Skip to main content

Yuzucard

Book a demo

SUBCONTRACTING AGREEMENT REGARDING PERSONAL DATA – DPA

Between the undersigned

NEWMIPS, the operator of the YUZUCARD solution, hereinafter referred to as “NEWMIPS” or the “Processor,”

and

The subscriber to the YUZUCARD solution, hereinafter referred to as the “Subscriber” or the “Data Controller,”

Collectively referred to as the “Parties.”

This Data Processing Agreement (hereinafter the “DPA”) supplements the General Terms and Conditions of Sale and Service applicable to the YUZUCARD solution (hereinafter the “GTC”).

In the event of any conflict between this DPA and the GTS regarding the protection of personal data, the provisions of this DPA shall prevail.

1. PURPOSE OF THE DPA

The purpose of this DPA is to define the conditions under which NEWMIPS is authorized to process, on behalf of the Subscriber, personal data in connection with the provision and use of the YUZUCARD solution.

The Parties undertake to comply with applicable regulations regarding the protection of personal data, in particular Regulation (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as any applicable national regulations.

With respect to the processing activities covered by this DPA, the Subscriber acts as the Data Controller and NEWMIPS acts as the Data Processor, provided that the legal conditions for such designations are met.

2. DESCRIPTION OF DATA PROCESSING

2.1 Purpose of Data Processing

NEWMIPS is authorized to process the personal data necessary for the provision, operation, hosting, maintenance, security, and support of the YUZUCARD solution.

2.2 Duration of Processing

Processing shall be carried out for the entire duration of the Contract between the Parties and, following its termination, for the period necessary to fulfill the obligations regarding return, deletion, or retention provided for in this DPA or by applicable regulations.

2.3 Nature of Processing Operations

Processing operations may include, depending on the features used:

  • collection;
  • recording;
  • organization;
  • structuring;
  • storage;
  • access;
  • use;
  • transmission or disclosure, when necessary for the operation of the Service;
  • restriction;
  • deletion or destruction.

2.4 Purposes of Data Processing

Data is processed exclusively for the following purposes:

  • to provide and enable the use of the YUZUCARD solution;
  • to host data and ensure the technical operation of the Service;
  • to manage User accounts and access;
  • ensure the maintenance, security, and technical improvement of the Service;
  • provide assistance and support requested by the Subscriber or authorized Users;
  • prevent, detect, and address technical or security incidents;
  • carry out the Subscriber’s documented instructions in connection with the use of the Service.

2.5 Categories of Data Subjects

Depending on how the YUZUCARD solution is used, data subjects may include, in particular:

  • the Subscriber’s representatives, employees, collaborators, and contacts;
  • Users of the solution;
  • customers, prospects, partners, or other contacts whose data is entered into the solution by the Subscriber or its Users.

2.6 Categories of Data

epending on the features used and the data provided by the Subscriber, the data processed may include, in particular:

  • identification and contact information;
  • professional data;
  • information regarding accounts and access rights;
  • login data and technical logs;
  • content, information, documents, or other data entered or transmitted by the Subscriber and its Users in connection with the use of the Service.

The Subscriber agrees to process, using the SOFTWARE, only the data necessary for its own purposes and to comply with its obligations as the Data Controller.

3. INSTRUCTIONS FROM THE SUBSCRIBER

NEWMIPS processes personal data solely on the basis of documented instructions from the Subscriber, including with respect to any transfers of data to a third country or an international organization, unless NEWMIPS is required to process such data under the applicable law to which it is subject.

In the latter case, NEWMIPS shall inform the Subscriber of this obligation prior to processing, unless applicable law prohibits such notification for compelling reasons of public interest.

The Subscriber’s documented instructions include, in particular, these Terms and Conditions, this DPA, the features used in connection with the Service, and requests sent to NEWMIPS through the channels provided for that purpose.

If NEWMIPS determines that an instruction from the Subscriber constitutes a violation of applicable data protection regulations, it will notify the Subscriber as soon as possible.

4. CONFIDENTIALITY

NEWMIPS ensures that individuals authorized to process personal data in connection with the Service are subject to an appropriate confidentiality obligation or a legal duty of confidentiality.

NEWMIPS restricts access to data to only those individuals who need to know such information to perform their duties.

5. DATA SECURITY

NEWMIPS implements appropriate technical and organizational measures to ensure a level of security appropriate to the risks posed by the processing, taking into account, in particular, the state of the art, the costs of implementation, the nature, scope, context, and purposes of the processing, as well as the risks to the rights and freedoms of data subjects.

These measures may include, depending on the needs and configuration of the Service:

Depending on the needs and configuration of the Service, these measures may include, among others:

  • management of authorizations and access rights;
  • user authentication;
  • protection of access to systems and data;
  • encryption of communications where technically feasible;
  • logging and traceability of certain access events or operations;
  • measures designed to ensure the availability and resilience of systems;
  • backup and restoration procedures, where these are provided for the Service;
  • procedures for detecting and handling security incidents;
  • procedures for evaluating and improving security measures.

The Subscriber acknowledges that the security of data processing also depends on its own measures, in particular the management of User accounts, the confidentiality of login credentials, and the access configuration it implements.

