These terms set out the additional terms requirements and conditions on which we will process personal data when providing services to you. This Agreement contains the mandatory clauses required by article 28(3) of the General Data Protection Regulation ((EU) 2016/679) for Agreements between data controllers.
Subject to our Terms of Service https://wpherc.com/terms (“Terms of Service” or “Agreement”), we (“WPHercules”, “us”) process Personal Data on behalf of the users of those services (“You” or “User”), for which we act as the processor under applicable Data Protection Laws and our users act as the controllers. That Personal Data is referred to as “Controller Data,” as further described below.
By purchasing our services you confirm that you accept these terms of data processing and you agree to comply with them. If you do not agree with these terms, you must not purchase services from us.
List of Parties
For this Agreement Addendum and the Standard Contractual Clauses included on it, the parties are:
- Customer acting as Data exporter(s), User, Data Controller, that has entered into the Agreement with WPHercules for the provision of Services as described in the Terms and Services and this Agreement.
Name, Address, Contact details:
As set out on their agrement of services and invoices.
Activities relevant to the data transferred under these Clauses:
Data exporter’s use of data importer’s services and data exporter’s customers’ websites and services
- WPHercules (Angel Fernandez Plaza) acting as Data Importer and Data Processor
Address: 91 Hazelwood Drive, St Albans, AL4 0UY.
Email: [email protected]
Activities relevant to the data transferred under these Clauses:
The data processing provided for by these standard contractual clauses is executed for the purpose of providing the services described in the Terms of Service.
1.- Definitions and interpretation
The following definitions and rules of interpretation apply in this Agreement.
1.1.- Definitions
- Data Subject: An individual who is the subject of Personal Data.
- Personal Data: Means any information relating to an identified or identifiable natural person that is processed by the Data Processor as a result of, or in connection with, the provision of the services; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
- Processing, processes and process: Either any activity that involves the use of Personal Data or as the Data Protection Legislation may otherwise define processing, processes or process. It includes any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording. organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Processing also includes transferring Personal Data to third parties.
- Data Protection Legislation: All applicable privacy and data protection laws including the General Data Protection Regulation ((EU) 2016/679) and any applicable national implementing laws, regulations and secondary legislation in England and Wales relating to the processing of Personal Data and the privacy of electronic communications, as amended, replaced or updated from time to time, including the Privacy and Electronic Communications Directive (2002/58/EC) and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426) and also the Retained General Data Protection Regulation (EU) 2016/679 and applicable UK laws from the end of the Brexit implementation period.
- Personal Data Breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.
- Standard Contractual Clauses (SCC): The European Commission’s Standard Contractual Clauses for the transfer of Personal Data from the European Union to processors established in third countries as set out in Commission Decision 2010/87/EU.
1.2.- rules of interpretation
This Agreement is subject to the terms of any separate agreement made between the parties for the supply of services (“Services Agreement”) and is incorporated into any such Agreement. Interpretations and defined terms set forth in the Services Agreement apply to the interpretation of this Agreement. The Annexes form part of this Agreement and will have effect as if set out in full in the body of this Agreement. Any reference to this Agreement includes the Annexes. A reference to writing or written excludes faxes and e-mail.
In the case of conflict or ambiguity between:
- Any provision contained in the body of this Agreement and any provision contained in the Annexes, the provision in the body of this Agreement will prevail;
- The terms of any accompanying invoice or other documents annexed to this Agreement and any provision contained in the Annexes, the provision contained in the Annexes will prevail; and
- Any of the provisions of this Agreement and the provisions of the Services Agreement, the provisions of the Services Agreement will prevail.
This agreement is in addition to and does not remove or replace a party’s obligations under the Data Protection Legislation.
Role of the Parties
The Data Controller acknowledges that for the purposes of fulfilling its obligations under the Agreement, the Data Processor may have access to and may be required to process Personal Data (as defined in the Data Protection Legislation) on behalf of the Data Controller. By accepting the Agreement, the Data Controller authorises the Data Processor to process its Personal Data in accordance with the terms of the Privacy Ploicy.
The parties acknowledge that for the purposes of the Data Protection Legislation, the Data Controller is the data controller, and the Data Processor is the data processor (where Data Controller and Data Processor have the meanings as defined in the Data Protection Legislation).
