This Data Processing Agreement ("DPA") supplements the Terms of Service (the "Agreement") between Xevendra and a design partner or customer ("Customer") wherever Xevendra processes personal data on Customer's behalf in connection with the Xevendra platform — for example, survey respondent data, behavioral analytics data, or other end-customer data Customer collects through the platform. Where this DPA conflicts with the Agreement on matters of data processing, this DPA governs.
"Controller," "Processor," "Data Subject," "Personal Data," "Processing," and "Personal Data Breach" have the meanings given in the GDPR. "Customer Data" means Personal Data that Customer or its authorized users submit to, or collect through, the Xevendra platform in the course of Xevendra providing the platform to Customer. "Data Protection Law" means the GDPR and other applicable data protection law. "Sub-processor" means a third party Xevendra engages to process Customer Data on Xevendra's behalf.
2.1 Role of the parties. As between Xevendra and Customer, Customer is the Controller of Customer Data and Xevendra processes Customer Data only as a Processor acting on Customer's behalf.
2.2 Xevendra's processing; no sale. Xevendra will process Customer Data in compliance with Data Protection Law, will not sell Customer Data, and will not retain, use, or disclose Customer Data for any purpose other than performing the services described in the Agreement and this DPA.
2.3 Customer's processing. Customer is responsible for ensuring it has a lawful basis to collect Customer Data and to have Xevendra process it on Customer's behalf, including obtaining any consents required under Data Protection Law from the individuals Customer surveys or tracks through the platform.
2.4 Processing instructions. Xevendra will process Customer Data only on Customer's documented instructions — as set out in the Agreement and as reflected by Customer's configuration and use of the platform — unless processing is required by law, in which case Xevendra will inform Customer of that legal requirement before processing, unless the law prohibits doing so.
2.5 Details of processing. The subject matter, duration, nature, and purpose of processing, and the categories of data subjects and Personal Data, are set out in Annex A.
2.6 Prohibited data. Customer will not configure the platform to collect, or submit directly, any payment card data, bank account or transaction data, government identification or passport numbers, or special category data (data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, or data about sex life or sexual orientation). If Customer does so anyway, Xevendra is not responsible for liability arising from processing that data.
3.1 Authorized sub-processors. Customer authorizes Xevendra to engage Sub-processors to process Customer Data, provided Xevendra imposes data protection obligations on each Sub-processor consistent with this DPA. Xevendra remains responsible for each Sub-processor's performance to the same extent as for its own.
3.2 Current sub-processors: Microsoft Azure (hosting infrastructure, Frankfurt, Germany). This list will be kept accurate and current as infrastructure changes.
3.3 Changes; objection. Xevendra will give Customer reasonable advance notice of any new Sub-processor. Customer may object on reasonable data protection grounds within 10 days of notice; the parties will discuss the objection in good faith.
4.1 Security measures. Xevendra will implement and maintain appropriate technical and organizational measures to protect Customer Data, as described in Annex B.
4.2 Confidentiality of processing. Xevendra ensures that personnel authorized to process Customer Data are bound by confidentiality obligations, whether contractual or statutory.
4.3 Breach notification. Xevendra will notify Customer without undue delay — and in any case within 72 hours of becoming aware — of any Personal Data Breach affecting Customer Data, and will provide reasonably available information to help Customer meet its own notification obligations.
4.4 Customer responsibilities. Customer is responsible for its own secure use of the platform, including protecting its account credentials and the security of Customer Data before it reaches the platform.
On reasonable written notice, and no more than once in any 12-month period, Customer may request information reasonably necessary to verify Xevendra's compliance with this DPA, or conduct a direct audit during normal business hours without undue disruption to Xevendra's operations. Customer bears the cost of any audit unless it reveals a material breach by Xevendra, in which case Xevendra bears its own costs.
Customer Data is hosted on Microsoft Azure in Frankfurt, Germany, within the European Economic Area. If Customer Data is nonetheless transferred outside the EEA — for example, by a Sub-processor — the parties will rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses, incorporated by reference into this DPA to the extent required by Data Protection Law.
At the end of the relationship, at Customer's choice, Xevendra will make Customer Data available for export, and will delete all remaining Customer Data within 30 days — unless applicable law requires continued retention.
Xevendra will reasonably assist Customer in responding to requests from Data Subjects exercising their rights under Data Protection Law, and in any data protection impact assessment Customer is required to carry out in connection with the platform. If Xevendra receives a request directly from a Data Subject, Xevendra will not respond to it itself, and will instead forward it to Customer without undue delay.
9.1 Except for the changes made by this DPA, the Agreement remains unchanged and in full force. If there is a conflict between this DPA and the Agreement on matters of data processing, this DPA prevails.
9.2 Each party's liability under this DPA is subject to the limitation of liability set out in the Agreement.
9.3 This DPA remains in effect for as long as Xevendra processes Customer Data on Customer's behalf, and terminates automatically with the Agreement.
9.4 This DPA is governed by the laws of Germany, consistent with the Agreement.
Data exporter: Customer, as identified in the Agreement. Role: Controller.
Data importer: Xevendra UG (haftungsbeschränkt), Fromet-und-Moses-Mendelssohn-Platz 3, 10969 Berlin, Germany. Contact: privacy@xevendra.com. Role: Processor.
Categories of data subjects: Customer's own customers, survey respondents, website visitors, and end-users who interact with Customer's properties through the Xevendra platform; and employees or contacts of Customer who access the platform.
Categories of Personal Data: Determined by Customer's configuration and use of the platform. Typically includes identification and contact data (name, email), survey and feedback responses, behavioral and usage data (pages visited, interactions, device/browser information), and any other data Customer chooses to collect through the platform.
Sensitive data: None — see the Prohibited Data restriction in Section 2.6.
Frequency of transfer: Continuous, for the duration of the Agreement.
Nature and purpose of processing: Collection, storage, analysis, and action management of Customer Data to provide the Xevendra platform to Customer, on Customer's instructions.
Duration: For the term of the Agreement, then as set out in Section 7.