significa cualquier dato relacionado con el uso, soporte u operación de los Servicios, que es recopilado directamente por Read de o sobre los usuarios de los Servicios o el uso de los Servicios por parte del Cliente para los propios fines de Read.
“Servicios” significa los servicios prestados por la Empresa de conformidad con el Contrato.
“Autoridad de Control” significa una autoridad pública independiente responsable de supervisar la aplicación de la Ley de Protección de Datos, incluido el Tratamiento de Datos Personales cubierto por este DPA.
“UK GDPR” significa el RGPD tal como se incorporó a la legislación del Reino Unido mediante la Ley de Protección de Datos de 2018 y modificado por el Reglamento de Protección de Datos, Privacidad y Comunicaciones Electrónicas (Modificaciones, etc.) (Salida de la UE) de 2019 (cada uno según haya sido modificado, sustituido o reemplazado).
“UK IDTA” significa el Anexo de Transferencia Internacional de Datos a las Cláusulas Contractuales Tipo de la Comisión de la UE emitido por el Comisionado de Información del Reino Unido, Versión B1.0, en vigor desde el 21 de marzo de 2022, disponible en https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf. Ninguna de las partes podrá rescindir el UK IDTA de conformidad con la Tabla 4 y la Sección 19 del mismo sin el consentimiento por escrito de la otra.
Anexo 2 - Alcance del tratamiento
Exportador de datos
Cliente
Importador de datos
Empresa
Objeto y duración del tratamiento
La Empresa Trata los Datos Personales del Cliente si y cuando son proporcionados por el Cliente en el curso de la prestación de los Servicios de conformidad con el Contrato y hasta que el Contrato finalice o expire.
Naturaleza y finalidad del tratamiento
Tratamiento de Datos Personales del Cliente en relación con y con el propósito de que la Empresa preste los Servicios al Cliente de conformidad con el Contrato. Específicamente, los Datos Personales del Cliente, si y en la medida en que el Cliente los proporcione, estarán sujetos a almacenamiento y análisis, entre otras actividades de Tratamiento.
Tipos de Datos Personales del Cliente
El Cliente puede enviar Datos Personales del Cliente a los Servicios, cuyo alcance es determinado y controlado por el Cliente a su entera discreción. Esto puede incluir, entre otras, las siguientes categorías de datos:
Categorías de Interesados
Los interesados incluirán a los empleados, contratistas y usuarios finales del Cliente.
Categorías Especiales de Datos (según corresponda)
Los Servicios no están diseñados para categorías especiales de Datos Personales. La Empresa no prevé que el Cliente envíe categorías especiales a los Servicios. En la medida en que dichos datos se envíen a los Servicios, serán determinados y controlados por el Cliente a su entera discreción.
Frecuencia de las Transferencias
La Empresa importará los Datos Personales del Cliente de forma continua.
Período de Conservación de Datos
La Empresa conservará los Datos Personales hasta la terminación del Contrato, a menos que las partes acuerden lo contrario.
Anexo 3 - Alcance del Tratamiento (Empresa como Responsable)
Exportador de datos
Cliente
Importador de datos
Empresa
Objeto y duración del tratamiento
La Empresa Trata los Datos Personales del Cliente y los Datos del Servicio para los fines descritos en la Sección 1.5 de este DPA y durante el tiempo que sea necesario para lograr los fines del tratamiento.
Naturaleza y finalidad del tratamiento
Tratamiento de los Datos Personales del Cliente y los Datos del Servicio para los fines descritos en la Sección 1.5 de este DPA. Específicamente, los Datos Personales del Cliente y los Datos del Servicio, si el Cliente los proporciona y en la medida en que lo haga, estarán sujetos a almacenamiento y análisis, entre otras actividades de Tratamiento.
Tipos de Datos Personales
El Cliente puede enviar Datos Personales a los Servicios y la Empresa puede obtener Datos Personales a través de la prestación de los Servicios. Esto puede incluir, entre otras, las siguientes categorías de datos:
Categorías de interesados
Los interesados incluirán a los empleados, contratistas y usuarios finales del Cliente.
Categorías especiales de datos (según corresponda)
Los Servicios no están diseñados para categorías especiales de Datos Personales. La Empresa no prevé que el Cliente envíe categorías especiales a los Servicios y la Empresa no intentará obtener categorías especiales a través de la prestación de sus Servicios.
Frecuencia de las transferencias
La Empresa importará Datos Personales del Cliente y Datos del Servicio de forma continua.
Período de Retención de Datos
La Empresa retendrá los Datos Personales durante el tiempo que sea necesario para lograr sus fines previstos y según se notifique de otro modo a los Interesados en el aviso de privacidad aplicable de la Empresa.
Anexo 4 - Anexo de Seguridad de Datos
%2C%20Color%3DOriginal.png)