2.- Scope of the Processing
The Data Controller retains control of the Personal Data and remains responsible for its compliance obligations under the applicable Data Protection Legislation, including providing any required notices and obtaining any required consents, and for the processing instructions it gives to the Data Processor.
The instructions of the User are in principle conclusively stipulated and documented in the provisions of this Addendum. Individual instructions which deviate from the stipulations of this Addendum or which impose additional requirements shall require the data Processor written agreement. The data Processor will immediately inform the User if an instruction from the User infringes applicable data protection law.
Where the Data Processor is relying on laws of a member of the European Union or European Union law as the basis for processing Personal Data, the Data Processor shall promptly notify the Data Controller of this before performing the processing required by the Applicable Laws unless those Applicable Laws prohibit the Data Processor from so notifying the Data Controller;
2.1.- Data processor obligations
The data processor certifies that it will not:
(a) collect, retain, use, disclose or otherwise process the Controller Data for any purpose other than as necessary for the specific purpose of performing the services on behalf of the User;
(b) collect, retain, use or disclose the Controller Data for a commercial purpose other than providing the services on behalf of the User;
(c) process the Controller Data outside of the direct business relationship between User and the Processor;
(d) combine the Controller Data with any other Personal Data the Processor collects (directly or via any third party) other than as expressly permitted for processors under Data Protection Legislation; or
(e) “sell” or “share” the Controller Data.
2.2.- Personal data types and processing purposes
The Processor processes Controller Data for the purpose of providing the website creation and management services to our Users. Controller Data is comprised exclusively of Personal Data relating to data subjects who use a User’s website, which may include a User’s customers, subscribers, followers, employees or other administrative users. Controller Data does not include content or Personal Data collected by the Processor about any of the foregoing persons in that person’s capacity as a user of WordPress.com or another service provided directly to the person by the Processor (including as specified in Section 2.7 and 2.8 below).
The type of Controller Data processed by the Processor depends on the services and features that the User decides to implement for the User’s website, and may include username and credentials; name; contact information, such as e-mail address, physical address, and telephone number; billing information, such as credit card data and billing address; website usage information, IP address, and other technical data such as browser type, unique device identifiers, language preference, referring site, the date and time of access, operating system, and mobile network information; approximate location data (from IP address); personal information discussed in the content of the site or any content you upload, information regarding interactions with the website, such as “comments,” poll responses, “ratings,” and “likes”; and other information directly provided to the User’s website by a visitor to the website, such as contact form submissions.
The duration of processing corresponds to the duration of the Agreement, which is described in the Terms of Service.
2.3.- User obligations
User shall comply with its obligations under Data Protection Laws. The User is responsible for the lawfulness of the processing of the Controller Data. In case third parties assert a claim against the data processor based on the unlawfulness of processing Controller Data or any other violation of Data Protection Law by User, the User shall release the data processor from any and all such claims.
2.4.- Depersonalise data
User agrees that the data Processor may depersonalise (including through deidentification) the Controller Data or aggregate data in a way which does not permit the identification of a natural person, as well as use the data in this form for purposes of designing, further developing, optimizing, and providing its services to the User as well as to other users of the service, provided that if such data is “deidentified” (as defined under Data Protection Law), the data Processor will take reasonable measures designed to ensure such data cannot be associated with a natural person and will commit to maintain this data in deidentified form and not attempt to reidentify this data except to assess the sufficiency of the deidentification. The parties agree that the Controller Data rendered depersonalised or aggregated as above-mentioned are no longer classified as Controller Data in terms of this Addendum and that the data Processor is instructed by User to depersonalise Controller Data in accordance with this clause.
2.5.- Other data
In some cases, the data processor may collect, use, and disclose any User data (“User Data”) which is distinct from Controller Data in accordance with the WPHercules privacy policy, which is available at https://wpherc.com/terms/privacy-policy/. User Data may include any information collected by WPHercules from or about a visitor to User’s website (including any contributor or editor). We may collect this data for internal security porpurses. The parties agree that WPHercules processing of User Data is independent of the services that WPHercules provides directly to the User for the User’s website, and is not subject to this Addendum.
3.- Personnel Requirements
The Processor shall ensure that all personnel who have access to and/or process Personal Data are obliged to keep the Personal Data confidential.
4.-Security of Processing
The Processor shall ensure that it has in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage and the nature of the data to be protected, having regard to the state of technological development and the cost of implementing any measures (those measures may include, where appropriate, pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of the technical and organisational measures adopted by it);
The Processor shall have the right to modify technical and organisational measures during the term
of the Agreement, as long as they continue to comply with the requirements under Data Protection
Legislation.
