Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Operator Subscription Agreement (the “Agreement”) between Fieldmarks Co. LLC (“Fieldmarks,” “Processor”) and the operator (“Operator,” “Controller”) and applies where Fieldmarks processes Personal Data on the Operator’s behalf.

1. Roles and Scope

For Personal Data that the Operator and its Authorized Users submit to or generate in the Services (“Operator Personal Data”), the Operator is the controller and Fieldmarks is the processor. Fieldmarks processes Operator Personal Data only to provide the Services and as set out in this DPA and Annex 1. Where Fieldmarks determines the purposes and means of processing for its own purposes — in particular creating and using Aggregated Data — Fieldmarks acts as an independent controller for that processing (see Section 13).

2. Definitions

“Data Protection Laws” means all laws applicable to the processing of Operator Personal Data under this DPA, including, as applicable, the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Kenya Data Protection Act, 2019, the Tanzania Personal Data Protection Act, 2022, and applicable U.S. state privacy laws.

“Personal Data,” “processing,” “controller,” “processor,” “data subject,” and “personal data breach” have the meanings given in the GDPR (or the equivalent meanings under other Data Protection Laws).

“Sub-processor” means a third party engaged by Fieldmarks to process Operator Personal Data.

“Standard Contractual Clauses” or “SCCs” means the clauses approved by the European Commission for transfers of Personal Data to third countries.

3. Processing on Instructions

Fieldmarks will process Operator Personal Data only on the Operator’s documented instructions, including as set out in the Agreement, this DPA, and Annex 1, and as needed to provide the Services, unless required by law (in which case Fieldmarks will inform the Operator unless legally prohibited). The Operator is responsible for the accuracy and lawfulness of its instructions and for having a lawful basis to provide the Operator Personal Data and for the notices and consents owed to data subjects.

4. Confidentiality

Fieldmarks ensures that personnel authorized to process Operator Personal Data are bound by confidentiality obligations and process the data only as instructed.

5. Security

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks to data subjects, Fieldmarks will implement appropriate technical and organizational measures to protect Operator Personal Data, as described in Annex 2.

6. Sub-processors

The Operator authorizes Fieldmarks to engage the Sub-processors listed in Annex 3 and others Fieldmarks may appoint to provide the Services. Fieldmarks will impose data-protection obligations on each Sub-processor that are substantially similar to those in this DPA, and remains responsible for its Sub-processors’ performance. Fieldmarks will give the Operator advance notice of any new Sub-processor and a reasonable opportunity to object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Operator may terminate the affected Services.

7. Assistance with Data-Subject Requests

Taking into account the nature of the processing, Fieldmarks will assist the Operator by appropriate technical and organizational measures, insofar as possible, to respond to data-subject requests to exercise their rights. If a data subject contacts Fieldmarks directly, Fieldmarks will, where permitted, refer them to the Operator.

8. Assistance with Compliance, DPIAs, and Consultation

Fieldmarks will provide the Operator with reasonable assistance, considering the information available to Fieldmarks, in meeting the Operator’s obligations to keep the processing secure, to notify personal data breaches, to carry out data protection impact assessments, and to consult with supervisory authorities.

9. Personal Data Breach Notification

Fieldmarks will notify the Operator without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a personal data breach affecting Operator Personal Data, and will provide information reasonably available to it to help the Operator meet its own breach-notification obligations. Fieldmarks’ notification is not an acknowledgment of fault.

10. Return and Deletion

On expiry or termination of the Services, Fieldmarks will retain Operator Personal Data in a dormant state for the 90-day Retention Period described in the Agreement. During that period the Operator may reactivate its subscription, request return of the Operator Personal Data in a commercially reasonable format, or instruct earlier deletion, and Fieldmarks will continue to honor the Operator’s instructions to delete specific data subjects’ Personal Data. At the end of the Retention Period (or earlier on the Operator’s instruction), Fieldmarks will delete Operator Personal Data and existing copies, with deletion from backups completing within Fieldmarks’ standard backup cycle, unless law requires storage. Fieldmarks may satisfy an obligation to delete by anonymizing the data — including within verification and correction audit records — so that it no longer identifies any individual. Aggregated Data is not subject to this Section.

11. Audits and Information

Fieldmarks will make available information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Operator or an auditor it mandates, on reasonable prior notice, during business hours, subject to confidentiality, and no more than once per calendar year unless required by a supervisory authority or following a breach. Fieldmarks may satisfy audit requests by providing third-party audit reports or certifications where available.

12. International Transfers

Where Fieldmarks processes Operator Personal Data in a country that the originating jurisdiction does not regard as providing adequate protection, the parties will rely on a valid transfer mechanism. For EEA and UK data, the Standard Contractual Clauses (with the UK Addendum) are incorporated into this DPA by reference, with Fieldmarks as data importer and the Operator as data exporter, and the details in Annex 1 completing them. For those purposes: Module Two (controller to processor) of the SCCs applies; the optional docking clause does not apply; the general written authorisation option in Clause 9(a) applies, with the notice mechanics in Section 6; for Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland; and for Clause 18, disputes arising from the SCCs are resolved before the courts of Ireland. For Operator Personal Data originating in Kenya or Tanzania, the parties will cooperate in good faith on any registration, permit, or transfer safeguard required under the Kenya Data Protection Act, 2019 or the Tanzania Personal Data Protection Act, 2022, including any cross-border transfer permit required for transfers out of Tanzania.

13. Aggregated and De-identified Data

The Operator acknowledges and agrees that Fieldmarks may create Aggregated Data from Operator Personal Data and use it for its own purposes as an independent controller, provided the Aggregated Data does not identify the Operator, any Guest, or any individual. Fieldmarks is responsible for its own compliance with Data Protection Laws in respect of that controller processing. Once data has been aggregated and de-identified in this way, it is no longer Operator Personal Data or the Operator’s confidential information. This Section survives termination.

14. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions in the Agreement. Nothing in this DPA limits any liability that cannot be limited under Data Protection Laws or affects a data subject’s rights under those laws.

15. General

If there is a conflict between this DPA and the rest of the Agreement on data-protection matters, this DPA controls; the SCCs control over this DPA to the extent of any conflict on transfer matters. This DPA is governed by the law stated in the Agreement, except where Data Protection Laws require otherwise.

Annex 1 — Description of the Processing

Annex 2 — Technical and Organizational Security Measures

Fieldmarks maintains the following measures, reviewed periodically and updated as the Services evolve.

Annex 3 — Approved Sub-processors

Fieldmarks engages the following sub-processors to provide the Services. Fieldmarks imposes data-protection obligations on each as described in Section 6 and will give notice of changes as set out there.

To receive notice of changes to this list, email legal@fieldmarks.co with the subject “Subscribe: sub-processor updates”.