1. Scope of this Data Processing Addendum (“DPA”)
1.1 This DPA forms part of the Terms between you and SuperNormal with regard to the processing of personal data that is subject to the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"). Terms used herein that are not otherwise defined have the meanings given in the Terms.
1.2 The parties agree that SuperNormal acts as a data processor for you in providing the Service.
2. Processing of personal data
2.1 The parties agree that SuperNormal will process the personal data only for the purposes of providing the Service.
2.2 You acknowledge that SuperNormal is a U.S. company and will process the personal data in the United States. To the extent that any personal data will be transferred from the European Economic Area to the United States, SuperNormal agrees to enter into standard contractual clauses based on the European Commission Decision C(2010)593 or any such clauses amending, replacing or superseding the standard contractual clauses by a European Commission decision or by a decision made by any other authorized body.
3. SuperNormal general obligations
3.1 SuperNormal must ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3.2 SuperNormal shall implement appropriate technical and organizational measures to prevent the personal data from being:
(i) accidentally or unlawfully destroyed, lost or altered,
(ii) disclosed or made available without authorization, or
(iii)otherwise processed in violation of applicable laws.
3.3 The appropriate technical and organizational security measures must be determined with due regard for:
(i) the current state of the art,
(ii) the cost of their implementation, and
(iii)the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.