5.- Support Obligations
If so reasonably required, the Data Processor shall:
- Assist the Data Controller, at the Data Controller’s cost, in responding to any request from a Data Subject and in ensuring compliance with its obligations under the Data Protection Legislation with respect to security, breach notifications, impact assessments, and consultations with supervisory authorities or regulators;
- Notify the Data Controller without undue delay on becoming aware of a Personal Data breach;
- If so reasonably required, at the written direction of the Data Controller, delete or return Personal Data and copies thereof to the Data Controller on termination of the agreement unless required by Applicable Law to store the Personal Data; and
- If so reasonably required, maintain complete and accurate records and information to demonstrate its compliance.
6.- Sub-processors
In accepting these Terms and Conditions, the Data Controller consents to the Data Processor appointing third-party processors of Personal Data (“the Sub Processors”) under this agreement.
The Data Processor shall enter into a written agreement with the Sub Processors, incorporating terms substantially similar to those prior to appointing any Sub Processor.
The Data Controller accepts that for the purposes of this Agreement, part or all of its Personal Data may need to be processed outside of the UK or EEA. The Data Controller further consents to the Data Processor processing its Personal Data by appointing these third-party processors referred to in section 5 (Glossary) who are located outside of the UK / EEA.
The Data Controller shall have the ability to withdraw its consent to the Data Processor’s use of Sub Processors for the purposes of fulfilling this Agreement by notifying the Data Processor in writing at its registered office. However, the Data Controller acknowledges that the Data Processor may not be able to perform the Services or any part of the Services unless it is able to appoint an alternative Sub Processor. If an alternative Sub Processor cannot be appointed, the Data Processor shall not be obliged to provide any part of the Services that are affected.
The Data Processor may, at any time on not less than 30 days’ notice, revise this clause 3 by replacing it with any applicable controller to processor standard clauses or similar terms forming part of an applicable certification scheme (which shall apply when replaced by attachment to this agreement).
The Processor shall make available to the User the current list of sub-processors at the following link: https://wpherc.com/terms/privacy-policy/third-party-subprocessors/. User should check this website regularly for updates.
Through this link, the Processor shall provide notice to the User of any intended changes concerning
the addition or replacement of sub-processors. The User is entitled to object to any intended
change. An objection may only be raised by the User for important reasons which have to be
proven to the Processor. Insofar as the User does not object within 14 days after the notification
date, the User’s right to object to the corresponding engagement lapses. If the User objects,
the Processor is entitled to terminate the Agreement on reasonable notice.
7.- Deletion and Return of Controller Data
Upon termination of the Terms of Service the Processor shall delete all Controller Data, unless the Processor is obligated by law to further store Controller Data as specified on the Privacy Policy.
8.- Term and termination
This Agreement will remain in full force and effect as long as:
- The Services Agreement remains in effect or the Data Processor provides the relevant services to the Data Controller, or
- The Data Processor retains any Personal Data related to the Services Agreement and/or the services in its possession or control.
Any provision of this Agreement that expressly or by implication should come into or continue in force on or after termination of the Services Agreement or the provision of services by the Data Processor to the Data Controller (as may be applicable) in order to protect Personal Data will remain in full force and effect.
If a change in any Data Protection Legislation prevents either party from fulfilling all or part of its obligations to the other party, the parties will suspend the processing of Personal Data until that processing complies with the new requirements. If the parties are unable to bring the Personal Data processing into compliance with the Data Protection Legislation within 28 days, they may terminate the Services Agreement and/or the provision of services on written notice to the other party without prejudice to any right or remedy the parties may have under the Services Agreement or otherwise.
9.- Evidence and Audits
User has the right to take reasonable and appropriate steps to help to ensure that the Processor processes the Controller Data in accordance with requirements of this Addendum.
The Processor shall ensure that the processing of Controller Data is consistent with this Addendum, comply with all obligations applicable to it as a processor under Data Protection Legislation, and provide the same level of privacy protection as is required by Data Protection Legislation.
The Processor shall document the implementations of the obligations under this Addendum in an
appropriate manner and provide the User with appropriate evidence at the latter’s reasonable
request.