6. USE OF SUBSUBSIDIAR PROCESSORS

The Subscriber authorizes NEWMIPS to use subsubsidiary processors to provide all or part of the Services, particularly with regard to hosting, infrastructure, maintenance, security, communication, or support.

The list of subprocessors used by NEWMIPS for the processing activities covered by this DPA may be provided to the Subscriber upon request or made available by NEWMIPS through any appropriate means.

NEWMIPS imposes appropriate data protection obligations on its subprocessors that are substantially equivalent to those set forth in this DPA, when required by applicable regulations.

In the event that a sub-processor is added or replaced that may process personal data on behalf of the Subscriber, NEWMIPS shall notify the Subscriber in accordance with the procedures set forth in applicable regulations and shall allow the Subscriber, where applicable, to raise reasoned objections.

7. DATA TRANSFERS

NEWMIPS undertakes not to transfer personal data to a country outside the European Economic Area without complying with the applicable requirements regarding international data transfers.

When an international transfer is necessary in connection with the provision of the Service, NEWMIPS ensures that it is based on an appropriate transfer mechanism provided for by applicable regulations.

Additional information regarding any such transfers may be provided to the Subscriber upon request, to the extent that NEWMIPS is authorized to disclose such information.

8. ASSISTANCE TO THE SUBSCRIBER

Given the nature of the processing activities and the information at its disposal, NEWMIPS shall provide reasonable assistance to the Subscriber, to the extent possible, to enable the Subscriber to respond to requests from data subjects to exercise their rights.

When a request to exercise rights is sent directly to NEWMIPS and concerns processing carried out on behalf of the Subscriber, NEWMIPS will forward this request to the Subscriber as soon as possible, unless otherwise required by law.

NEWMIPS shall also provide reasonable assistance to the Subscriber, taking into account the nature of the processing and the available information, in compliance with its obligations relating in particular to:

  • the security of processing;
  • the notification of personal data breaches;
  • the conduct of data protection impact assessments when required;
  • any prior consultations with the supervisory authority.

Any assistance exceeding the normal functionality of the Service or NEWMIPS’s legal obligations may be subject to specific terms and conditions.

9. PERSONAL DATA BREACHES

In the event of a personal data breach involving data processed on behalf of the Subscriber, NEWMIPS shall notify the Subscriber as soon as possible after becoming aware of the breach.

To the extent that information is available, NEWMIPS will provide the Subscriber with the relevant details at its disposal to enable the Subscriber to assess the incident and, if necessary, to fulfill its legal obligations.

NEWMIPS shall take reasonable measures to limit the consequences of the breach and prevent the occurrence of similar incidents, where such measures fall within its responsibility.

10. DOCUMENTATION AND AUDIT

NEWMIPS shall provide the Subscriber with the information reasonably necessary to demonstrate compliance with its obligations under this DPA and applicable regulations.

Subject to reasonable notice, the confidentiality of information relating to NEWMIPS’s other customers, and compliance with applicable security requirements, the Subscriber may request an audit of NEWMIPS’s obligations under this DPA.

The practical arrangements, scope, frequency, and conditions for conducting any audit shall be determined by mutual agreement between the Parties in order to avoid any undue disruption to the operation of the Services or the security of the systems.

11. DISPOSAL OF DATA UPON TERMINATION OF THE AGREEMENT

Upon termination of the Agreement, for any reason whatsoever, NEWMIPS shall, at the Subscriber’s discretion and subject to the Service’s capabilities, return or delete the personal data processed on the Subscriber’s behalf.

The Subscriber is encouraged to retrieve any data of which they wish to retain a copy before the effective date of termination of access to the Service, provided that the SOFTWARE’s features allow for this.

After a reasonable technical retention period has elapsed following the termination of the Agreement, NEWMIPS will delete or anonymize the data, unless required by law to retain it.

Data may remain temporarily in technical backups for the time necessary to complete their normal overwrite or deletion cycle, provided that it is no longer accessible through normal use of the Service and remains protected by appropriate security measures.

12. OBLIGATIONS OF THE SUBSCRIBER

The Subscriber agrees, in particular, to:

  • determine the purposes and means of the processing it carries out using the SOFTWARE;
  • ensure that it has an appropriate legal basis for the processing it carries out;
  • provide data subjects with the information required by applicable regulations;
  • respond to requests from data subjects to exercise their rights;
  • ensure the lawfulness, relevance, and minimization of the data it processes;
  • not use the SOFTWARE to process data in a manner contrary to applicable regulations;
  • provide NEWMIPS with lawful, documented, and sufficiently precise instructions.

The Subscriber remains solely responsible for its own obligations as the Data Controller.

13. TERM AND PRIORITY

This DPA shall take effect upon the effective date of the Agreement and shall remain in effect for the entire duration of the processing activities carried out by NEWMIPS on behalf of the Subscriber.

Obligations that, by their nature, must survive the termination of the Contract—including those relating to confidentiality, security, and the disposition of data—shall remain in effect for as long as necessary to fulfill them.

In the event of changes to applicable regulations or to the Services that require an amendment to this DPA, NEWMIPS may propose an update to this document in order to maintain a contractual framework that complies with applicable requirements.