10.- Transfer of Controller Data
In processing the Controller Data as part of the Agreement, the Processor may have to transfer the Controller Data outside of the European Union, the United Kingdom. When the Processor does such a transfer, it will do so via the applicable mechanism outlined below.
10.1.- General conditions for transfering data:
- The Data Controller or the Data Processor has provided appropriate safeguards in relation to the transfer;
- The data subject has enforceable rights and effective legal remedies;
- The Data Processor complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any Personal Data that is transferred; and
- The Data Processor complies with reasonable instructions notified to it in advance by the Data Controller with respect to the processing of the Personal Data.
10.2.- For Controller Data Transferred Outside of the European Union
For any Controller Data that is transferred outside of the European Union to a Third Country , the
parties agree to be bound by the Standard Contractual Clauses” as further shown in Annex A.
“Standard Contractual Clauses” means the standard contractual clauses for the transfer of
personal data to processors in third countries according to Decision (EU) 2021/914 of the EU
Commission of 4 June 2021.
“Third Country” means a country that the EU has not recognized as providing an equivalent level
of protection for personal data as the EU.
10.3.- For Controller Data Transferred Outside of the United Kingdom
For any Controller Data subject to the UK GDPR that is transferred outside of the United Kingdom
to a Third Country, the parties agree to be bound by the UK Addendum as outlined in Annex A.
“UK Addendum” means the Addendum to the Standard Contractual Clauses issued by the UK
Information Commissioner, in force 21 March 2022.
“UK GDPR” means the GDPR as incorporated into United Kingdom law by the Data Protection Act
2018 and amended by the Data Protection, Privacy and Electronic Communications
(Amendments etc.) (EU Exit) Regulations 2019 (each as amended, superseded, or replaced). For
purposes of any Controller Data subject to the UK GDPR, references to the GDPR in this DPA will
be replaced with references to the UK GDPR.
11.- Notice and communication
Any notice or other communication given to a party under or in connection with this Agreement must be in writing and delivered to:
For the Data Controller: The address provided under the Services Agreement.
For the Data Processor: The address provided under the Services Agreement or on this document above.
A notice given under this agreement is valid if sent by post or by e-mail.
12.- General
If any provision or part-provision of this Agreement is or becomes invalid, illegal, or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid, legal, and enforceable. If such modification is not possible, the relevant provision or part-provision shall be deemed deleted. Any modification to or deletion of a provision or part-provision under this clause shall not affect the validity and enforceability of the rest of this Agreement.
If any provision or part-provision of this Agreement is invalid, illegal, or unenforceable, the parties shall negotiate in good faith to amend such provision so that, as amended, it is legal, valid, and enforceable, and, to the greatest extent possible, achieves the intended commercial result of the original provision.
Waiver: A waiver of any right under this Agreement or law is only effective if it is in writing and shall not be deemed to be a waiver of any subsequent breach or default. No failure or delay by a party in exercising any right or remedy provided under this Agreement or by law shall constitute a waiver of that or any other right or remedy, nor shall it prevent or restrict its further exercise of that or any other right or remedy. No single or partial exercise of such right or remedy shall prevent or restrict the further exercise of that or any other right or remedy.
No partnership or agency: Nothing in this Agreement is intended to, or shall be deemed to, establish any partnership or joint venture between the parties, nor constitute either party the agent of the other for any purpose. Neither party shall have authority to act as agent for, or to bind, the other party in any way.
Third parties: A person who is not a party to this Agreement shall not have any rights to enforce its terms.
Variation: Except as set out in these Conditions, no variation of this Agreement, including the introduction of any additional terms and conditions, shall be effective unless it is agreed in writing and signed by the Data Processor.
Governing law: This Agreement, and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims), shall be governed by, and construed in accordance with the law of England.
Jurisdiction: Each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this Agreement or its subject matter or formation (including non-contractual disputes or claims).
ANNEX A Standard Contractual Clauses (processors)
For Controller Data transferred outside of the European Union:
For transfers outside of the European Union, the parties agree to be bound by the Standard Contractual Clauses. The Standard Contractual Clauses (linked below) are incorporated into this Data Processing Addendum: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914&from=EN There are certain sections of the Standard Contractual Clauses that require population or selection which are outlined in the following table for simplicity:
Section Reference Concept Selection by the Parties
Clause 7 Docking Clause The option under clause 7 shall not apply
Section II, Clause 9 Approval of Subprocessors Option 2: GENERAL WRITTEN AUTHORIZATION
Section IV, Clause 17 Governing law The laws of England and Wales insofar as transfers are governed by UK Data Protection Laws
Section IV, Clause 18 (b) Choice of forum and jurisdiction The courts of England and Wales shall have exclusive jurisdiction to resolve any dispute or lawsuit arising out of or in connection with this Addendum
Annex I.A List of Parties The parties on this Agreement.
Annex I.B Description of Transfer As described on ANNEX C
Annex I.C Competent Supervisory Authority the UK’s Information Commissioner
Annex II Technical and Organisational Measures See Annex B of this Agreement
Annex III List of Subprocessors As described on this Agreement
Further, if the Standard Contractual Clauses are implemented, adopted, or recognized as a legitimate data transfer mechanism in countries other than the EEA countries, then it shall apply the Standard Contractual Clauses to the transfer of Personal Data originating from such country(-ies).
For Controller Data to be transferred outside of the United Kingdom.
For transfers outside of the United Kingdom, the parties are able to use a UK Addendum. The UK Addendum (linked below) is incorporated into this Data Processing Addendum: https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-addendum.pdf In using the UK Addendum, similar to the Standard Contractual Clauses, there are certain sections of the UK Addendum that require population or selection and are outlined in the following table for simplicity:
Section Reference Concept Selection by the Parties
Clause 7 Docking Clause The option under clause 7 shall not apply
Clause 11 Redress The option under clause 11 shall not apply
Section II, Clause 9(a) Approval of Sub processors Option 2: GENERAL WRITTEN AUTHORIZATION
Section IV, Clause 17 Governing law The laws of England and Wales insofar as transfers are governed by UK Data Protection Laws
Section IV, Clause 18 (b) Choice of forum and jurisdiction The courts of England and Wales shall have exclusive jurisdiction to resolve any dispute or lawsuit arising out of or in connection with this UK Addendum
Annex I.A List of Parties The parties on this Agreement.
Annex I.B Description of Transfer As described on ANNEX C
Annex I.C Competent Supervisory Authority the UK’s Information Commissioner
Annex II Technical and Organisational Measures See Annex B of this Agreement
Annex III List of Subprocessors As described on this Agreement
Section 19 0f UK Addendum End of UK Addendum when the Approved Addendum changes Neither party may end this UK Addendum per Section 19 of the UK Addendum, except as set forth in the Agreement
ANNEX B Security
The Data processor maintains safeguards designed to protect Controller Data from unauthorised access, use and disclosure. The Data processor currently abides by the security standards below and may update or modify these security standards from time to time, provided that such updates and modifications will not result in a degradation of the overall security of the services during the term of the User’s Agreement.
More information about the security can be found on the link:
https://wpherc.com/terms/privacy-policy/security-policy/
ANNEX C. DESCRIPTION OF TRANSFER
Categories of data subjects whose personal data is transferred
Data exporter’s employees, users, customers, and the personal data of any data subject the data exporter provides the data importer in connection the services.
Categories of personal data transferred
The type of data processed by data importer depends on the services and features that the data exporter uses, and may include personal data contained in content (text and media); username and credentials, such as password hashes; name; contact information, such as e-mail address, physical address, and telephone number; billing information, such as credit card data and billing address; website usage information, IP address, and other technical data such as browser type, unique device identifiers, language preference, referring site, the date and time of access, operating system, and mobile network information; approximate location data (from IP address); information regarding interactions with the website, such as “comments,” poll responses, “ratings,” and “likes”; and other information directly provided by data exporter to a website, such as contact form submissions.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures
None.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)
Continuous for the term of the services agreement between the data exporter and data importer.
Nature of the processing
Collection, use, organisation, and storage.
Purpose(s) of the data transfer and further processing
The data processing provided for by these standard contractual clauses is executed for the purpose of providing the services described in the Terms of Service.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
The data importer will retain personal data for as long as necessary to provide the services and fulfil the transactions requested by the data exporter, or for other business purposes such as complying with our legal obligations, resolving disputes, and enforcing the data importer’s agreements.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
The data importer may share personal data with sub-processors for the subject matter and nature described in our Privacy Policy, available at https://wpherc.com/privacy-policy. Sub-processors retain personal data for the duration of time necessary to perform sub-processing activities under the agreement between the data importer and the sub-processor.